Multisite ignores the WordPress install directory

[FolioVision]

Our WordPress Multisite is located in ​https://our-site.com/wordpress but the homepage is just ​https://our-site.com/

We see the issue that "Lost your Password" link on login screen is not using our site directory at all.

Here's the relevant part of our wp-config.php

define('MULTISITE', true);
define('SUBDOMAIN_INSTALL', true);
define('DOMAIN_CURRENT_SITE', 'our-site.com');
define('PATH_CURRENT_SITE', '/');
define('SITE_ID_CURRENT_SITE', 1);
define('BLOG_ID_CURRENT_SITE', 1);

If we set PATH_CURRENT_SITE to /wordpress/ then the "Lost your Password" link works, but the wp-admin/network pages won't open. They end up in an endless loop because of $redirect_network_admin_request in wp-admin/network/admin.php

Here's our quick fix to be put into wp-content/mu-plugins (you need to specify your WP directory as a path there): ​https://gist.github.com/foliovision/52e8a2bc5ae68eb73844

---

The problematic function is network_admin_url() and the fact that it doesn't count on putting WordPress into a directory at all. It's using the global variable $current_blog which is initialized in ms-settings.php. The variable should not only store the path to the site front-end, but also the WordPress directory, so that it can reference individual PHP files properly.

Similar bug is recorded here, but it's for WordPress 3.5: #23221

[nacin]

See https://core.trac.wordpress.org/ticket/23221#comment:19. This is by design.

[FolioVision]

Mike, did you look at the other ticket: #23221. This is an easy fix. Many people have written to you and Nacin about it. Why should WPMU be broken by default?

If you are wondering why few people contribute to core it has a lot to do with contributing valuable fixes and just having them stomped on for no particular reason. Apart from not belonging to the clique.

[nacin]

Duplicate of #23221.

It has nothing to do with a clique. It has to do with no one yet convincingly stating why something is broken here. I am all ears and always want WordPress to be better. Receiving notes that say that you want something fixed is not going to, by itself, get it fixed. :-)

[FolioVision]

Hi Nacin,

We've said why WPMU is broken (the site owner is FORCED to keep all Wordpress files in root) and we've provided a fix (a firm path to the Wordpress install for WPMU whether using one of the existing paths or adding a new one).

Why might a site owner want this?

• security (keeping the main path out of root stops a lot of mechanical attacks)
• more importantly, clutter. Often the main site of WPMU is an important domain for the site owner and he has lots of directories and folders and other things going on. Forcing him/her to put up with dozens of Wordpress php files and directories in root is just plain bad manners.

Refusing to fix it is just being arbitrary.

Would you please include our fix (for which people who use WPMU seriously have been asking for over two years now)?

Thank you. Alec Kinnear

[SergeyBiryukov]

It's still a duplicate of #23221, let's continue the discussion there.

[nacin]

@FolioVision: You can put multisite files outside the root. It was implemented in #19796. There's a reason I'm telling you what I'm telling you. You are not forced to keep all WordPress files in the root. We use this setup on wordpress.org. It works fine.

In single site, you actually have a different site URL and home URL. In multisite, because there is a requirement to have rewrite rules, we decided to actually keep site URL and home URL the same, and instead internally rewrite (in Apache, nginx, IIS) /wp-admin/ to /wordpress/wp-admin/. That is what was implemented in #19796. Point is, all that is required is that you update your rewrite rules and move your WordPress files.

Please use #23221 for any other updates.