require_once normalization

changelog.md

@@ -37,6 +37,7 @@ This release contains bug fixes for Largo 0.6.
 - If Co-Authors Plus is active, and if a post has an `author` term, but the term has no corresponding `guest-author` post, when running `largo_byline()`, the byline will now contain an HTML comment informing why the byline is empty. If the `WP_DEBUG` or `LARGO_DEBUG` constants are true, Largo will add a message to the server's error log of the form "post 123 should have at least one co-author, but has none!" [Pull request #1607](https://github.com/INN/largo/pull/1607) for [Automattic/Co-Authors-Plus#637](https://github.com/Automattic/Co-Authors-Plus/issues/637) and as part of the general cleanup ticket [#1492](https://github.com/INN/largo/issues/1492).
 - Fix for posts with "Featured in category" selected not displaying on category RSS feeds. [Pull request #1668](https://github.com/INN/largo/pull/1668) for [issue #1598](https://github.com/INN/largo/issues/1598).
 - Fixes issue where prominence terms were not saving with the Block Editor, because the "Post Prominence" metabox was output twice. [Pull request #1655](https://github.com/INN/largo/pull/1655) for [issue #1654](https://github.com/INN/largo/issues/1654).
+- Uses `validate_file()` when using `require_once`. [Pull request #1589](https://github.com/INN/largo/pull/1589) for [issue #1494](https://github.com/INN/largo/issues/1494).
 - Further cleans up undefined variables.
 
 ### Upgrade notices

functions.php

@@ -104,7 +104,9 @@
  */
 if ( ! function_exists( 'optionsframework_init' ) ) {
 	define( 'OPTIONS_FRAMEWORK_DIRECTORY', get_template_directory_uri() . '/lib/options-framework/' );
-	require_once dirname( __FILE__ ) . '/lib/options-framework/options-framework.php';
+	if ( 0 == validate_file( get_template_directory() . '/lib/options-framework/options-framework.php' ) ) {
+		require_once get_template_directory() . '/lib/options-framework/options-framework.php';
+	}
 }
 
 /**
@@ -186,21 +188,23 @@ private function require_files() {
 			$includes[] = '/inc/custom-less-variables.php';
 		}
 
-		foreach ( $includes as $include ) {
-			require_once( get_template_directory() . $include );
-		}
-
 		// If the plugin is already active, don't cause fatals
 		if ( ! class_exists( 'Navis_Media_Credit' ) ) {
-			require_once dirname( __FILE__ ) . '/lib/navis-media-credit/navis-media-credit.php';
+			$includes[] = '/lib/navis-media-credit/navis-media-credit.php';
 		}
 
 		if ( ! class_exists( 'Navis_Slideshows' ) ) {
-			require_once dirname( __FILE__ ) . '/lib/navis-slideshows/navis-slideshows.php';
+			$includes[] = '/lib/navis-slideshows/navis-slideshows.php';
 		}
 
 		if ( ! function_exists( 'clean_contact_func' ) ) {
-			require_once dirname( __FILE__ ) . '/lib/clean-contact/clean_contact.php';
+			$includes[] = '/lib/clean-contact/clean_contact.php';
+		}
+
+		foreach ( $includes as $include ) {
+			if ( 0 === validate_file( get_template_directory() . $include ) ) {
+				require_once( get_template_directory() . $include );
+			}
 		}
 
 	}
@@ -388,14 +392,17 @@ function largo_php_warning() {
 /*
  * This functionality is probably not for everyone so we'll make it easy to turn it on or off
  */
-if ( of_get_option( 'custom_landing_enabled' ) && of_get_option( 'series_enabled' ) )
+if ( of_get_option( 'custom_landing_enabled' ) && of_get_option( 'series_enabled' ) ) {
 	$includes[] = '/inc/wp-taxonomy-landing/taxonomy-landing.php'; // adds taxonomy landing plugin
+}
 
 /*
  * Perform load
  */
 foreach ( $includes as $include ) {
-	require_once( get_template_directory() . $include );
+	if ( 0 === validate_file( get_template_directory() . $include ) ) {
+		require_once( get_template_directory() . $include );
+	}
 }
 
 if ( ! function_exists( 'largo_setup' ) ) {

homepages/homepage-class.php

@@ -1,8 +1,18 @@
 <?php
 
-if (empty($wp_filesystem)) {
-	require_once(ABSPATH . 'wp-admin/includes/file.php');
-	WP_Filesystem();
+if ( empty( $wp_filesystem ) ) {
+	if ( 0 === validate_file( ABSPATH . 'wp-admin/includes/file.php' ) ) {
+		require_once( ABSPATH . 'wp-admin/includes/file.php' );
+		WP_Filesystem();
+	} else {
+		wp_die(
+			sprintf(
+				esc_html__( 'The WP_Filesystem class could not be found by %1$s', 'largo' ),
+				__FILE__
+			),
+			'WP_Filesystem'
+		);
+	}
 }
 
 class Homepage {

inc/avatars/admin.php

@@ -75,8 +75,17 @@ function largo_save_avatar_field($user_id) {
 				);
 				$id = wp_insert_attachment($args, $file['file']);
 
-				if (!is_wp_error($id)) {
-					require_once(ABSPATH . 'wp-admin/includes/image.php');
+				if ( ! is_wp_error( $id ) ) {
+					if ( 0 === validate_file( ABSPATH . 'wp-admin/includes/image.php' ) ) {
+						require_once( ABSPATH . 'wp-admin/includes/image.php' );
+					} else {
+						wp_die(
+							sprintf(
+								esc_html__( 'wp-admin/includes/image.php could not be loaded by %1$s', 'largo' ),
+								__FILE__
+							)
+						);
+					}
 					// Generate the metadata for the attachment, and update the database record.
 					$metadata = wp_generate_attachment_metadata($id, $file['file']);
 					$update = wp_update_attachment_metadata($id, $metadata);