Ticket #48316: 48316.diff

src/wp-includes/functions.php

@@ -1924 +1924 @@
         }
 
         // Do not allow path traversals.
-        if ( false !== strpos( $target, '../' ) || false !== strpos( $target, '..' . DIRECTORY_SEPARATOR ) ) {
-                return false;
+        if (1 === validate_file($target)) {
+                $_sanitized_target = str_replace('/', DIRECTORY_SEPARATOR, $target);
+                $_target_parts     = explode('/', $_sanitized_target);
+
+                $keys = array_keys($_target_parts, '..');
+                foreach ($keys AS $keypos => $key) {
+                        array_splice($_target_parts, $key - ($keypos * 2 + 1), 2);
+                }
+                $_sanitized_target = implode(DIRECTORY_SEPARATOR, $_target_parts);
+
+                $_allowed_base_directories = apply_filters('allowed_base_directories', [ABSPATH]);
+                $_allowed                  = false;
+
+                foreach ($_allowed_base_directories AS $_allowed_base_directory) {
+                        if (0 === strpos($_sanitized_target, $_allowed_base_directory)) {
+                                $_allowed = true;
+                                break;
+                        }
+                }
+
+                if ( ! $_allowed) {
+                        return false;
+                }
         }
 
         // We need to find the permissions of the parent folder that exists and inherit that.