Bug: function delete_gallery may delete whole website.

While working on a customer’s website, I just uncovered a but in NGG 2.1.9 that could lead to your whole website being deleted:

The file /nextgen-gallery/products/photocrati_nextgen/modules/nextgen_data/package.module.nextgen_data.php contains a function delete_gallery (at line 3330). The function gets a path using $this->object->get_gallery_abspath and then iterates trough that directory and all files+directories below it, and removes them. If get_gallery_abspath returns a wrong path, more may be deleted than was planned.

This was exactly the case in the rare situation my customer had:

For some reason the gallery directory belonging to gallery 21 was missing from the filesystem. When trying to delete gallery 21, an exception comes up:
RecursiveDirectoryIterator::__construct(/wproot/wp-content/gallery/the-gallery1): failed to open dir: No such file or directory

This will never be a problem when only deleting gallery 21. But when multiple galleries are removed, and the gallery with the missing directory is not the first gallery to be deleted, the same error message comes up. If at that point, the confused user presses F5 to reload the page, the function get_gallery_abspath returns the wordpress root directory, and the whole website is deleted.

So say that gallery 15, 21 and 23 are selected for bulk deletion, then what happens is:
delete_gallery(15)
-> get_gallery_abspath(15) returns ‘/wproot/wp-content/gallery/the-gallery2’
-> iterating through ‘/wproot/wp-content/gallery/the-gallery2’ and deleting all
delete_gallery(21)
-> get_gallery_abspath(21) returns ‘/wproot/wp-content/gallery/the-gallery1’, which is non-existent
-> RecursiveIteratorIterator raises exception and stops processing. It never gets to gallery 23.

Now the users presses F5, the same gallery IDs are posted. What happens next:
delete_gallery(15)
-> get_gallery_abspath(15) returns ‘/wproot’
-> iterating through ‘/wproot’ and deleting all
*poof* The whole website is now gone.

Possible resolution: if the gallery does not exist, get_gallery_abspath should probably return false, so that the function delete_gallery does not try to remove a non-existent directory.

This customer’s configuration:
WP 5.2.4
NGG 2.1.9
Apache 2.2.15 (centos6)
PHP 5.6.12
MySQL 5.1.73 (centos6)

If you need more information, please let me know.

https://wordpress.org/plugins/nextgen-gallery/