Restore the home path fallback when realpath() fails

[lloc]

https://core.trac.wordpress.org/ticket/38312

When realpath( $_SERVER['DOCUMENT_ROOT'] ) returns false, $document_root_fix was an empty string, and str_starts_with() with an empty needle always returns true. This made the get_home_path() fallback unreachable in precisely the scenario it was intended for, leaving $home_path set to just the base path.

Also guards against $_SERVER['DOCUMENT_ROOT'] being unset, which triggered an undefined array key notice and a realpath( null ) deprecation on PHP 8.1+.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props realloc.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[irozum]

Confirmed the root cause by hand: when realpath( $_SERVER['DOCUMENT_ROOT'] ) returns false (or the key is unset), the old code's str_replace( '\\', '/', false ) produces '', and str_starts_with( $abspath_fix, '' ) is always true — so the intended get_home_path() fallback was unreachable in exactly the case it exists for, silently leaving $home_path set to just $base. Traced through both the failure case and the normal case (valid DOCUMENT_ROOT) with the patched code and both now branch correctly.

Ran composer lint:errors and typecheck:php — clean on the changed file (the reported errors are pre-existing, in unrelated files). network_step2() itself isn't covered by any existing PHPUnit test (it's an HTML-emitting network-setup screen function), so there's nothing to run directly against this change, but get_home_path() (the fallback it now correctly reaches) still passes. Also checked for other DOCUMENT_ROOT/realpath() callers with the same pattern elsewhere in wp-admin — none, this is fully self-contained.

One small thing: the ternary reassigns $document_root_fix from a realpath()-or-false intermediate rather than checking false !== $document_root directly, which works but reads slightly indirect — not blocking, just a minor readability nit if you want to simplify. Otherwise this looks correct and safe to land.