Add public / web directory to $config->paths

[SwimToWin]

Small request: When working with files outside ProcessWire, it would be useful to know the the public / web folder. Having this folder or directory will allow me to work with the "non-Processwire file system".

Example: /var/sites/www.example.com/public/ <- (or whatever your hosting provider calls the public directory for a website)

I can get the directory with $_SERVER['DOCUMENT_ROOT'] - unfortunately, the $_SERVER variable is easily manipulated and therefore unsafe (needs to be escaped and such).

sprintf('%s/%s/', $_SERVER['DOCUMENT_ROOT'], 'whatever');

Currently print_r($config->paths) outputs two array keys that hold (too deep) info about the public web directory:

• [sessions] => /var/sites/www.example.com/public/site/assets/sessions/
• [classes] => /var/sites/www.example.com/public/site/classes/

[horst]

I think this is available since forever. Check all config paths properties, especially:

$config->paths->root

[rick]

The config->paths->root also contains the current process as part of the path. For example, if you are currently within a custom process module named 'widget', then the returned path is '/path/to/docroot/widget/'.

You could use a combination of string functions with DOCUMENT_ROOT, CONTEXT_DOCUMENT_ROOT, and SCRIPT_FILENAME values to validate the directory. As far as I know, the script_filename value is not vulnerable so should provide a base from which to test and extract the doc root with some confidence.

[horst]

On 4/17/2022 at 9:42 PM, rick said:

The config->paths->root also contains the current process as part of the path

I think this is wrong. The root is exactly the directory where the PW index.php is stored: https://processwire.com/api/ref/paths/

Quote

$var->root

string

Site root: / (or subdirectory if site not at domain root)