From a60b30444fa1e626fa1362873fc0f8ae63c6eb81 Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov@git.wordpress.org>
Date: Mon, 18 May 2020 16:01:38 +0000
Subject: [PATCH] Themes: Prevent installation of themes that require a higher
 version of PHP or WordPress.

Props afragen.
Fixes #49653. See #48491.

git-svn-id: https://develop.svn.wordpress.org/trunk@47819 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-admin/includes/theme.php               |  9 +++--
 src/wp-admin/theme-install.php                | 33 ++++++++++++++-----
 .../class-wp-customize-manager.php            |  8 +++--
 .../class-wp-customize-theme-control.php      |  6 +++-
 4 files changed, 42 insertions(+), 14 deletions(-)

diff --git a/src/wp-admin/includes/theme.php b/src/wp-admin/includes/theme.php
index 09473c1a50..5c5afee52a 100644
--- a/src/wp-admin/includes/theme.php
+++ b/src/wp-admin/includes/theme.php
@@ -827,8 +827,13 @@ function customize_themes_print_templates() {
 						<button class="button button-primary disabled"><?php _e( 'Live Preview' ); ?></button>
 					<# } #>
 				<# } else { #>
-					<button type="button" class="button theme-install" data-slug="{{ data.id }}"><?php _e( 'Install' ); ?></button>
-					<button type="button" class="button button-primary theme-install preview" data-slug="{{ data.id }}"><?php _e( 'Install &amp; Preview' ); ?></button>
+					<# if ( data.compatibleWP && data.compatiblePHP ) { #>
+						<button type="button" class="button theme-install" data-slug="{{ data.id }}"><?php _e( 'Install' ); ?></button>
+						<button type="button" class="button button-primary theme-install preview" data-slug="{{ data.id }}"><?php _e( 'Install &amp; Preview' ); ?></button>
+					<# } else { #>
+						<button type="button" class="button disabled"><?php _ex( 'Cannot Install', 'theme' ); ?></button>
+						<button type="button" class="button button-primary disabled"><?php _e( 'Install &amp; Preview' ); ?></button>
+					<# } #>
 				<# } #>
 			</div>
 		</div>
diff --git a/src/wp-admin/theme-install.php b/src/wp-admin/theme-install.php
index 6e890f5da1..b1b1eaf4fc 100644
--- a/src/wp-admin/theme-install.php
+++ b/src/wp-admin/theme-install.php
@@ -311,12 +311,21 @@ if ( $tab ) {
 					<# } #>
 				<# } #>
 			<# } else { #>
-				<?php
-				/* translators: %s: Theme name. */
-				$aria_label = sprintf( __( 'Install %s' ), '{{ data.name }}' );
-				?>
-				<a class="button button-primary theme-install" data-name="{{ data.name }}" data-slug="{{ data.id }}" href="{{ data.install_url }}" aria-label="<?php echo esc_attr( $aria_label ); ?>"><?php _e( 'Install' ); ?></a>
-				<button class="button preview install-theme-preview"><?php _e( 'Preview' ); ?></button>
+				<# if ( data.compatible_wp && data.compatible_php ) { #>
+					<?php
+					/* translators: %s: Theme name. */
+					$aria_label = sprintf( __( 'Install %s' ), '{{ data.name }}' );
+					?>
+					<a class="button button-primary theme-install" data-name="{{ data.name }}" data-slug="{{ data.id }}" href="{{ data.install_url }}" aria-label="<?php echo esc_attr( $aria_label ); ?>"><?php _e( 'Install' ); ?></a>
+					<button class="button preview install-theme-preview"><?php _e( 'Preview' ); ?></button>
+				<# } else { #>
+					<?php
+					/* translators: %s: Theme name. */
+					$aria_label = sprintf( __( 'Cannot Install %s' ), '{{ data.name }}' );
+					?>
+					<a class="button button-primary disabled" data-name="{{ data.name }}" aria-label="<?php echo esc_attr( $aria_label ); ?>"><?php _ex( 'Cannot Install', 'theme' ); ?></a>
+					<button class="button disabled"><?php _e( 'Preview' ); ?></button>
+				<# } #>
 			<# } #>
 		</div>
 	</div>
@@ -333,9 +342,17 @@ if ( $tab ) {
 			<button class="previous-theme"><span class="screen-reader-text"><?php _e( 'Previous theme' ); ?></span></button>
 			<button class="next-theme"><span class="screen-reader-text"><?php _e( 'Next theme' ); ?></span></button>
 			<# if ( data.installed ) { #>
-				<a class="button button-primary activate" href="{{ data.activate_url }}"><?php _e( 'Activate' ); ?></a>
+				<# if ( data.compatible_wp && data.compatible_php ) { #>
+					<a class="button button-primary activate" href="{{ data.activate_url }}"><?php _e( 'Activate' ); ?></a>
+				<# } else { #>
+					<a class="button button-primary disabled" ><?php _ex( 'Cannot Activate', 'theme' ); ?></a>
+				<# } #>
 			<# } else { #>
-				<a href="{{ data.install_url }}" class="button button-primary theme-install" data-name="{{ data.name }}" data-slug="{{ data.id }}"><?php _e( 'Install' ); ?></a>
+				<# if ( data.compatible_wp && data.compatible_php ) { #>
+					<a href="{{ data.install_url }}" class="button button-primary theme-install" data-name="{{ data.name }}" data-slug="{{ data.id }}"><?php _e( 'Install' ); ?></a>
+				<# } else { #>
+					<a class="button button-primary disabled" ><?php _ex( 'Cannot Install', 'theme' ); ?></a>
+				<# } #>
 			<# } #>
 		</div>
 		<div class="wp-full-overlay-sidebar-content">
diff --git a/src/wp-includes/class-wp-customize-manager.php b/src/wp-includes/class-wp-customize-manager.php
index 2342089302..ce325118f5 100644
--- a/src/wp-includes/class-wp-customize-manager.php
+++ b/src/wp-includes/class-wp-customize-manager.php
@@ -5853,9 +5853,11 @@ final class WP_Customize_Manager {
 				$theme->active = ( isset( $_POST['customized_theme'] ) && $_POST['customized_theme'] === $theme->slug );
 
 				// Map available theme properties to installed theme properties.
-				$theme->id           = $theme->slug;
-				$theme->screenshot   = array( $theme->screenshot_url );
-				$theme->authorAndUri = wp_kses( $theme->author['display_name'], $themes_allowedtags );
+				$theme->id            = $theme->slug;
+				$theme->screenshot    = array( $theme->screenshot_url );
+				$theme->authorAndUri  = wp_kses( $theme->author['display_name'], $themes_allowedtags );
+				$theme->compatibleWP  = is_wp_version_compatible( $theme->requires );
+				$theme->compatiblePHP = is_php_version_compatible( $theme->requires_php );
 
 				if ( isset( $theme->parent ) ) {
 					$theme->parent = $theme->parent['slug'];
diff --git a/src/wp-includes/customize/class-wp-customize-theme-control.php b/src/wp-includes/customize/class-wp-customize-theme-control.php
index 9c5e7602cf..270547baaf 100644
--- a/src/wp-includes/customize/class-wp-customize-theme-control.php
+++ b/src/wp-includes/customize/class-wp-customize-theme-control.php
@@ -133,7 +133,11 @@ class WP_Customize_Theme_Control extends WP_Customize_Control {
 				<div class="theme-id-container">
 					<h3 class="theme-name" id="{{ data.section }}-{{ data.theme.id }}-name">{{ data.theme.name }}</h3>
 					<div class="theme-actions">
-						<button type="button" class="button button-primary theme-install preview" aria-label="<?php echo esc_attr( $install_label ); ?>" data-slug="{{ data.theme.id }}" data-name="{{ data.theme.name }}"><?php _e( 'Install &amp; Preview' ); ?></button>
+						<# if ( data.theme.compatibleWP && data.theme.compatiblePHP ) { #>
+							<button type="button" class="button button-primary theme-install preview" aria-label="<?php echo esc_attr( $install_label ); ?>" data-slug="{{ data.theme.id }}" data-name="{{ data.theme.name }}"><?php _e( 'Install &amp; Preview' ); ?></button>
+						<# } else { #>
+							<button type="button" class="button button-primary disabled" aria-label="<?php echo esc_attr( $install_label ); ?>" disabled><?php _e( 'Install &amp; Preview' ); ?></button>
+						<# } #>
 					</div>
 				</div>
 			<# } #>