Contact Form 7 path for local file

mZoo · March 4, 2023, 1:48am

My issue is similar to this one where dev needed to configure WPCF7_UPLOADS_TMP_DIR.

However, I can see that CF7 is creating the attachments for the form’s file element using this handy tool:

current/web/app/uploads$ watch -d find wpcf7_uploads/

Which gives something like this:

Every 2.0s: find wpcf7_uploads/                    project-ubuntu-s-1cpu-1gb-nyc3: Sat Mar  4 01:35:49 2023

wpcf7_uploads/
wpcf7_uploads/.htaccess
# then two lines briefly flash here as the temp file is generated

So in debugging I want to try sending a local file attachment, but can’t seem to find a local path that will satisfy CF7.

It reports:

It is not allowed to use files outside the wp-content directory.

for paths:

/srv/www/example.com/current/web/app/uploads/2017/10/image1-150x150.jpeg
uploads/2017/10/image1-150x150.jpeg
/srv/www/example.com/releases/20230303203238/web/app/uploads/2017/10/image1-150x150.jpeg

Running wp config get WP_CONTENT_DIR returns:

/srv/www/example.com/releases/20230303203238/web/app

Any suggestions will be most welcome.

strarsis · March 4, 2023, 4:13pm

This should be the path validation function of Contact Form 7 (called from where the error originates from):

github.com

takayukister/contact-form-7/blob/6efa44cf62c055bbeb316290b66f405d4bf01946/includes/validation-functions.php#L225


      
          /**
           * Verifies that a given file path is under the directories that WordPress
           * manages for user contents.
           *
           * Returns false if the file at the given path does not exist yet.
           *
           * @param string $path A file path.
           * @return bool True if the path is under the content directories,
           *              false otherwise.
           */
          function wpcf7_is_file_path_in_content_dir( $path ) {
          	if ( $real_path = realpath( $path ) ) {
          		$path = $real_path;
          	} else {
          		return false;
          	}
          
          
	if ( 0 === strpos( $path, realpath( WP_CONTENT_DIR ) ) ) {
          		return true;
          	}

You can hold the debugger here and check why the path fails the check (or just pepper in some var_dump/exit stuff (on development of course) ).

mZoo · March 10, 2023, 2:50am

With plenty of help from xdebug (and having benefited greatly from the Roots/Trellis xdebug video,

Our approach was, to get past validation for our Roots/Bedrock instance, contact-form-7/validation-functions.php at 2ff6732e97ebb28f2d335002a23bca0247f9146e · takayukister/contact-form-7 · GitHub

Then added a new php global define('UPLOADS', '../app/uploads'); in site/config/application.php.

Thanks, as always for the great tools and support.