Issue with ‘wp-content’ dir check with a symlink

Hi,

I’m using the roots.io stack, which is a solid set-up with many years of development.

They set WP_CONTENT_DIR in https://github.com/roots/bedrock/blob/master/config/application.php as..:

$root_dir = dirname(__DIR__);
$webroot_dir = $root_dir . '/web';
Config::define('WP_CONTENT_DIR', $webroot_dir . Config::get('CONTENT_DIR'));

…which results in something like /srv/www/example.com/releases/20201216105336/web/app.

They retain the last five deployments, which are timestamped. There’s one deployment (typically the latest), which is symlinked as ‘current’.

They keep one copy of ‘uploads’ directory, which is symlinked as ‘shared’ such that any ‘current’ has access to the uploaded files.

Therefore, a file that we’d want to attach in a Contact Form 7 mail resides at, for instance, /srv/www/example.com/releases/20201216105336/web/app/uploads/file.pdf.

That is, however, a symlink to /srv/www/example.com/shared/uploads/file.pdf.

Now, when Contact Form 7 checks that the paths match at..:

1. https://github.com/takayukister/contact-form-7/blob/1789f36fd8d389acceec9694f1f8637ebd2011e1/includes/config-validator.php#L644
2. https://github.com/takayukister/contact-form-7/blob/1789f36fd8d389acceec9694f1f8637ebd2011e1/includes/functions.php#L469

…CF7 ends up comparing a symlink and an actual path, and when CF7 uses realpath() in doing so, the paths differ as the symlink is resolved, and CF7 finally outputs an error “It is not allowed to use files outside the wp-content directory.”

I have worked around this problem by defining UPLOADS in the site’s config, but I’m having a little uneasy feelings as any side-effects to other plugins remain unknown at this stage:

Config::define('UPLOADS', '../../../../shared/uploads');

I have also tried removing the realpath() calls in the strpos check at https://github.com/takayukister/contact-form-7/blob/1789f36fd8d389acceec9694f1f8637ebd2011e1/includes/functions.php#L469 which also resolves the problem (without having to define UPLOADS).

Do you think that would work for everyone? If so, do you mind making the change, or would you accept a PR if I submit one?

Thanks for your time & thoughts!

• This topic was modified 4 years, 5 months ago by Jouni Kananen.