Fix Windows path separator incompatibility in handle_imports

[Copilot]

On Windows/IIS, realpath() returns paths with backslashes while the constructed $filename uses forward slashes, causing the security check to always fail and block all imports.

Changes

• Normalize both paths using wp_normalize_path() before comparison
• Store realpath() result to avoid duplicate calls and enable explicit false-check for non-existent files

// Before
if ( $filename !== realpath( $filename ) ) {
    continue;
}

// After
$realpath = realpath( $filename );
if ( ! $realpath || wp_normalize_path( $filename ) !== wp_normalize_path( $realpath ) ) {
    continue;
}

The security check (directory traversal prevention) remains intact since realpath() resolves the canonical path before normalization.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>on Windows/IIS the function handle_imports not work correctly due to the path separator.</issue_title>
<issue_description>the function handle_imports in the file class.add-from-server.php not work correctly on windows,the code below:

if ( $filename !== realpath( $filename ) ) {
continue;
}

on Windows/IIS,the path separator are '\', '$filename !== realpath( $filename )' always is true.
</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes on Windows/IIS the function handle_imports not work correctly due to the path separator. #5

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.