CRM attempts to store data in invalid path

[dd32]

Impacted plugin

CRM

Quick summary

CRM stores data in wp-content/jpcrm-storage via jpcrm_storage_dir_info() in a very weird and odd manner.

This causes three main issues:

• wp-content is often not writable, other than wp-content/uploads, when running in multi-server environments (ie. WordPress.com, WordPress.org, etc)
• It throws PHP Warnings constantly, because the code is.. questionable..
• Functionality probably doesn't work

jetpack/projects/plugins/crm/includes/ZeroBSCRM.FileUploads.php

Lines 426 to 441 in d8ebece

	function jpcrm_storage_dir_info() {
	$uploads_dir = WP_CONTENT_DIR;
	$uploads_url = content_url();
	$private_dir_name = 'jpcrm-storage';
	if ( ! empty( $uploads_dir ) && ! empty( $uploads_url ) ) {
	$full_dir_path = $uploads_dir . '/' . $private_dir_name;
	$full_url = $uploads_url . '/' . $private_dir_name;
	return array(
	'path' => $full_dir_path,
	'url' => $full_url,
	);
	}
	return false;
	}

1. $uploads_dir and $uploads_url will always pass the ! empty() check.
2. This is Content URLs, not the upload directory.
3. no file_exists() checks, no is_writable() checks, no validation logic what-so-ever (which based on the logic, seems to be intended to go in other functions that use this result)
4. No filter, so I can't even put it into the writable uploads directory.
5. There's some notion of "Private" here, but it's not exactly a hidden folder, I note jpcrm_create_and_secure_dir_from_external_access() does attempt to hide it though, and it seems files created should have hash-based filenames.

Warnings generated include, but are not limited to:

1. fopen(wp-content/jpcrm-storage/contacts/index.html): Failed to open stream: No such file or directory
2. fopen(wp-content/plugins/zero-bs-crm/templates/index.html): Failed to open stream: Permission denied
3. chmod(): No such file or directory
4. mkdir(): Permission denied

Steps to reproduce

1. Create a site, with an unwritable wp-content.
2. Try to use the plugin
3. Watch and wait.

Site owner impact

Fewer than 20% of the total website/platform users

Severity

Critical

What other impact(s) does this issue have?

No response

If a workaround is available, please outline it here.

No response

Platform (Simple and/or Atomic)

No response