[wp-trac] [WordPress Trac] #64071: Site Health false positive: WP_DEBUG_LOG warning when debug.log is outside wp-content

[WordPress Trac]

#64071: Site Health false positive: WP_DEBUG_LOG warning when debug.log is outside
wp-content
--------------------------------------+-----------------------------
 Reporter:  dannythedog               |       Owner:  hbhalodia
     Type:  defect (bug)              |      Status:  assigned
 Priority:  normal                    |   Milestone:  7.0
Component:  Site Health               |     Version:
 Severity:  normal                    |  Resolution:
 Keywords:  has-patch has-unit-tests  |     Focuses:  administration
--------------------------------------+-----------------------------

Comment (by ozgursar):

 == Patch Testing Report

 Patch Tested: https://github.com/WordPress/wordpress-develop/pull/10684

 === Environment
 - WordPress: 7.0-beta2-61752-src
 - PHP: 8.2.29
 - Server: nginx/1.29.4
 - Database: mysqli (Server: 8.4.7 / Client: mysqlnd 8.2.29)
 - Browser: Chrome 145.0.0.0
 - OS: macOS
 - Theme: Twenty Twenty-Five 1.4
 - MU Plugins: None activated
 - Plugins:
   * Test Reports 1.2.1

 I used WordPress Develop local environment for testing this ticket.

 === Steps taken
 1. Edit the `wp-config.php` to include the constants follows:


 {{{
 define('WP_DEBUG', true);
 define('WP_DEBUG_LOG', '/var/www/debug.log'); // Outside wp-content
 define('WP_DEBUG_DISPLAY', false);

 define( 'SCRIPT_DEBUG', true );
 define( 'WP_ENVIRONMENT_TYPE', 'local' );
 define( 'WP_DEVELOPMENT_MODE', 'core' );
 }}}

 2. Use `error_log()` function in `functions.php` to log anything to the
 `debug.log`
 3. Confirm the `debug.log` gets created **outside** the `/src` folder
 where WordPress files reside
 4. Check Site Health tool and confirm the security warning gets displayed
 5. Apply the patch
 6. Recheck Site Health tool and confirm the security warning no longer
 gets displayed
 x. ✅ Patch is solving the problem

 === Expected result
 - If the `debug.log` is not accessible publicly, we should not see any
 security warnings in the Site Heath tool.

 === Screenshots/Screencast with results
 wp-config
 [[Image(https://i.imgur.com/g7qgBe9.png)]]

 Before
 [[Image(https://i.imgur.com/PA6hrtr.png)]]

 After
 [[Image(https://i.imgur.com/mmK46XO.png)]]

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/64071#comment:16>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform