[wp-trac] [WordPress Trac] #48316: Changeset 46482 breaks upload when using ".." in upload_path.

[WordPress Trac]

#48316: Changeset 46482 breaks upload when using ".." in upload_path.
----------------------------+----------------------
 Reporter:  xpoon           |       Owner:  (none)
     Type:  defect (bug)    |      Status:  closed
 Priority:  normal          |   Milestone:
Component:  Filesystem API  |     Version:  trunk
 Severity:  major           |  Resolution:  wontfix
 Keywords:                  |     Focuses:
----------------------------+----------------------

Comment (by DreadLox):

 It broke dozen of websites for me. The UPLOAD constant cannot hold an
 absolute path as it is used to construct URL too.

 I tried to filter, but it break wp-cli:

 {{{#!php
 <?php
 /** Sets up WordPress vars and included files. */
 require_once( ABSPATH . 'wp-settings.php' );
 ​
 add_filter( 'upload_dir', function ( $upload_dir ) {
     $prev_basedir          = $upload_dir['basedir'];
     $upload_dir['basedir'] = realpath( $upload_dir['basedir'] );
     $upload_dir['path']    = str_replace( $prev_basedir,
 $upload_dir['basedir'], $upload_dir['path'] );
 ​
     return $upload_dir;
 } );
 }}}

 With that filter wordpress works but not wp-cli:


 {{{
 PHP Fatal error:  Uncaught Error: Call to undefined function add_filter()
 in phar:///usr/local/bin/wp/vendor/wp-cli/wp-
 cli/php/WP_CLI/Runner.php(1169) : eval()'d code:77
 }}}

 We need a proper secure workaround please.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/48316#comment:10>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform