Make WordPress Core

Opened 11 years ago

Closed 11 years ago

#13772 closed defect (bug) (duplicate)

_unzip_file_ziparchive fails with open_basedir in effect

Reported by: tinuzz Owned by: dd32
Milestone: Priority: normal
Severity: normal Version: 3.0
Component: Upgrade/Install Keywords: reporter-feedback
Focuses: Cc:


wp-admin/includes/file.php contains a function called _unzip_file_ziparchive, that is used -at least- for automatically upgrading plugins.

In this function, the list of needed directories, that it is passed as the third argument, is expanded, so that is contains all the parent directories of every needed directory, up to '/'.

After that, for each path component, starting with '/', an attempt to create it is made, and if that fails, its existence is checked with $wp_filesystem->is_dir().

Now, when FS_METHOD == "direct" and open_basedir is in effect, $wp_filesystem->is_dir('/') returns false, and it does this for every directory that is outside the open_basedir.

The result is, that the action fails with the message "Could not create directory. /".

I think that Wordpress should not try and create directories /above/ its own installation directory. Wordpress trying to do mkdir('/') is juist plain stupid.

A check should be implemented so that Wordpress will only attempt to create directories /below/ WP_CONTENT_DIR.

Change History (5)

#1 @tinuzz
11 years ago

Forgot to mention: this is Wordpress running on PHP 5.3.2.

#2 @tinuzz
11 years ago

A patch, that made it work for me:

--- file.php.orig 2010-06-07 19:03:55.000000000 +0000
+++ file.php 2010-06-07 19:08:24.000000000 +0000
@@ -601,7 +601,6 @@

$needed_dirs[] = $to . untrailingslashit(dirname($infoname?));


  • $needed_dirs = array_unique($needed_dirs);

foreach ( $needed_dirs as $dir ) {

Check the parent folders of the folders all exist within the creation array.
if ( untrailingslashit($to) == $dir )
Skip over the working directory, We know this exists (or will exist)

@@ -609,10 +608,16 @@

$parent_folder = dirname($dir);
while ( !empty($parent_folder) && untrailingslashit($to) != $parent_folder && !in_array($parent_folder, $needed_dirs) ) {

  • $needed_dirs[] = $parent_folder;
  • $parent_folder = dirname($parent_folder);

+ if (substr(WP_CONTENT_DIR, 0, strlen($parent_folder)) != $parent_folder) {
+ $needed_dirs[] = $parent_folder;
+ $parent_folder = dirname($parent_folder);
+ }
+ else {
+ break;
+ }



+ $needed_dirs = array_unique($needed_dirs);


Create those directories if need be:

#3 @dd32
11 years ago

  • Keywords reporter-feedback added; open_ basedir mkdir removed

Attempting to create /, /home/, /home....../wp-content/ was a bug, Can you check to see if your problem was fixed by this commit yesterday?

(In [15156]) Do not check to see if parents of folders outside of the

Destination folder exist within the Archive extractors, unzip_file() will
take care of that area. Fixes #13741

Close as duplicate of that ticket if that fixes it, else I'll enable open_basedir and have a look tonight.

#4 @dd32
11 years ago

  • Milestone set to Unassigned

Also, In order to duplicate the / bug, you WILL need to delete the wp-content/upgrade/ folder in its entirety.

#5 @dd32
11 years ago

  • Milestone Unassigned deleted
  • Resolution set to duplicate
  • Status changed from new to closed

Closing as duplicate of #13741

Note: See TracTickets for help on using tickets.