Remove the calls to realpath in FileIntegrity checks

[danielpunkass]

Description:

If the FileIntegrity check discovers an unexpected symlink in the source tree, it causes Matomo to suggest to the user deleting the target of the symlink, instead of the symlink itself. At best this would be a nuisance, and at worst it could be catastrophic (if the user kept a symlink to files outside of Matomo's directory, for example). Fixes #16551.

Review

• [ ] Functional review done
• [ ] Potential edge cases thought about (behavior of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
• [ ] Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
• [ ] Security review done
• [ ] Wording review done
• [ ] Code review done
• [ ] Tests were added if useful/possible
• [ ] Reviewed for breaking changes
• [ ] Developer changelog updated if needed
• [ ] Documentation added if needed
• [ ] Existing documentation updated if needed

[github-actions[bot]]

This issue is in "needs review" but there has been no activity for 7 days. ping @matomo-org/core-reviewers

[caddoo]

@danielpunkass Thanks a lot for your contribution, really appreciated 🎉

I tested this locally and while it does work and achieve what is expected, we do lose a little user-friendliness with the messaging to our users.

Removing realpath means a relative filename is given which means the rm or rm -rF will only work when they are in their Matomo install directory whereas before they could be anywhere in their filesystem.

Maybe an idea would be to change it to use something like: htmlspecialchars(realpath(dirname($fileFoundNotExpected)). '/' .basename($fileFoundNotExpected))

This seems to get the symlink location with the full absolute path and the resulting rm command doesn't touch the source file.

@matomo-org/core-reviewers any other opinions here?

[github-actions[bot]]

This issue is in "needs review" but there has been no activity for 7 days. ping @matomo-org/core-reviewers