← All changes | includes/class-wpbot-gc-download.php +90 -135 8.7.5 → 5.2.5 View file →

		@@ -4,166 +4,121 @@
4	4	}
5	5
6	6	class WPBotGCDownload
7	7	{
	8	+ private $download_url = 'https://github.com/qcloud/gc/raw/master/wpbotgc.zip';
8	9	private $filename = 'wpbotgc.zip';
	10	+ public function __construct(){
	11	+ add_action('wp_ajax_qcld_wp_chatbot_gc_client_download', array($this, 'downloadgc'));
	12	+ add_action('wp_ajax_nopriv_qcld_wp_chatbot_gc_client_download', array($this, 'downloadgc'));
	13	+ add_action('wp_ajax_qcld_wp_chatbot_gc_client_extract', array($this, 'extractgc'));
	14	+ add_action('wp_ajax_nopriv_qcld_wp_chatbot_gc_client_extract', array($this, 'extractgc'));
	15	+
	16	+ }
9	17
10		- /**
11		- * Path to the bundled Google Client zip inside the plugin.
12		- *
13		- * @return string
14		- */
15		- private function get_bundled_zip_path() {
16		- return plugin_dir_path( __FILE__ ) . 'assets/' . $this->filename;
	18	+ public function create_folder($gcdirectory){
	19	+ return @mkdir( $gcdirectory, 0777, true );
17	20	}
18	21
19		- public function __construct() {
20		- add_action( 'wp_ajax_qcld_wp_chatbot_gc_client_download', array( $this, 'downloadgc' ) );
21		- add_action( 'wp_ajax_qcld_wp_chatbot_gc_client_extract', array( $this, 'extractgc' ) );
22		- }
	22	+ public function create_file($filename){
	23	+ if ( ! @file_exists( $filename ) ) {
	24	+ if ( ! @is_writable( dirname( $filename ) ) ) {
	25	+ return false;
	26	+ }
23	27
24		- /**
25		- * Initialise WP_Filesystem and return the global instance.
26		- */
27		- private function get_filesystem() {
28		- global $wp_filesystem;
29		- if ( empty( $wp_filesystem ) ) {
30		- require_once ABSPATH . 'wp-admin/includes/file.php';
31		- WP_Filesystem();
32		- }
33		- return $wp_filesystem;
34		- }
	28	+ if ( ! @touch( $filename ) ) {
	29	+ return false;
	30	+ }
	31	+ } elseif ( ! @is_writable( $filename ) ) {
	32	+ return false;
	33	+ }
35	34
36		- /**
37		- * Create a directory using WP_Filesystem.
38		- */
39		- public function create_folder( $gcdirectory ) {
40		- $fs = $this->get_filesystem();
41		- if ( ! $fs->is_dir( $gcdirectory ) ) {
42		- return $fs->mkdir( $gcdirectory, FS_CHMOD_DIR );
43		- }
44		- return true;
45		- }
	35	+ $is_written = false;
	36	+ if ( ( $handle = @fopen( $filename, 'w' ) ) !== false ) {
	37	+ if ( @fwrite( $handle, '<?php //silence is golden' ) !== false ) {
	38	+ $is_written = true;
	39	+ }
46	40
47		- /**
48		- * Create a blank index.php guard file using WP_Filesystem.
49		- */
50		- public function create_file( $filename ) {
51		- $fs = $this->get_filesystem();
52		- if ( $fs->exists( $filename ) ) {
53		- return true;
54		- }
55		- return $fs->put_contents( $filename, '<?php //silence is golden', FS_CHMOD_FILE );
	41	+ @fclose( $handle );
	42	+ }
	43	+
	44	+ return $is_written;
56	45	}
57	46
58		- public function downloadgc() {
59		- if ( ! current_user_can( 'manage_options' ) ) {
60		- wp_send_json( array( 'success' => false, 'msg' => esc_html__( 'Unauthorized access', 'chatbot' ) ) );
	47	+ public function downloadgc(){
	48	+ $nonce = sanitize_text_field($_POST['nonce']);
	49	+ if (! wp_verify_nonce($nonce,'wp_chatbot')) {
	50	+ wp_send_json(array('success' => false, 'msg' => esc_html__('Failed in Security check', 'sm')));
61	51	wp_die();
62		- }
63	52
64		- $nonce = sanitize_text_field( wp_unslash( $_POST['nonce'] ?? '' ) );
65		- if ( ! wp_verify_nonce( $nonce, 'wp_chatbot' ) ) {
66		- wp_send_json( array( 'success' => false, 'msg' => esc_html__( 'Failed in Security check', 'chatbot' ) ) );
67		- wp_die();
68		- }
	53	+ }else{
	54	+ $gcdirectory = QCLD_wpCHATBOT_GC_DIRNAME;
69	55
70		- $fs = $this->get_filesystem();
71		- $gcdirectory = QCLD_wpCHATBOT_GC_DIRNAME;
	56	+ if ( ! is_dir( $gcdirectory ) ) {
	57	+ $this->create_folder( $gcdirectory );
	58	+ }
	59	+ if(!file_exists($gcdirectory.'/index.php')){
	60	+ $this->create_file( $gcdirectory.'/index.php' );
	61	+ }
72	62
73		- if ( ! $fs->is_dir( $gcdirectory ) ) {
74		- $this->create_folder( $gcdirectory );
75		- }
	63	+ if(is_dir($gcdirectory)){
76	64
77		- if ( ! $fs->exists( $gcdirectory . '/index.php' ) ) {
78		- $this->create_file( $gcdirectory . '/index.php' );
79		- }
	65	+ $zipFile = $gcdirectory."/".$this->filename; // Local Zip File Path
	66	+ $zipResource = fopen($zipFile, "w");
	67	+ // Get The Zip File From Server
	68	+ $ch = curl_init();
	69	+ curl_setopt($ch, CURLOPT_URL, $this->download_url);
	70	+ curl_setopt($ch, CURLOPT_FAILONERROR, true);
	71	+ curl_setopt($ch, CURLOPT_HEADER, 0);
	72	+ curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
	73	+ curl_setopt($ch, CURLOPT_AUTOREFERER, true);
	74	+ curl_setopt($ch, CURLOPT_BINARYTRANSFER,true);
	75	+ curl_setopt($ch, CURLOPT_TIMEOUT, 10);
	76	+ curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
	77	+ curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
	78	+ curl_setopt($ch, CURLOPT_FILE, $zipResource);
	79	+ $page = curl_exec($ch);
	80	+ if(!$page) {
	81	+ $response = array('status'=>'error','content'=> curl_error($ch));
	82	+ echo wp_send_json($response);
	83	+ wp_die();
	84	+ }
	85	+ curl_close($ch);
	86	+ $response = array('status'=>'success','content'=> 'File downloaded successfully');
	87	+ }else{
	88	+ $response = array('status'=>'error','content'=> 'Server does not allow to create files and folders');
	89	+ }
80	90
81		- if ( ! $fs->is_dir( $gcdirectory ) ) {
82		- wp_send_json( array( 'status' => 'error', 'content' => esc_html__( 'Server does not allow creating files and folders.', 'chatbot' ) ) );
	91	+ echo wp_send_json($response);
83	92	wp_die();
84	93	}
85		-
86		- $zip_file = $gcdirectory . '/' . $this->filename;
87		- $bundled = $this->get_bundled_zip_path();
88		-
89		- if ( ! $fs->exists( $bundled ) ) {
90		- wp_send_json( array( 'status' => 'error', 'content' => esc_html__( 'Bundled Google Client package not found. Please install it manually using the instructions above.', 'chatbot' ) ) );
91		- wp_die();
92		- }
93		-
94		- if ( ! $fs->copy( $bundled, $zip_file, true, FS_CHMOD_FILE ) ) {
95		- wp_send_json( array( 'status' => 'error', 'content' => esc_html__( 'Could not copy the Google Client package.', 'chatbot' ) ) );
96		- wp_die();
97		- }
98		-
99		- wp_send_json( array( 'status' => 'success', 'content' => esc_html__( 'File downloaded successfully.', 'chatbot' ) ) );
100		- wp_die();
101	94	}
102	95
103		- public function extractgc() {
104		- if ( ! current_user_can( 'manage_options' ) ) {
105		- wp_send_json( array( 'success' => false, 'msg' => esc_html__( 'Unauthorized access', 'chatbot' ) ) );
	96	+ function extractgc(){
	97	+ $nonce = sanitize_text_field($_POST['nonce']);
	98	+ if (! wp_verify_nonce($nonce,'wp_chatbot')) {
	99	+ wp_send_json(array('success' => false, 'msg' => esc_html__('Failed in Security check', 'sm')));
106	100	wp_die();
107		- }
108	101
109		- $nonce = sanitize_text_field( wp_unslash( $_POST['nonce'] ?? '' ) );
110		- if ( ! wp_verify_nonce( $nonce, 'wp_chatbot' ) ) {
111		- wp_send_json( array( 'success' => false, 'msg' => esc_html__( 'Failed in Security check', 'chatbot' ) ) );
	102	+ }else{
	103	+ $gcdirectory = QCLD_wpCHATBOT_GC_DIRNAME;
	104	+ $gcfilename = QCLD_wpCHATBOT_GC_DIRNAME.'/'.$this->filename;
	105	+ /* Open the Zip file */
	106	+ $zip = new ZipArchive;
	107	+ $extractPath = "path_to_extract";
	108	+ if($zip->open($gcfilename) != "true"){
	109	+ $response = array('status'=>'error','content'=> 'File Not Found!');
	110	+ echo wp_send_json($response);
	111	+ wp_die();
	112	+ }
	113	+ /* Extract Zip File */
	114	+ $zip->extractTo($gcdirectory);
	115	+ $zip->close();
	116	+ @unlink($gcfilename);
	117	+ $response = array('status'=>'success','content'=> 'Files Extracted successfully!');
	118	+ echo wp_send_json($response);
112	119	wp_die();
113	120	}
114		-
115		- $fs = $this->get_filesystem();
116		- $gcdirectory = QCLD_wpCHATBOT_GC_DIRNAME;
117		- $gcfilename = $gcdirectory . '/' . $this->filename;
118		-
119		- // Verify the zip exists before attempting to open it.
120		- if ( ! $fs->exists( $gcfilename ) ) {
121		- wp_send_json( array( 'status' => 'error', 'content' => esc_html__( 'File not found.', 'chatbot' ) ) );
122		- wp_die();
123		- }
124		-
125		- $zip = new ZipArchive();
126		- if ( true !== $zip->open( $gcfilename ) ) {
127		- wp_send_json( array( 'status' => 'error', 'content' => esc_html__( 'Could not open zip archive.', 'chatbot' ) ) );
128		- wp_die();
129		- }
130		-
131		- // Validate every entry: block path traversal and absolute paths.
132		- $real_dest = realpath( $gcdirectory );
133		- for ( $i = 0; $i < $zip->numFiles; $i++ ) {
134		- $stat = $zip->statIndex( $i );
135		- $entry = $stat['name'];
136		-
137		- if (
138		- strpos( $entry, '../' ) !== false ||
139		- strpos( $entry, '..' . DIRECTORY_SEPARATOR ) !== false ||
140		- '/' === substr( $entry, 0, 1 )
141		- ) {
142		- $zip->close();
143		- $fs->delete( $gcfilename );
144		- wp_send_json( array( 'status' => 'error', 'content' => esc_html__( 'Invalid zip structure — path traversal detected.', 'chatbot' ) ) );
145		- wp_die();
146		- }
147		-
148		- // Ensure resolved path stays within the destination directory.
149		- $resolved = realpath( $real_dest . DIRECTORY_SEPARATOR . $entry );
150		- if ( $resolved !== false && strpos( $resolved, $real_dest ) !== 0 ) {
151		- $zip->close();
152		- $fs->delete( $gcfilename );
153		- wp_send_json( array( 'status' => 'error', 'content' => esc_html__( 'Invalid zip structure — entry escapes destination.', 'chatbot' ) ) );
154		- wp_die();
155		- }
156		- }
157		-
158		- $zip->extractTo( $gcdirectory );
159		- $zip->close();
160		-
161		- // Remove the zip after successful extraction.
162		- $fs->delete( $gcfilename );
163		-
164		- wp_send_json( array( 'status' => 'success', 'content' => esc_html__( 'Files extracted successfully.', 'chatbot' ) ) );
165		- wp_die();
166	121	}
167	122	}
168	123
169	124	new WPBotGCDownload();