Unable to have upload directory outside webroot

Do you know if having upload files on an HDD instead of an SSD would noticeably reduce SugarCRM performance?

For some SugarCRM instances the upload directory is massive so it sounds good to move it to a storage with a focus on volume rather than Read/Write speed.

I have been trying this for some time on a new server, but even if I get actual uploads to work, the Module Builder fails to Deploy because of this change.

I want to have the upload directory of our SugarCRM instances outside the webroot. Later these will be moved to an HDD while keeping SugarCRM installations on an SSD.

At the root of the server I have a new directory called upload and within that directory, the actual upload directories for each SugarCRM instance on the server. E.g.:
- /upload/sugarcrm
- /upload/sugarcrm1
- /upload/sugarcrm2

So I ensure that the permissions and owner on all of those directories are the same as they should be in the upload directory in SugarCRM root directory normally and change the config.php upload_dir setting to point to the new directory.

config.php

'upload_dir' => '/upload/sugarcrm/'

And when trying to deploy a new module using the Module Builder I get an alert saying this:

An error has occurred during deploy process, your package may not have installed correctly

And this error in sugarcrm.log:

Thu Apr  6 15:16:31 2017 [3880][1][FATAL] Exception in Controller: exception 'RuntimeException' with message 'File name violation: file outside basedir' in /var/www/vhosts/hostdomain.com/sugarcrm.hostdomain.com/src/Util/Files/FileLoader.php:64
Stack trace:
#0 /var/www/vhosts/hostdomain.com/sugarcrm.hostdomain.com/ModuleInstall/ModuleInstaller.php(3500): Sugarcrm\Sugarcrm\Util\Files\FileLoader::validateFilePath('/upload/sugarcrm/u...')
#1 /var/www/vhosts/hostdomain.com/sugarcrm.hostdomain.com/ModuleInstall/ModuleInstaller.php(157): ModuleInstaller->readManifest()
#2 /var/www/vhosts/hostdomain.com/sugarcrm.hostdomain.com/ModuleInstall/PackageManager/PackageManager.php(554): ModuleInstaller->install('/upload/sugarcrm/u...')
#3 /var/www/vhosts/hostdomain.com/sugarcrm.hostdomain.com/modules/ModuleBuilder/controller.php(296): PackageManager->performInstall('upload/upgrades...', true)
#4 /var/www/vhosts/hostdomain.com/sugarcrm.hostdomain.com/include/MVC/Controller/SugarController.php(450): ModuleBuilderController->action_DeployPackage()
#5 /var/www/vhosts/hostdomain.com/sugarcrm.hostdomain.com/include/MVC/Controller/SugarController.php(423): SugarController->do_action()
#6 /var/www/vhosts/hostdomain.com/sugarcrm.hostdomain.com/include/MVC/Controller/SugarController.php(398): SugarController->handle_action()
#7 /var/www/vhosts/hostdomain.com/sugarcrm.hostdomain.com/modules/ModuleBuilder/controller.php(151): SugarController->process()
#8 /var/www/vhosts/hostdomain.com/sugarcrm.hostdomain.com/include/MVC/Controller/SugarController.php(306): ModuleBuilderController->process()
#9 /var/www/vhosts/hostdomain.com/sugarcrm.hostdomain.com/include/MVC/SugarApplication.php(200): SugarController->execute()
#10 /var/www/vhosts/hostdomain.com/sugarcrm.hostdomain.com/index.php(27): SugarApplication->execute()
#11 {main}

I get the exact same error again if I try keeping the upload_dir in config.php as it is, but remove the actual upload directory and put a symlink in its place called upload that points to the actual upload directory with the right permissions /upload/sugarcrm.

'upload_dir' => 'upload/'

So has anyone managed to set up a SugarCRM instance with the upload directory outside the webroot?

Using:

• Ubuntu 16.04
• Plesk Onyx
• PHP 5.6
• Apache 2.4
• SugarCRM 7.8.2.0