Acorn as plugin open_basedir issue

acorn
1

Due to certain situations, I end up having to develop a sage theme without bedrock and got open_basedir issue after installing acorn as a plugin,

is_file(): open_basedir restriction in effect. File(/www/wwwroot/vendor/composer/installed.json) is not within the allowed path(s): (/www/wwwroot/domain_dir/:/tmp/)

I’m not sure how to solve this issue as it tried to access outside of the domain directory,
vendor/roots/acorn/src/Roots/Acorn/Application.php:270

        ->map(function ($path) use ($files) {    
		return rtrim($files->normalizePath($path), '/');
	})
	->unique()
	->filter(function ($path) use ($files) {
		return $files->isFile("{$path}/vendor/composer/installed.json")
			&& $files->isFile("{$path}/composer.json");
	})
	->all();

return new PackageManifest(
2

I’m having this same issue using Roots Sage 10 theme. I got on Kinsta live chat, and had them add [rootfolder]/vendor and [rootfolder]/composer.json to the base_dir options. The vendor folder option worked, but of course the composer.json file did not. Does anyone have a better solution for this? My next step is to have them update the document root to a sub folder of public/ which should work, but would hate to have to do this on every project…

3

There was a fix that already merged that you can give a try by using dev-main at composer, I don’t because I’m using Log1x/pagi that requires "illuminate/pagination": "^7.0|^8.0" and decided to disable open_basedir limit

4

If you’re not able to use Acorn as a dependency from Bedrock, can you try to add it as a dependency in the theme instead of trying to install it as a plugin?

From the theme directory: composer require roots/acorn, then update your composer.json with:

"post-autoload-dump": [
  "Roots\\Acorn\\ComposerScripts::postAutoloadDump"
]

Previous versions of Sage included Acorn this way

5

Unfortunately, it also has same issue, based on the defined path list, acorn tries to look at the www root directory first which outside base_dir restrictions.

Breakdown of why open_basedir occurred
open_basedir=/www/wwwroot/domain.com/:/tmp/

  ->merge([
      $this->basePath(), // return ""
      dirname(WP_CONTENT_DIR, 2), // return "/www/wwwroot" which not a wordpress or content path and trigger open_basedir restriction.
      get_template_directory(), // The path that actually acorn needed in plugin/theme environment
      get_stylesheet_directory(),
  ])

dirname(WP_CONTENT_DIR, 2) make the acorn itself assume it was in a bedrock environment which does return the correct path when we use bedrock (/www/wwwroot/domain.com)

6 
is_file(): open_basedir restriction in effect. File(/www/xy/vendor/composer/installed.json) is not within the allowed path(s): (/www/xy/public:/www/xy/mysqleditor:/www/xy/web:/www/xy/deploy:/www/xy/deployment:/www/xy/deployments:/usr/share:/tmp)

i have a similar problem with the kinsta hosting provider.

sage manually copied, then composer install on ssh.
i also added this to composer.json:

"post-autoload-dump": [
  "Roots\\Acorn\\ComposerScripts::postAutoloadDump"
]

full composer.json:

{
	"name": "roots/sage",
	"type": "wordpress-theme",
	"license": "MIT",
	"description": "WordPress starter theme with a modern development workflow",
	"homepage": "https://roots.io/sage/",
	"authors": [
		{
			"name": "Ben Word",
			"email": "ben@benword.com",
			"homepage": "https://github.com/retlehs"
		},
		{
			"name": "Scott Walkinshaw",
			"email": "scott.walkinshaw@gmail.com",
			"homepage": "https://github.com/swalkinshaw"
		},
		{
			"name": "QWp6t",
			"email": "hi@qwp6t.me",
			"homepage": "https://github.com/qwp6t"
		},
		{
			"name": "Brandon Nifong",
			"email": "brandon@tendency.me",
			"homepage": "https://github.com/log1x"
		}
	],
	"keywords": [
		"wordpress"
	],
	"support": {
		"issues": "https://github.com/roots/sage/issues",
		"forum": "https://discourse.roots.io/"
	},
	"autoload": {
		"psr-4": {
			"App\\": "app/"
		}
	},
	"require": {
		"php": "^7.4|^8.0",
		"log1x/sage-directives": "^1.1",
		"log1x/sage-svg": "^1.1",
		"mwdelaney/sage-acf-gutenberg-blocks": "^0.7.0",
		"roots/acorn": "^2.1"
	},
	"require-dev": {
		"squizlabs/php_codesniffer": "3.7.1"
	},
	"suggest": {
		"log1x/sage-directives": "A collection of useful Blade directives for WordPress and Sage (^1.0).",
		"log1x/sage-svg": "A useful SVG directive for inlining SVG's within Blade views (^1.0)."
	},
	"config": {
		"optimize-autoloader": true,
		"preferred-install": "dist",
		"sort-packages": true
	},
	"minimum-stability": "dev",
	"prefer-stable": true,
	"scripts": {
		"lint": [
			"phpcs --extensions=php --standard=PSR12 app"
		],
		"post-autoload-dump": [
			"Roots\\Acorn\\ComposerScripts::postAutoloadDump"
		]
	},
	"extra": {
		"acorn": {
			"providers": [
				"App\\Providers\\ThemeServiceProvider"
			]
		}
	}
}
7

Guys, is there any for this problem?
Maybe acorn has some configuration settings like that says that we use the default WordPress environment instead of Bedrock, and we have to skip directory /var/www/ from the search for composer.json and installed.json

I am using Acorn 2.1
Problem file - roots/acorn/src/Roots/Acorn/Application.php line 271