Site Health false positive: WP_DEBUG_LOG warning when debug.log is outside wp-content - Ticket #64071

src/wp-admin/includes/class-wp-site-health.php

@@ -1409,18 +1409,37 @@ public function get_test_is_in_debug_mode() {
 
 		if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
 			if ( defined( 'WP_DEBUG_LOG' ) && WP_DEBUG_LOG ) {
-				$result['label'] = __( 'Your site is set to log errors to a potentially public file' );
+				$debug_log_path = WP_DEBUG_LOG === true ? WP_CONTENT_DIR . '/debug.log' : WP_DEBUG_LOG;
+				$debug_log_path = realpath( $debug_log_path );
+				$absolute_path  = realpath( ABSPATH ) . DIRECTORY_SEPARATOR;
 
-				$result['status'] = str_starts_with( ini_get( 'error_log' ), ABSPATH ) ? 'critical' : 'recommended';
+				if ( $debug_log_path && $absolute_path && str_starts_with( $debug_log_path, $absolute_path ) ) {
+					$result['label'] = __( 'Your site is set to log errors to a potentially public file' );
 
-				$result['description'] .= sprintf(
-					'<p>%s</p>',
-					sprintf(
-						/* translators: %s: WP_DEBUG_LOG */
-						__( 'The value, %s, has been added to this website&#8217;s configuration file. This means any errors on the site will be written to a file which is potentially available to all users.' ),
-						'<code>WP_DEBUG_LOG</code>'
-					)
-				);
+					$result['status'] = 'critical';
+
+					$result['description'] .= sprintf(
+						'<p>%s</p>',
+						sprintf(
+							/* translators: %s: WP_DEBUG_LOG */
+							__( 'The constant, %s, has been added to this website&#8217;s configuration file. This means any errors on the site will be written to a file which is likely publicly accessible.' ),
+							'<code>WP_DEBUG_LOG</code>'
+						)
+					);
+				} else {
+					$result['label'] = __( 'Your site is set to log errors to a file outside the document root' );
+
+					$result['status'] = 'good';
+
+					$result['description'] .= sprintf(
+						'<p>%s</p>',
+						sprintf(
+							/* translators: %s: WP_DEBUG_LOG */
+							__( 'The configuration constant, %s, has been set to write errors to a file outside the WordPress directory. This is a good practice as the log file should not be publicly accessible' ),
+							'<code>WP_DEBUG_LOG</code>'
+						)
+					);
+				}
 			}
 
 			if ( defined( 'WP_DEBUG_DISPLAY' ) && WP_DEBUG_DISPLAY ) {