[wp-trac] [WordPress Trac] #42619: WordPress tries to access /home/.bzr but to no avail

[WordPress Trac]

#42619: WordPress tries to access /home/.bzr but to no avail
-----------------------------+------------------------------
 Reporter:  meyegui          |       Owner:
     Type:  defect (bug)     |      Status:  new
 Priority:  normal           |   Milestone:  Awaiting Review
Component:  Upgrade/Install  |     Version:  4.9
 Severity:  normal           |  Resolution:
 Keywords:  needs-patch      |     Focuses:
-----------------------------+------------------------------
Changes (by dd32):

 * keywords:   => needs-patch
 * component:  General => Upgrade/Install


Comment:

 Hi @meyegui and welcome to Trac.

 I'd like to apologise for this ticket not getting a response until now.

 This is caused by WordPress checking to see if it's running within a
 version-controlled environment, and avoiding autoupdating if that's the
 case.
 The code responsible for this is located here:
 https://core.trac.wordpress.org/browser/trunk/src/wp-admin/includes/class-
 wp-automatic-updater.php?marks=74-106#L58

 WordPress doesn't take into consideration the PHP `open_basedir` setting,
 which causes it to process further up the path list than expected.

 #35536 is a related ticket, where it processes up into completely invalid
 directories.

 If you're curious as to why we care about a `.git` or `.bzr` file in a
 `/home/username/` folder, it's because we decided to be ultra-conservative
 and check all the way up to `/` instead of just the parent directory of
 WordPress for if it's running within a VCS environment.
 We could probably relax this restriction to checking the immediate parent
 of WordPress only, but that wouldn't take into account some edge-cases of
 deployment situations, where for example, the VCS files are in the
 grandparent instead - Like I said, this code was written extremely
 conservatively.

 Fixing this, adding a check to ensure that it's not going to run into an
 `open_basedir` restriction would be good, although maybe we can look at
 relaxing this restriction in the first place at the same time.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/42619#comment:2>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform