Usually, you don’t need it. But … there is at least one edge case:
- If a theme file is a template part,
- and it is using global variables from the calling context (parent file),
- and register_globals is
on, - and it is just using these variables without any security check …
… an attacker can call this file, set the missing variables with GET or POST and make the theme file print those out. And then there is a security problem.
So … the best option is not a context check like the one from your example, but good code: avoid global variables, check their content before you print it out.
Related Posts:
- Worthwhile to restrict direct access of theme files?
- Should `get_template_directory_uri()` be escaped?
- Is it good to rename theme folder downloaded from WordPress.org?
- How to sanitize select box values in post meta?
- When to use esc_url, esc_html, esc_attr, and friends?
- Where i should not use if (!defined(‘ABSPATH’)) { exit; }?
- Whats the safest way to output custom JavaScript and Css code entered by the admin in the Theme Settings?
- Is it safe to enqueue a font style without putting http or https?
- Using esc_url with a hard coded url
- What is the safe way to print tracking code / pixel code before tag or tag
- Underscore Based Theme File Permissions in Git
- correct tags for validating input types
- How to escape multiple attribute at once in WordPress?
- Contact Form Security
- Do I need to escape get_the_post_thumbnail function?
- Strict Folder and File Permissions for WordPress Themes Folder
- hide theme files for admin beneath root
- Should we escape the values of constants?
- If necessary, how should wp_get_attachment_image() and its parameters be escaped?
- How do I add version control to my workflow?
- Using classes instead of global functions in functions.php
- Child Theme vs Duplicate Theme Renamed
- Setting multiple default background images?
- How to make a theme with more than one CSS file?
- Is it feasible to build and update a WordPress website offline?
- Theme Review: post thumbnail, header image, content width
- How to determine if a category is empty?
- The seventh parameter passed to add_submenu_page()
- What would happen if the admin installs a plugin when the plugin is included in the theme?
- How do I get my child-theme to work with my theme’s includes folder?
- wp_insert_post breaks rewrite rules
- Where can I find a good reviewed collection of Twenty Ten child themes?
- how to create theme based widget that can be drop in sider bar or footer
- CSS in child theme not overriding the parent theme [closed]
- Template Hierarchy for get_header()
- Remove frameborder attribute from iframes
- how do I get a sidebar’s id or number for use with is_active_sidebar()
- Looking for the code in twentyten that allows users to select images for the header/banner
- WordPress as a data intensive web app
- How to determine which custom header image is being shown
- using wordpress without javascript
- Theme Check: Could not find post_class
- Override theme programmatically
- Custom URL parameters in template files
- How do I remove TinyMCE text format
- can’t understand _e function well
- WP 3.1 upgrade breaks AutoFocus+ theme
- Change content layout based on menu hierarchy
- Theme Loading Into Dashboard
- How to make theme elements customizable in wordpress?
- How to filter or remove the “title” attribute from category links
- Change “Thumbnail”, “Medium” and “Large” image sizes using functions.php?
- How to obtain a reference to the_excerpt() from custom loop
- defining a folder location in order to recall it
- Remove CPT slug from URL WordPress
- JavaScript stops working on selectively refreshed sections one inside the other
- Why doesn’t my css work when I check my theme on mobile devices? [closed]
- WooCommerce: multiple input field for multiple product variations
- Where WordPress Stores The Custom Fields Values
- How to unset a set query variable?
- Theming Using Bootstrap Glyphicons and WordPress Dashicons
- Overide enqueue in non plugable function via child theme
- Overrride buddypress theme function [closed]
- Custom Post Type Query issue
- WP_editor doesnt apply wpautop on single line content
- Starting point for custom Themes [closed]
- How to order by multiple date meta_values?
- How to safely return the HTML?
- How do I modify the ‘more’ link in a feed
- Create something that can be added or removed in Customizer
- Menu dispareing when visititing current page [closed]
- I need to develop a one-page design
- index.php file in wp-content/themes/ folder
- WordPress dashboard
- Implementing HTML/CSS menu in WordPress theme
- show_option_none not working in meta box
- Is there a template tag I can use to link to the archive page corresponding to the month that a post was published on?
- Hide/disable sidebar using shortcode?
- Where are the options “template” and “current_theme” derived from
- How do I open a post in a custom page in wordpress?
- A Reviews Page is Showing root Index.php instead of Template-Page
- Pages not displaying as sections on static page
- How to test another theme in a live WordPress website instead of live preview?
- custom js script is not loading
- Template for front page (latest posts)
- Theme option page doesn’t save options
- Can’t upload images on new theme
- footer menu changes primary menu
- Primary Menu Showing All Pages With No Sub-Nav
- wp_update_comment not working
- WordPress 3.9 two menus in same position?
- Image load issue with custom page template on Internet Explorer
- Custom widgets in theme option page
- Showcase your wordpress themes [closed]
- Develop theme with demo default content, programmatically create pages
- the_author() str_replace error
- Block to show posts from same category
- How can I enforce user to use Application password to generate JWT token? [closed]
- Only show read more text when when wp:post-excerpt meets excerptLength
- Which is recommended to learn first: classic themes or block themes?