← All changes | includes/class-wpbot-gc-download.php +111 -167 8.7.2 → 4.3.1 View file →

		@@ -1,167 +1,111 @@
1		-<?php
2		-if ( ! defined( 'ABSPATH' ) ) {
3		- exit;
4		-}
5		-
6		-class WPBotGCDownload
7		-{
8		- private $download_url = 'https://github.com/qcloud/gc/raw/master/wpbotgc.zip';
9		- private $filename = 'wpbotgc.zip';
10		-
11		- public function __construct() {
12		- add_action( 'wp_ajax_qcld_wp_chatbot_gc_client_download', array( $this, 'downloadgc' ) );
13		- add_action( 'wp_ajax_qcld_wp_chatbot_gc_client_extract', array( $this, 'extractgc' ) );
14		- }
15		-
16		- /**
17		- * Initialise WP_Filesystem and return the global instance.
18		- */
19		- private function get_filesystem() {
20		- global $wp_filesystem;
21		- if ( empty( $wp_filesystem ) ) {
22		- require_once ABSPATH . 'wp-admin/includes/file.php';
23		- WP_Filesystem();
24		- }
25		- return $wp_filesystem;
26		- }
27		-
28		- /**
29		- * Create a directory using WP_Filesystem.
30		- */
31		- public function create_folder( $gcdirectory ) {
32		- $fs = $this->get_filesystem();
33		- if ( ! $fs->is_dir( $gcdirectory ) ) {
34		- return $fs->mkdir( $gcdirectory, FS_CHMOD_DIR );
35		- }
36		- return true;
37		- }
38		-
39		- /**
40		- * Create a blank index.php guard file using WP_Filesystem.
41		- */
42		- public function create_file( $filename ) {
43		- $fs = $this->get_filesystem();
44		- if ( $fs->exists( $filename ) ) {
45		- return true;
46		- }
47		- return $fs->put_contents( $filename, '<?php //silence is golden', FS_CHMOD_FILE );
48		- }
49		-
50		- public function downloadgc() {
51		- if ( ! current_user_can( 'manage_options' ) ) {
52		- wp_send_json( array( 'success' => false, 'msg' => esc_html__( 'Unauthorized access', 'chatbot' ) ) );
53		- wp_die();
54		- }
55		-
56		- $nonce = sanitize_text_field( wp_unslash( $_POST['nonce'] ?? '' ) );
57		- if ( ! wp_verify_nonce( $nonce, 'wp_chatbot' ) ) {
58		- wp_send_json( array( 'success' => false, 'msg' => esc_html__( 'Failed in Security check', 'chatbot' ) ) );
59		- wp_die();
60		- }
61		-
62		- $fs = $this->get_filesystem();
63		- $gcdirectory = QCLD_wpCHATBOT_GC_DIRNAME;
64		-
65		- if ( ! $fs->is_dir( $gcdirectory ) ) {
66		- $this->create_folder( $gcdirectory );
67		- }
68		-
69		- if ( ! $fs->exists( $gcdirectory . '/index.php' ) ) {
70		- $this->create_file( $gcdirectory . '/index.php' );
71		- }
72		-
73		- if ( ! $fs->is_dir( $gcdirectory ) ) {
74		- wp_send_json( array( 'status' => 'error', 'content' => esc_html__( 'Server does not allow creating files and folders.', 'chatbot' ) ) );
75		- wp_die();
76		- }
77		-
78		- $zip_file = $gcdirectory . '/' . $this->filename;
79		-
80		- $remote_response = wp_remote_get( $this->download_url, array(
81		- 'timeout' => 60,
82		- 'stream' => true,
83		- 'filename' => $zip_file,
84		- ) );
85		-
86		- if ( is_wp_error( $remote_response ) ) {
87		- wp_send_json( array( 'status' => 'error', 'content' => esc_html( $remote_response->get_error_message() ) ) );
88		- wp_die();
89		- }
90		-
91		- $http_code = wp_remote_retrieve_response_code( $remote_response );
92		- if ( 200 !== $http_code ) {
93		- wp_send_json( array( 'status' => 'error', 'content' => esc_html__( 'Remote server returned an unexpected response.', 'chatbot' ) ) );
94		- wp_die();
95		- }
96		-
97		- wp_send_json( array( 'status' => 'success', 'content' => esc_html__( 'File downloaded successfully.', 'chatbot' ) ) );
98		- wp_die();
99		- }
100		-
101		- public function extractgc() {
102		- if ( ! current_user_can( 'manage_options' ) ) {
103		- wp_send_json( array( 'success' => false, 'msg' => esc_html__( 'Unauthorized access', 'chatbot' ) ) );
104		- wp_die();
105		- }
106		-
107		- $nonce = sanitize_text_field( wp_unslash( $_POST['nonce'] ?? '' ) );
108		- if ( ! wp_verify_nonce( $nonce, 'wp_chatbot' ) ) {
109		- wp_send_json( array( 'success' => false, 'msg' => esc_html__( 'Failed in Security check', 'chatbot' ) ) );
110		- wp_die();
111		- }
112		-
113		- $fs = $this->get_filesystem();
114		- $gcdirectory = QCLD_wpCHATBOT_GC_DIRNAME;
115		- $gcfilename = $gcdirectory . '/' . $this->filename;
116		-
117		- // Verify the zip exists before attempting to open it.
118		- if ( ! $fs->exists( $gcfilename ) ) {
119		- wp_send_json( array( 'status' => 'error', 'content' => esc_html__( 'File not found.', 'chatbot' ) ) );
120		- wp_die();
121		- }
122		-
123		- $zip = new ZipArchive();
124		- if ( true !== $zip->open( $gcfilename ) ) {
125		- wp_send_json( array( 'status' => 'error', 'content' => esc_html__( 'Could not open zip archive.', 'chatbot' ) ) );
126		- wp_die();
127		- }
128		-
129		- // Validate every entry: block path traversal and absolute paths.
130		- $real_dest = realpath( $gcdirectory );
131		- for ( $i = 0; $i < $zip->numFiles; $i++ ) {
132		- $stat = $zip->statIndex( $i );
133		- $entry = $stat['name'];
134		-
135		- if (
136		- strpos( $entry, '../' ) !== false ||
137		- strpos( $entry, '..' . DIRECTORY_SEPARATOR ) !== false ||
138		- '/' === substr( $entry, 0, 1 )
139		- ) {
140		- $zip->close();
141		- $fs->delete( $gcfilename );
142		- wp_send_json( array( 'status' => 'error', 'content' => esc_html__( 'Invalid zip structure — path traversal detected.', 'chatbot' ) ) );
143		- wp_die();
144		- }
145		-
146		- // Ensure resolved path stays within the destination directory.
147		- $resolved = realpath( $real_dest . DIRECTORY_SEPARATOR . $entry );
148		- if ( $resolved !== false && strpos( $resolved, $real_dest ) !== 0 ) {
149		- $zip->close();
150		- $fs->delete( $gcfilename );
151		- wp_send_json( array( 'status' => 'error', 'content' => esc_html__( 'Invalid zip structure — entry escapes destination.', 'chatbot' ) ) );
152		- wp_die();
153		- }
154		- }
155		-
156		- $zip->extractTo( $gcdirectory );
157		- $zip->close();
158		-
159		- // Remove the zip after successful extraction.
160		- $fs->delete( $gcfilename );
161		-
162		- wp_send_json( array( 'status' => 'success', 'content' => esc_html__( 'Files extracted successfully.', 'chatbot' ) ) );
163		- wp_die();
164		- }
165		-}
166		-
167		-new WPBotGCDownload();
	1	+<?php
	2	+if ( ! defined( 'ABSPATH' ) ) {
	3	+ exit;
	4	+}
	5	+
	6	+class WPBotGCDownload
	7	+{
	8	+ private $download_url = 'https://github.com/qcloud/gc/raw/master/wpbotgc.zip';
	9	+ private $filename = 'wpbotgc.zip';
	10	+ public function __construct(){
	11	+ add_action('wp_ajax_qcld_wp_chatbot_gc_client_download', array($this, 'downloadgc'));
	12	+ add_action('wp_ajax_nopriv_qcld_wp_chatbot_gc_client_download', array($this, 'downloadgc'));
	13	+ add_action('wp_ajax_qcld_wp_chatbot_gc_client_extract', array($this, 'extractgc'));
	14	+ add_action('wp_ajax_nopriv_qcld_wp_chatbot_gc_client_extract', array($this, 'extractgc'));
	15	+
	16	+ }
	17	+
	18	+ public function create_folder($gcdirectory){
	19	+ return @mkdir( $gcdirectory, 0777, true );
	20	+ }
	21	+
	22	+ public function create_file($filename){
	23	+ if ( ! @file_exists( $filename ) ) {
	24	+ if ( ! @is_writable( dirname( $filename ) ) ) {
	25	+ return false;
	26	+ }
	27	+
	28	+ if ( ! @touch( $filename ) ) {
	29	+ return false;
	30	+ }
	31	+ } elseif ( ! @is_writable( $filename ) ) {
	32	+ return false;
	33	+ }
	34	+
	35	+ $is_written = false;
	36	+ if ( ( $handle = @fopen( $filename, 'w' ) ) !== false ) {
	37	+ if ( @fwrite( $handle, '<?php //silence is golden' ) !== false ) {
	38	+ $is_written = true;
	39	+ }
	40	+
	41	+ @fclose( $handle );
	42	+ }
	43	+
	44	+ return $is_written;
	45	+ }
	46	+
	47	+ public function downloadgc(){
	48	+ $gcdirectory = QCLD_wpCHATBOT_GC_DIRNAME;
	49	+
	50	+ if ( ! is_dir( $gcdirectory ) ) {
	51	+ $this->create_folder( $gcdirectory );
	52	+ }
	53	+ if(!file_exists($gcdirectory.'/index.php')){
	54	+ $this->create_file( $gcdirectory.'/index.php' );
	55	+ }
	56	+
	57	+ if(is_dir($gcdirectory)){
	58	+
	59	+ $zipFile = $gcdirectory."/".$this->filename; // Local Zip File Path
	60	+ $zipResource = fopen($zipFile, "w");
	61	+ // Get The Zip File From Server
	62	+ $ch = curl_init();
	63	+ curl_setopt($ch, CURLOPT_URL, $this->download_url);
	64	+ curl_setopt($ch, CURLOPT_FAILONERROR, true);
	65	+ curl_setopt($ch, CURLOPT_HEADER, 0);
	66	+ curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
	67	+ curl_setopt($ch, CURLOPT_AUTOREFERER, true);
	68	+ curl_setopt($ch, CURLOPT_BINARYTRANSFER,true);
	69	+ curl_setopt($ch, CURLOPT_TIMEOUT, 10);
	70	+ curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
	71	+ curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
	72	+ curl_setopt($ch, CURLOPT_FILE, $zipResource);
	73	+ $page = curl_exec($ch);
	74	+ if(!$page) {
	75	+ $response = array('status'=>'error','content'=> curl_error($ch));
	76	+ echo wp_send_json($response);
	77	+ wp_die();
	78	+ }
	79	+ curl_close($ch);
	80	+ $response = array('status'=>'success','content'=> 'File downloaded successfully');
	81	+ }else{
	82	+ $response = array('status'=>'error','content'=> 'Server does not allow to create files and folders');
	83	+ }
	84	+
	85	+ echo wp_send_json($response);
	86	+ wp_die();
	87	+ }
	88	+
	89	+ function extractgc(){
	90	+ $gcdirectory = QCLD_wpCHATBOT_GC_DIRNAME;
	91	+ $gcfilename = QCLD_wpCHATBOT_GC_DIRNAME.'/'.$this->filename;
	92	+ /* Open the Zip file */
	93	+ $zip = new ZipArchive;
	94	+ $extractPath = "path_to_extract";
	95	+ if($zip->open($gcfilename) != "true"){
	96	+ $response = array('status'=>'error','content'=> 'File Not Found!');
	97	+ echo wp_send_json($response);
	98	+ wp_die();
	99	+ }
	100	+ /* Extract Zip File */
	101	+ $zip->extractTo($gcdirectory);
	102	+ $zip->close();
	103	+ @unlink($gcfilename);
	104	+ $response = array('status'=>'success','content'=> 'Files Extracted successfully!');
	105	+ echo wp_send_json($response);
	106	+ wp_die();
	107	+
	108	+ }
	109	+}
	110	+
	111	+new WPBotGCDownload();