Install new theme via FTP failed

[Przemyslaw Plewa]

New theme installation via FTP has failed when we specified custom FTP_BASE folder. If we try this theme installation , wordpress shows error message: "Unable to locate WordPress theme directory". This was because search_for_folder method do not respect FTP_BASE setting and allows to walking on parent directories. All solutions I found in google is ugly hacks who only mask the problem but does not resolved it
I attached patch example who resolve this problem. I hope is useful and will help to repair this bug.

[Przemyslaw Plewa]

patch

[dd32]

Can you provide some more details that explains the environment you're running in, and why FTP_BASE is required?
Are you defining the other FTP_* constants for other paths?
Does it work when you do? (I'm specifically thinking of FTP_CONTENT_DIR )
Do Plugin installs work?

[Przemyslaw Plewa]

In wp-config.php i definded FTP_ constants:
define('FTP_BASE', '/zupa.web5.beep.pl/');
define('FTP_CONTENT_DIR', '/zupa.web5.beep.pl/wp-content/');
define('FTP_PLUGIN_DIR', '/zupa.web5.beep.pl/wp-content/plugins');
define('FTP_LANG_DIR', '/zupa.web5.beep.pl/wp-content/languages');

Plugin installs works fine, upgrade wordpress (tested from 3.5.0 to 3.5.1) works too. Only install themes cause problems. With my patch all it's ok.

Physically my files stored in path: /home/virtualki/88211
Via FTP wordpress files located in /zupa.web5.beep.pl/

[dd32]

Added some unit tests that show this case. Unfortunately, I don't think there's going to be any easy way to fix this particular use-case.

This is similar to #14401 and #20652

attachment:wp-filesystem-ftpext.patch​ is ultimately the same as [25057] I believe. In 3.7+ you'll only need to specify the FTP_BASE constant.

[chriscct7]

Any updated thoughts @dd32?