Ticket #42619: 42619.diff

src/wp-admin/includes/class-wp-automatic-updater.php

@@ -55 +55 @@
                 return apply_filters( 'automatic_updater_disabled', $disabled );
         }
 
+        public function is_allowed_dir( $dir ) {
+                $open_basedir = ini_get('open_basedir');
+
+                if ( !$open_basedir ) {
+                        return true;
+                }
+
+                $open_basedir_dirs = explode(PATH_SEPARATOR, $open_basedir);
+
+                foreach ( $open_basedir_dirs as $basedir ) {
+                        if ( strpos( $dir, $basedir ) === 0 ) {
+                                return true;
+                        }
+                }
+
+                return false;
+}
+
         /**
          * Check for version control checkouts.
          *
@@ -101 +119 @@
                 // Search all directories we've found for evidence of version control.
                 foreach ( $vcs_dirs as $vcs_dir ) {
                         foreach ( $check_dirs as $check_dir ) {
-                                $checkout = @is_dir( rtrim( $check_dir, '\\/' ) . "/$vcs_dir" );
+                                $checkout = $this->is_allowed_dir( $check_dir ) && @is_dir( rtrim( $check_dir, '\\/' ) . "/$vcs_dir" );
                                 if ( $checkout ) {
                                         break 2;
                                 }