wp_mkdir_p does not support relative paths

[greengremlin]

I have a wordpress install where the uploads folder is one level above the root path.

/www/public/wordpress (WordPress root)
/www/public/uploads (Uploads folder)

Here's the relevant wp-config.php:

<?php
if ( !defined('ABSPATH') )
  define('ABSPATH', dirname(__FILE__) . '/wordpress/');
define('WP_SITEURL', $protocol . '://' . $_SERVER['HTTP_HOST'] . '/wordpress');
define('UPLOADS', '../uploads');

This works well and I've had no issues until recently. I just traced a bug in the FooGallery plugin where thumbnails were not getting generated to the fact that it was calling wp_mkdir_p with a path that includes .., which resulted in the directory not getting created.

It seems wp_mkdir_p needs to resolve the relative path, before trying to create the folder.

For example:

<?php
wp_mkdir_p('/www/public/wordpress/../uploads/cache/2019/07/2019-my-pic');

Should resolve the path to /www/public/uploads/cache/2019/07/2019-my-pic and create the folder using the resolved path.

[mpcube]

It broke with this change:

https://core.trac.wordpress.org/changeset/46476

Before this, defining an UPLOADS constant beginning with "../" allowed Wordpress code and uploads to be side-by-side in seperate folders. This is now broken, because new directories for new months cannot me made.

I dont' know, what exactly the reason for this change was, but for me the following solution would fit:

In _wp_upload_dir(): use path_join() to join ABSPATH and UPLOADS (not just ABSPATH and $upload_path)

In path_join(): replace /foo/bar/../baz with /foo/baz so that UPLOADS and $upload_path can be a string starting with ../

​https://foliovision.com/2019/11/wordpress-unable-to-create-directory

​https://www.trullala.de/wordpress-media-upload-broken/

[peterwilsoncc]

@greengremlin

Hello and welcome to trac!

This is being discussed in #48316 so I have closed this ticket as a duplicate to allow discussion to remain in one place. You can watch or comment on the original ticket to be notified by email of updates.

Thanks,
Pete