Thumbnail generation and wordpress.com document root change

Hi,

On the last release of this plugin we noticed thumbnail generation stopped working on a number of our sites, both on CPanel servers and our custom hosting setups.

The sites are running FPM chroot with open_basedir and other restrictions in place.

ABSPATH is set to /app as we are inside a chroot’ed environment
DOCUMENT_ROOT is set to /home/user/html/site.com/app/

The change breaking our sites (and by the looks of this support forum many others) is down to a bespoke section of code specifically for wordpress.com regardless of other setups:

./app/wp-content/plugins/nextgen-gallery/products/photocrati_nextgen/modules/fs/package.module.fs.php

function initialize()
    {
        parent::initialize();
        // Special hack for wordpress.com hosted accounts where ABSPATH is outside the DOCUMENT_ROOT
        if (!empty($_SERVER['DOCUMENT_ROOT']) && strpos(ABSPATH, $_SERVER['DOCUMENT_ROOT']) === FALSE) {
            $root = $_SERVER['DOCUMENT_ROOT'];
        } else {
            $root = ABSPATH;
        }
        $this->_document_root = $this->set_document_root($root);
    }

So in our situation:

!empty($_SERVER['DOCUMENT_ROOT']) is true
strpos(ABSPATH, $_SERVER['DOCUMENT_ROOT']) is false as /home/user/html/site.com/app is not inside the string /app at any position

This triggers

$root = $_SERVER['DOCUMENT_ROOT'];

Which would set $root incorrectly to /home/user/html/site.com/app whereas PHP in a chroot like ours only knows about /app (chroot environments can only see inside their set path in theory).

Compounded by open_basedir set to /app as well our error logs were filling up with no such directory and access denied errors.

Current workarounds for now with some success:

FPM Config:

; WP Specific Absolute Path override for chroot
env[ABSPATH] = /app/

Sets the ABSPATH environment variable otherwise this will be set by wp-config.php

Apache Vhost:

ProxyPassMatch ^/(.*\.php)$ fcgi://127.0.0.1:9050/app/$1
SetEnv document_root "/app/"

This overrides the document root variable given to the FPM process via proxypassmatch which then makes sure when hitting the wordpress.com workaround we succeed in setting the correct file system absolute path.

Personally a webserver document root isn’t really a valid way to detect a programming language’s directory of operation, perhaps prefer the programming language features over the supplied webserver environment variable?