The latest WordPress security releases (7.1.2, backported to 7.0.6, 6.8.x, and older branches) changed how locate_template() works. It now rejects any template name containing .. unless the file resolves inside the theme directory. See _wp_is_template_path_allowed() in wp-includes/template.php.
This breaks any Acorn project whose Blade views live outside the theme directory.
Who is affected
- Radicle projects
- Bedrock + Acorn projects with
resources/viewsat the project root instead of inside the theme - Any project using generoi/sage-woocommerce with that layout
Not affected: standard Sage themes where resources/views lives inside the theme directory.
Why
Acorn tells WordPress about your Blade views by adding them to the template hierarchy as paths relative to the theme directory. When views are outside the theme, those paths look like ../../../../resources/views/index.blade.php. WordPress now silently drops every one of them.
Symptoms
Theme templates: WordPress falls back to the theme’s index.php, which is the tiny shim that renders sage.view. With no view to render, it renders itself, forever. You’ll see one of:
Fatal error: Allowed memory size of 134217728 bytes exhausted in vendor/illuminate/view/FileViewFinder.php
or with Xdebug:
Xdebug has detected a possible infinite loop, and aborted your script with a stack depth of '512' frames
with themes/<your-theme>/index.php:3 repeating down the stack trace. wp-admin keeps working, which makes it easy to miss.
WooCommerce templates: no error at all. sage-woocommerce also calls locate_template() for its Blade candidates, gets nothing back, and WooCommerce quietly falls back to its own core PHP templates. Shop, product, cart, checkout, and account pages render, but with WooCommerce’s default markup instead of your views.
Fix for Acorn
Fixed in roots/acorn#572. Update to Acorn v6.3.0 or later:
composer update roots/acorn
Acorn now re-resolves its own Blade candidates after WordPress runs locate_template(), and only accepts a .. path when it resolves into a registered view directory. The WordPress hardening still applies to everything else.
Fix for sage-woocommerce
Fixed in generoi/sage-woocommerce/#41. Update to sage-woocommerce v1.1.5 or later.
Quick check
Not sure if you’re affected? On WordPress 7.0.6+ with the old Acorn, this returns your theme’s index.php instead of a Blade view:
wp eval 'echo get_query_template("index"), PHP_EOL;'
After updating Acorn it should print the absolute path to index.blade.php.
Do not roll back WordPress
These are security releases. Update Acorn (and sage-woocommerce if you use it) rather than pinning WordPress to an older version.
Awesome work.