WordPress · aristath · Oct 13, 2022 · Oct 13, 2022 · Oct 13, 2022 · Oct 13, 2022
diff --git a/src/index.php b/src/index.php
@@ -11,16 +11,18 @@
 	define( 'ABSPATH', __DIR__ . '/' );
 }
 
-/*
- * Load the actual index.php file if the assets were already built.
- * Note: WPINC is not defined yet, it is defined later in wp-settings.php.
- */
-if ( file_exists( ABSPATH . 'wp-includes/js/dist/edit-post.js' ) ) {
+if ( ! defined( 'WPINC' ) ) {
+	define( 'WPINC', 'wp-includes' );
+}
+
+require_once ABSPATH . WPINC . '/class-wp-autoload.php';
+
+// Load the actual index.php file if the assets were already built.
+if ( file_exists( ABSPATH . WPINC . '/js/dist/edit-post.js' ) ) {
 	require_once ABSPATH . '_index.php';
 	return;
 }
 
-define( 'WPINC', 'wp-includes' );
 require_once ABSPATH . WPINC . '/version.php';
 require_once ABSPATH . WPINC . '/compat.php';
 require_once ABSPATH . WPINC . '/load.php';

diff --git a/src/wp-admin/custom-background.php b/src/wp-admin/custom-background.php
@@ -10,6 +10,3 @@
  */
 
 _deprecated_file( basename( __FILE__ ), '5.3.0', 'wp-admin/includes/class-custom-background.php' );
-
-/** Custom_Background class */
-require_once ABSPATH . 'wp-admin/includes/class-custom-background.php';
diff --git a/src/wp-admin/custom-header.php b/src/wp-admin/custom-header.php
@@ -10,6 +10,3 @@
  */
 
 _deprecated_file( basename( __FILE__ ), '5.3.0', 'wp-admin/includes/class-custom-image-header.php' );
-
-/** Custom_Image_Header class */
-require_once ABSPATH . 'wp-admin/includes/class-custom-image-header.php';
diff --git a/src/wp-admin/includes/admin.php b/src/wp-admin/includes/admin.php
@@ -42,9 +42,6 @@
 /** WordPress Misc Administration API */
 require_once ABSPATH . 'wp-admin/includes/misc.php';
 
-/** WordPress Misc Administration API */
-require_once ABSPATH . 'wp-admin/includes/class-wp-privacy-policy-content.php';
-
 /** WordPress Options Administration API */
 require_once ABSPATH . 'wp-admin/includes/options.php';
 
@@ -55,7 +52,6 @@
 require_once ABSPATH . 'wp-admin/includes/post.php';
 
 /** WordPress Administration Screen API */
-require_once ABSPATH . 'wp-admin/includes/class-wp-screen.php';
 require_once ABSPATH . 'wp-admin/includes/screen.php';
 
 /** WordPress Taxonomy Administration API */
@@ -65,8 +61,6 @@
 require_once ABSPATH . 'wp-admin/includes/template.php';
 
 /** WordPress List Table Administration API and base class */
-require_once ABSPATH . 'wp-admin/includes/class-wp-list-table.php';
-require_once ABSPATH . 'wp-admin/includes/class-wp-list-table-compat.php';
 require_once ABSPATH . 'wp-admin/includes/list-table.php';
 
 /** WordPress Theme Administration API */
@@ -75,18 +69,9 @@
 /** WordPress Privacy Functions */
 require_once ABSPATH . 'wp-admin/includes/privacy-tools.php';
 
-/** WordPress Privacy List Table classes. */
-// Previously in wp-admin/includes/user.php. Need to be loaded for backward compatibility.
-require_once ABSPATH . 'wp-admin/includes/class-wp-privacy-requests-table.php';
-require_once ABSPATH . 'wp-admin/includes/class-wp-privacy-data-export-requests-list-table.php';
-require_once ABSPATH . 'wp-admin/includes/class-wp-privacy-data-removal-requests-list-table.php';
-
 /** WordPress User Administration API */
 require_once ABSPATH . 'wp-admin/includes/user.php';
 
-/** WordPress Site Icon API */
-require_once ABSPATH . 'wp-admin/includes/class-wp-site-icon.php';
-
 /** WordPress Update Administration API */
 require_once ABSPATH . 'wp-admin/includes/update.php';
 

diff --git a/src/wp-admin/includes/ajax-actions.php b/src/wp-admin/includes/ajax-actions.php
@@ -366,8 +366,6 @@ function wp_ajax_autocomplete_user() {
  * @since 4.8.0
  */
 function wp_ajax_get_community_events() {
-	require_once ABSPATH . 'wp-admin/includes/class-wp-community-events.php';
-
 	check_ajax_referer( 'community_events' );
 
 	$search         = isset( $_POST['location'] ) ? wp_unslash( $_POST['location'] ) : '';
@@ -1935,10 +1933,6 @@ function wp_ajax_wp_link_ajax() {
 
 	$args['pagenum'] = ! empty( $_POST['page'] ) ? absint( $_POST['page'] ) : 1;
 
-	if ( ! class_exists( '_WP_Editors', false ) ) {
-		require ABSPATH . WPINC . '/class-wp-editor.php';
-	}
-
 	$results = _WP_Editors::wp_link_query( $args );
 
 	if ( ! isset( $results ) ) {
@@ -4025,7 +4019,6 @@ function wp_ajax_crop_image() {
 
 	switch ( $context ) {
 		case 'site-icon':
-			require_once ABSPATH . 'wp-admin/includes/class-wp-site-icon.php';
 			$wp_site_icon = new WP_Site_Icon();
 
 			// Skip creating a new attachment if the attachment is a Site Icon.
@@ -4176,7 +4169,6 @@ function wp_ajax_install_theme() {
 		wp_send_json_error( $status );
 	}
 
-	require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
 	require_once ABSPATH . 'wp-admin/includes/theme.php';
 
 	$api = themes_api(
@@ -4308,8 +4300,6 @@ function wp_ajax_update_theme() {
 		$status['oldVersion'] = $theme->get( 'Version' );
 	}
 
-	require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
-
 	$current = get_site_transient( 'update_themes' );
 	if ( empty( $current ) ) {
 		wp_update_themes();
@@ -4469,7 +4459,6 @@ function wp_ajax_install_plugin() {
 		wp_send_json_error( $status );
 	}
 
-	require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
 	require_once ABSPATH . 'wp-admin/includes/plugin-install.php';
 
 	$api = plugins_api(
@@ -4641,8 +4630,6 @@ function wp_ajax_update_plugin() {
 		$status['oldVersion'] = sprintf( __( 'Version %s' ), $plugin_data['Version'] );
 	}
 
-	require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
-
 	wp_update_plugins();
 
 	$skin     = new WP_Ajax_Upgrader_Skin();
@@ -5368,10 +5355,6 @@ function wp_ajax_health_check_dotorg_communication() {
 		wp_send_json_error();
 	}
 
-	if ( ! class_exists( 'WP_Site_Health' ) ) {
-		require_once ABSPATH . 'wp-admin/includes/class-wp-site-health.php';
-	}
-
 	$site_health = WP_Site_Health::get_instance();
 	wp_send_json_success( $site_health->get_test_dotorg_communication() );
 }
@@ -5401,10 +5384,6 @@ function wp_ajax_health_check_background_updates() {
 		wp_send_json_error();
 	}
 
-	if ( ! class_exists( 'WP_Site_Health' ) ) {
-		require_once ABSPATH . 'wp-admin/includes/class-wp-site-health.php';
-	}
-
 	$site_health = WP_Site_Health::get_instance();
 	wp_send_json_success( $site_health->get_test_background_updates() );
 }
@@ -5434,10 +5413,6 @@ function wp_ajax_health_check_loopback_requests() {
 		wp_send_json_error();
 	}
 
-	if ( ! class_exists( 'WP_Site_Health' ) ) {
-		require_once ABSPATH . 'wp-admin/includes/class-wp-site-health.php';
-	}
-
 	$site_health = WP_Site_Health::get_instance();
 	wp_send_json_success( $site_health->get_test_loopback_requests() );
 }
@@ -5484,10 +5459,6 @@ function wp_ajax_health_check_get_sizes() {
 		wp_send_json_error();
 	}
 
-	if ( ! class_exists( 'WP_Debug_Data' ) ) {
-		require_once ABSPATH . 'wp-admin/includes/class-wp-debug-data.php';
-	}
-
 	$sizes_data = WP_Debug_Data::get_sizes();
 	$all_sizes  = array( 'raw' => 0 );
 

diff --git a/src/wp-admin/includes/class-ftp.php b/src/wp-admin/includes/class-ftp.php
@@ -904,8 +904,6 @@ function PopError(){
 	$mod_sockets = extension_loaded( 'sockets' );
 }
 
-require_once __DIR__ . "/class-ftp-" . ( $mod_sockets ? "sockets" : "pure" ) . ".php";
-
 if ( $mod_sockets ) {
 	class ftp extends ftp_sockets {}
 } else {

diff --git a/src/wp-admin/includes/class-wp-filesystem-ftpsockets.php b/src/wp-admin/includes/class-wp-filesystem-ftpsockets.php
@@ -32,11 +32,6 @@ public function __construct( $opt = '' ) {
 		$this->method = 'ftpsockets';
 		$this->errors = new WP_Error();
 
-		// Check if possible to use ftp functions.
-		if ( ! require_once ABSPATH . 'wp-admin/includes/class-ftp.php' ) {
-			return;
-		}
-
 		$this->ftp = new ftp();
 
 		if ( empty( $opt['port'] ) ) {

diff --git a/src/wp-admin/includes/class-wp-privacy-data-export-requests-list-table.php b/src/wp-admin/includes/class-wp-privacy-data-export-requests-list-table.php
@@ -7,10 +7,6 @@
  * @since 4.9.6
  */
 
-if ( ! class_exists( 'WP_Privacy_Requests_Table' ) ) {
-	require_once ABSPATH . 'wp-admin/includes/class-wp-privacy-requests-table.php';
-}
-
 /**
  * WP_Privacy_Data_Export_Requests_Table class.
  *

diff --git a/src/wp-admin/includes/class-wp-privacy-data-removal-requests-list-table.php b/src/wp-admin/includes/class-wp-privacy-data-removal-requests-list-table.php
@@ -7,10 +7,6 @@
  * @since 4.9.6
  */
 
-if ( ! class_exists( 'WP_Privacy_Requests_Table' ) ) {
-	require_once ABSPATH . 'wp-admin/includes/class-wp-privacy-requests-table.php';
-}
-
 /**
  * WP_Privacy_Data_Removal_Requests_List_Table class.
  *

diff --git a/src/wp-admin/includes/class-wp-site-health-auto-updates.php b/src/wp-admin/includes/class-wp-site-health-auto-updates.php
@@ -9,15 +9,6 @@
 
 #[AllowDynamicProperties]
 class WP_Site_Health_Auto_Updates {
-	/**
-	 * WP_Site_Health_Auto_Updates constructor.
-	 *
-	 * @since 5.2.0
-	 */
-	public function __construct() {
-		require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
-	}
-
 
 	/**
 	 * Runs tests to determine if auto-updates can run.
@@ -135,10 +126,6 @@ public function test_filters_automatic_updater_disabled() {
 	 * @return array|false The test results. False if auto-updates are enabled.
 	 */
 	public function test_wp_automatic_updates_disabled() {
-		if ( ! class_exists( 'WP_Automatic_Updater' ) ) {
-			require_once ABSPATH . 'wp-admin/includes/class-wp-automatic-updater.php';
-		}
-
 		$auto_updates = new WP_Automatic_Updater();
 
 		if ( ! $auto_updates->is_disabled() ) {

diff --git a/src/wp-admin/includes/class-wp-site-health.php b/src/wp-admin/includes/class-wp-site-health.php
@@ -1718,10 +1718,6 @@ public function get_test_background_updates() {
 			'test'        => 'background_updates',
 		);
 
-		if ( ! class_exists( 'WP_Site_Health_Auto_Updates' ) ) {
-			require_once ABSPATH . 'wp-admin/includes/class-wp-site-health-auto-updates.php';
-		}
-
 		/*
 		 * Run the auto-update tests in a separate class,
 		 * as there are many considerations to be made.
@@ -2315,6 +2311,77 @@ public function get_test_file_uploads() {
 		return $result;
 	}
 
+	/**
+	 * Tests if any of the WordPress Core classes are overridden.
+	 *
+	 * @since 6.6.0
+	 *
+	 * @return array
+	 */
+	public static function get_test_core_classes_paths() {
+		$overridden_classes = array();
+		/*
+		 * Bypass check for WP_Object_Cache.
+		 *
+		 * It is intended that persistent caching plugins replace the core version
+		 * of WP_Object_Cache with their own version so it shouldn't be reported
+		 * as an error in site health.
+		 */
+		$wp_core_classes = WP_Autoload::CLASSES_PATHS;
+		unset( $wp_core_classes['wp_object_cache'] );
+		foreach ( $wp_core_classes as $class_name => $class_path ) {
+			$default_path = ABSPATH . $class_path;
+
+			/*
+			 * Init a Reflection class to get the real path of the class.
+			 * This is performed inside an output buffer to avoid any errors
+			 * that might be thrown by the ReflectionClass constructor.
+			 */
+			ob_start();
+			$reflection = new \ReflectionClass( $class_name );
+			ob_end_clean();
+
+			if ( $default_path !== $reflection->getFileName() ) {
+				$overridden_classes[ $reflection->getName() ] = $reflection->getFileName();
+			}
+		}
+
+		$result = array(
+			'label'       => __( 'All WordPress Core classes can be properly loaded' ),
+			'status'      => 'good',
+			'badge'       => array(
+				'label' => __( 'Security' ),
+				'color' => 'blue',
+			),
+			'description' => sprintf(
+				'<p>%s</p>',
+				__( 'Plugins and Themes should not override the default WordPress Core classes, as that might lead to unexpected side-effects on your site.' )
+			),
+			'actions'     => '',
+			'test'        => 'core_classes_paths',
+		);
+
+		if ( ! empty( $overridden_classes ) ) {
+			$result['status'] = 'critical';
+			$result['label']  = __( 'WordPress Core classes are being overridden' );
+			$result['description'] .= sprintf(
+				'<p>%s</p>',
+				__( 'The following WordPress Core classes are being overridden:' )
+			);
+
+			$result['description'] .= '<table class="widefat striped health-check-table">';
+			foreach ( $overridden_classes as $class_name => $class_path ) {
+				$result['description'] .= '<tr>';
+				$result['description'] .= '<th><code>' . esc_html( $class_name ) . '</code></th>';
+				$result['description'] .= '<td><code>' . esc_html( $class_path ) . '</code></td>';
+				$result['description'] .= '</tr>';
+			}
+			$result['description'] .= '</table>';
+		}
+
+		return $result;
+	}
+
 	/**
 	 * Tests if the Authorization header has the expected values.
 	 *
@@ -2830,6 +2897,12 @@ public static function get_tests() {
 			);
 		}
 
+		// Check for Core classes being overridden.
+		$tests['direct']['core_classes_paths'] = array(
+			'label' => __( 'Core classes paths' ),
+			'test'  => 'core_classes_paths',
+		);
+
 		/**
 		 * Filters which site status tests are run on a site.
 		 *

diff --git a/src/wp-admin/includes/class-wp-upgrader-skins.php b/src/wp-admin/includes/class-wp-upgrader-skins.php
@@ -9,36 +9,3 @@
  */
 
 _deprecated_file( basename( __FILE__ ), '4.7.0', 'class-wp-upgrader.php' );
-
-/** WP_Upgrader_Skin class */
-require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader-skin.php';
-
-/** Plugin_Upgrader_Skin class */
-require_once ABSPATH . 'wp-admin/includes/class-plugin-upgrader-skin.php';
-
-/** Theme_Upgrader_Skin class */
-require_once ABSPATH . 'wp-admin/includes/class-theme-upgrader-skin.php';
-
-/** Bulk_Upgrader_Skin class */
-require_once ABSPATH . 'wp-admin/includes/class-bulk-upgrader-skin.php';
-
-/** Bulk_Plugin_Upgrader_Skin class */
-require_once ABSPATH . 'wp-admin/includes/class-bulk-plugin-upgrader-skin.php';
-
-/** Bulk_Theme_Upgrader_Skin class */
-require_once ABSPATH . 'wp-admin/includes/class-bulk-theme-upgrader-skin.php';
-
-/** Plugin_Installer_Skin class */
-require_once ABSPATH . 'wp-admin/includes/class-plugin-installer-skin.php';
-
-/** Theme_Installer_Skin class */
-require_once ABSPATH . 'wp-admin/includes/class-theme-installer-skin.php';
-
-/** Language_Pack_Upgrader_Skin class */
-require_once ABSPATH . 'wp-admin/includes/class-language-pack-upgrader-skin.php';
-
-/** Automatic_Upgrader_Skin class */
-require_once ABSPATH . 'wp-admin/includes/class-automatic-upgrader-skin.php';
-
-/** WP_Ajax_Upgrader_Skin class */
-require_once ABSPATH . 'wp-admin/includes/class-wp-ajax-upgrader-skin.php';