Restrict file access to WP_CONTENT_DIR only

[Copilot]

Addresses security concerns by removing all base directory logic and limiting file browsing to WP_CONTENT_DIR. For multisite, this naturally restricts to each site's upload directory via wp_upload_dir().

Changes

• Simplified get_root(): Returns WP_CONTENT_DIR unconditionally

  • Removes ADD_FROM_SERVER constant support
  • Removes /home/ directory detection
  • Removes ABSPATH parent directory traversal

• Added path validation: Extra check in handle_imports() ensures resolved paths stay within bounds

• Updated notices: Removed ADD_FROM_SERVER workaround suggestions, inform users of security restriction

• Updated docs: FAQ reflects new behavior

Before/After

// Before: Complex logic with multiple escape hatches
function get_root() {
    if ( defined( 'ADD_FROM_SERVER' ) ) {
        $root = ADD_FROM_SERVER;
    } elseif ( str_starts_with( __FILE__, '/home/' ) ) {
        $root = implode( '/', array_slice( explode( '/', __FILE__ ), 0, 3 ) );
    } else {
        if ( str_starts_with( WP_CONTENT_DIR, ABSPATH ) ) {
            $root = dirname( ABSPATH );
        } else {
            $root = dirname( WP_CONTENT_DIR );
        }
    }
    // ... more validation logic
    return $root;
}

// After: Single source of truth
function get_root() {
    return WP_CONTENT_DIR;
}

Net: -30 lines, tightened security boundary

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Remove all base directory logic and limit to content dir</issue_title>
<issue_description>Due to a stream of ill-imformed security vulnerability notices the plugin should be limited to the WP_CONTENT_DIR folder going forward, and in the case of multisite, the individual sites upload folder.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Remove all base directory logic and limit to content dir #11

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.