Sanity check failed for source: Path is outside allowed path

I also have the problem where no images are loaded after the latest update.

I tested with cwebp and Gd Extension.
In the console the Type for all images is text/html.
In .htaccess at the top it says

mod_header working?: could not be determined
pass variable from .htaccess to script through header working?: could not be determined
pass variable from .htaccess to script through environment variable working?: could not be determined

With the new release, for security purposes, WebP Express now rejects to convert images outside of the document root (the root of the website). The message “Sanity check failed for source: Path is outside allowed path” is an indication that this is what is at play here.
Can you post some details about your setup?

Also, try clicking the “test” button next to a converter. In the right pane, you should see a message that reveals details about the conversion process, and also tells you what went wrong if conversion cannot be made.

Problem is in Operation mode: Tweaked
Images is showing destination folder except image itself https://i.imgur.com/SgmXaMn.png. In tester there is no errors. It looks like these when you upload image on server https://i.imgur.com/1fwE769.png but if you download image from ftp it’s working fine

Converter set to: gd

*WebP Convert 2.1.1*  ignited.
- PHP version: 7.3.6
- Server software: Apache/2.4.39 (Unix) OpenSSL/1.1.1

Gd converter ignited

Options:
------------
The following options have been set explicitly. Note: it is the resulting options after merging down the "jpeg" and "png" options and any converter-prefixed options.
- source: .../webp-express/test/test-pattern-tv.jpg
- destination: .../webp-express/test/test-pattern-tv.jpg.webp
- log-call-arguments: true
- quality: 75

The following options have not been explicitly set, so using the following defaults:
- default-quality: 75
- max-quality: 85
- skip: false

The following options were supplied but are ignored because they are not supported by this converter:
- encoding
- metadata
- skip-pngs
------------

GD Version: bundled (2.1.0 compatible)
image is true color
Quality: 75. 
Consider setting quality to "auto" instead. It is generally a better idea

Converted image in 25 ms, reducing file size with 75% (went from 28 kb to 7 kb)

YAK!
This was a debug message that I have forgotten to get rid of.
In wod/webp-on-demand.php, find and remove this line (line 125):

echo $source; exit;

I shall create an update as soon as possible!

Now is working fine

I have released the fix in 0.14.12. So sorry for this bug. I was under pressure with this release and did not get around doing all the tests I usually do before releasing.

Hi!
Is there any chance to deactivate this feature?

In my hosting the docroot and upload folder are in the same folder but they are detected different because the use of symlinks.

Regards,

Ahhh, so thats the problem – thanks David! (@sultanicq). I should be able to do expand the symlink by call realpath before doing the check – without compromising security

Good! I’m waiting for the update! ??

I have just released 0.14.13, which has fixes in the conversion scripts. Perhaps this solves this too?

I have checked the code and I am actually already using realpath all the places where I use document root. Something else than symlinked paths might be the issue.
But first let me hear if 0.14.13 fixes it, @sultanicq

After updating and new generating .htacess – same problem here.

@schnorz, do you see this message when you try to bulk convert, click the “test” button next to a converter, request an image (jpg/png) or request a webp which has not been regenerated yet?

• This reply was modified 5 years, 5 months ago by rosell.dk.

To check that the “redirect to conversion script” functionality is working, you can:

1) Switch to Tweaked mode
2) Set Cache-Control header to public, one second
3) Check “Enable redirection to converter?”
4) Uncheck “Only redirect to converter if no webp exists”
5) Uncheck “Enable direct redirection to existing converted images?”
6) Uncheck “Create webp files upon request?”
7) Disable Alter HTML
8) Under “Serve options”, set “Response on failure” to “Error report (in plain text”)
9) Visit an image URL directly
10) If you see no error message, edit wp-content/plugins/webp-express/wod/webp-on-demand.php. In the top, insert the following:

error_reporting(E_ALL);
ini_set('display_errors', 1);

To check that the “Create webp files upon request?” functionality is working, you can:

1) Again use to Tweaked mode
2) Set Cache-Control header to public, one second
3) Now Uncheck “Enable redirection to converter?”
4) Uncheck “Enable direct redirection to existing converted images?”
5) Now check “Create webp files upon request?”
6) Enable Alter HTML
7) Under “Serve options”, set “Response on failure” to “Error report (in plain text”)
8) Visit a page
9) If images are not showing, it isn’t working. To get the error, view source and copy the URL of the webp file. And open it in a new tab/window. You should see an error message.
10) If you see no error message, edit wp-content/plugins/webp-express/wod/webp-realizer.php. In the top, insert the following:

error_reporting(E_ALL);
ini_set('display_errors', 1);

• This reply was modified 5 years, 5 months ago by rosell.dk.
• This reply was modified 5 years, 5 months ago by rosell.dk.