Site Health false positive: WP_DEBUG_LOG warning when debug.log is outside wp-content - Ticket #64071

src/wp-admin/includes/class-wp-site-health.php

@@ -29,6 +29,21 @@ class WP_Site_Health {
 	private $timeout_missed_cron = null;
 	private $timeout_late_cron   = null;
 
+	/**
+	 * @var bool
+	 */
+	private $wp_debug;
+
+	/**
+	 * @var bool|string
+	 */
+	private $wp_debug_log;
+
+	/**
+	 * @var bool|null
+	 */
+	private $wp_debug_display;
+
 	/**
 	 * WP_Site_Health constructor.
 	 *
@@ -54,6 +69,10 @@ public function __construct() {
 		add_action( 'wp_site_health_scheduled_check', array( $this, 'wp_cron_scheduled_check' ) );
 
 		add_action( 'site_health_tab_content', array( $this, 'show_site_health_tab' ) );
+
+		$this->wp_debug         = defined( 'WP_DEBUG' ) && WP_DEBUG;
+		$this->wp_debug_log     = defined( 'WP_DEBUG_LOG' ) && WP_DEBUG_LOG;
+		$this->wp_debug_display = defined( 'WP_DEBUG_DISPLAY' ) && WP_DEBUG_DISPLAY ? WP_DEBUG_DISPLAY : null;
 	}
 
 	/**
@@ -1383,7 +1402,7 @@ public function get_test_dotorg_communication() {
 	 *
 	 * @since 5.2.0
 	 *
-	 * @return array The test results.
+	 * @return array<string, string|array<string, string>> The test results.
 	 */
 	public function get_test_is_in_debug_mode() {
 		$result = array(
@@ -1408,23 +1427,80 @@ public function get_test_is_in_debug_mode() {
 			'test'        => 'is_in_debug_mode',
 		);
 
-		if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
-			if ( defined( 'WP_DEBUG_LOG' ) && WP_DEBUG_LOG ) {
-				$result['label'] = __( 'Your site is set to log errors to a potentially public file' );
+		if ( $this->wp_debug ) {
+			if ( ! empty( ini_get( 'error_log' ) ) ) {
+				$debug_log_dir = realpath( dirname( ini_get( 'error_log' ) ) );
+				$absolute_path = realpath( ABSPATH ) . DIRECTORY_SEPARATOR;
 
-				$result['status'] = str_starts_with( ini_get( 'error_log' ), ABSPATH ) ? 'critical' : 'recommended';
+				if ( false === $debug_log_dir ) {
+					$log_path_status = 'error';
+				} elseif ( str_starts_with( $debug_log_dir . DIRECTORY_SEPARATOR, $absolute_path ) ) {
+					$log_path_status = 'public';
+				} else {
+					$log_path_status = 'private';
+				}
 
-				$result['description'] .= sprintf(
-					'<p>%s</p>',
-					sprintf(
-						/* translators: %s: WP_DEBUG_LOG */
-						__( 'The value, %s, has been added to this website&#8217;s configuration file. This means any errors on the site will be written to a file which is potentially available to all users.' ),
-						'<code>WP_DEBUG_LOG</code>'
-					)
-				);
+				if ( 'public' === $log_path_status ) {
+					$result['label']  = __( 'Your site is set to log errors to a potentially public file' );
+					$result['status'] = 'critical';
+
+					if ( $this->wp_debug_log ) {
+						$result['description'] .= sprintf(
+							'<p>%s</p>',
+							sprintf(
+								/* translators: %s: WP_DEBUG_LOG */
+								__( 'The constant, %s, has been added to this website&#8217;s configuration file. This means any errors on the site will be written to a file which is likely publicly accessible.' ),
+								'<code>WP_DEBUG_LOG</code>'
+							)
+						);
+					} else {
+						$result['description'] .= sprintf(
+							'<p>%s</p>',
+							__( 'The error log path has been configured to a file within the WordPress directory. This means any errors on the site will be written to a file which is likely publicly accessible.' )
+						);
+					}
+				} elseif ( 'private' === $log_path_status ) {
+					$result['label']  = __( 'Your site is set to log errors to a file outside the document root' );
+					$result['status'] = 'good';
+
+					if ( $this->wp_debug_log ) {
+						$result['description'] .= sprintf(
+							'<p>%s</p>',
+							sprintf(
+								/* translators: %s: WP_DEBUG_LOG */
+								__( 'The configuration constant, %s, is enabled. In addition, your site is set to write errors to a file outside the WordPress directory, which is a good practice as the log file should not be publicly accessible.' ),
+								'<code>WP_DEBUG_LOG</code>'
+							)
+						);
+					} else {
+						$result['description'] .= sprintf(
+							'<p>%s</p>',
+							__( 'The error log path has been configured to a file outside the WordPress directory. This is a good practice as the log file should not be publicly accessible.' )
+						);
+					}
+				} else {
+					$result['label']  = __( 'Unable to determine error log file location' );
+					$result['status'] = 'critical';
+
+					if ( $this->wp_debug_log ) {
+						$result['description'] .= sprintf(
+							'<p>%s</p>',
+							sprintf(
+								/* translators: %s: WP_DEBUG_LOG */
+								__( 'The configuration constant, %s, is enabled, but the log file location could not be determined.' ),
+								'<code>WP_DEBUG_LOG</code>'
+							)
+						);
+					} else {
+						$result['description'] .= sprintf(
+							'<p>%s</p>',
+							__( 'The error log path could not be determined. Please check your PHP configuration.' )
+						);
+					}
+				}
 			}
 
-			if ( defined( 'WP_DEBUG_DISPLAY' ) && WP_DEBUG_DISPLAY ) {
+			if ( $this->wp_debug_display ) {
 				$result['label'] = __( 'Your site is set to display errors to site visitors' );
 
 				$result['status'] = 'critical';