_unzip_file_ziparchive fails with open_basedir in effect

[tinuzz]

wp-admin/includes/file.php contains a function called _unzip_file_ziparchive, that is used -at least- for automatically upgrading plugins.

In this function, the list of needed directories, that it is passed as the third argument, is expanded, so that is contains all the parent directories of every needed directory, up to '/'.

After that, for each path component, starting with '/', an attempt to create it is made, and if that fails, its existence is checked with $wp_filesystem->is_dir().

Now, when FS_METHOD == "direct" and open_basedir is in effect, $wp_filesystem->is_dir('/') returns false, and it does this for every directory that is outside the open_basedir.

The result is, that the action fails with the message "Could not create directory. /".

I think that Wordpress should not try and create directories /above/ its own installation directory. Wordpress trying to do mkdir('/') is juist plain stupid.

A check should be implemented so that Wordpress will only attempt to create directories /below/ WP_CONTENT_DIR.

[tinuzz]

Forgot to mention: this is Wordpress running on PHP 5.3.2.

[tinuzz]

A patch, that made it work for me:

--- file.php.orig 2010-06-07 19:03:55.000000000 +0000
+++ file.php 2010-06-07 19:08:24.000000000 +0000
@@ -601,7 +601,6 @@

$needed_dirs[] = $to . untrailingslashit(dirname($infoname?));

}

• $needed_dirs = array_unique($needed_dirs);

foreach ( $needed_dirs as $dir ) {

Check the parent folders of the folders all exist within the creation array.
if ( untrailingslashit($to) == $dir ) Skip over the working directory, We know this exists (or will exist)

@@ -609,10 +608,16 @@

$parent_folder = dirname($dir);
while ( !empty($parent_folder) && untrailingslashit($to) != $parent_folder && !in_array($parent_folder, $needed_dirs) ) {

• $needed_dirs[] = $parent_folder;
• $parent_folder = dirname($parent_folder);

+ if (substr(WP_CONTENT_DIR, 0, strlen($parent_folder)) != $parent_folder) {
+ $needed_dirs[] = $parent_folder;
+ $parent_folder = dirname($parent_folder);
+ }
+ else {
+ break;
+ }

}

}

+ $needed_dirs = array_unique($needed_dirs);

asort($needed_dirs);

Create those directories if need be:

[dd32]

Attempting to create /, /home/, /home....../wp-content/ was a bug, Can you check to see if your problem was fixed by this commit yesterday?

(In [15156]) Do not check to see if parents of folders outside of the

Destination folder exist within the Archive extractors, unzip_file() will
take care of that area. Fixes #13741

Close as duplicate of that ticket if that fixes it, else I'll enable open_basedir and have a look tonight.

[dd32]

Also, In order to duplicate the / bug, you WILL need to delete the wp-content/upgrade/ folder in its entirety.

[dd32]

Closing as duplicate of #13741