class.jetpack-json-api-themes-replace-endpoint.php — Jetpack – WP Security, Backup, Speed, & Growth 16.1-beta

jetpack / json-endpoints / jetpack / class.jetpack-json-api-themes-replace-endpoint.php

jetpack / json-endpoints / jetpack Last commit date

class.jetpack-json-api-themes-replace-endpoint.php

245 lines

1	<?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2
3	use Automattic\Jetpack\Automatic_Install_Skin;
4
5	if ( ! defined( 'ABSPATH' ) ) {
6	exit( 0 );
7	}
8
9	require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
10	require_once ABSPATH . 'wp-admin/includes/file.php';
11
12	/**
13	* Install-or-replace a theme via zip upload. Passes overwrite_package=true to
14	* Theme_Upgrader so an existing theme at the same slug is replaced in place,
15	* mirroring wp-admin's "Replace current with uploaded" confirmation flow.
16	*
17	* POST /sites/%s/themes/replace
18	*
19	* ## Authentication trust model
20	*
21	* Two auth modes are supported:
22	*
23	* 1. User auth — the request is mapped to a WordPress user who must hold
24	* `install_themes` AND `update_themes`. The ownership check verifies the
25	* referenced attachment was authored by that same user, preventing the
26	* endpoint from being used to touch another user's attachments.
27	*
28	* 2. Site-based auth (`allow_jetpack_site_auth => true`) — no user is
29	* identified; capability and ownership checks are skipped. The wpcom
30	* upload forwarder is expected to (a) vouch for the caller, (b) create the
31	* attachment as part of the same request's upload-intercept pipeline, and
32	* (c) pass the resulting ID through unchanged. If that contract is broken
33	* on the wpcom side, any trusted site credential becomes install-anything
34	* on the site.
35	*
36	* ## Cross-user attachment-deletion guard
37	*
38	* `Jetpack_JSON_API_Themes_New_Endpoint::validate_call` deletes the referenced
39	* attachment on capability-check failure without verifying the caller owns it.
40	* This Replace endpoint overrides `validate_call` to run the ownership check
41	* first, so a low-privilege caller cannot use it to hard-delete another user's
42	* attachment as a side-effect of the cap check failing. The parent's behavior
43	* is unchanged for the legitimate case (caller's own attachment is cleaned up
44	* when their cap check fails).
45	*
46	* @phan-constructor-used-for-side-effects
47	*/
48	class Jetpack_JSON_API_Themes_Replace_Endpoint extends Jetpack_JSON_API_Themes_New_Endpoint {
49	use Jetpack_JSON_API_Attachment_Ownership_Trait;
50
51	/**
52	* Replace is destructive, so require both install and update caps.
53	*
54	* @var array
55	*/
56	protected $needed_capabilities = array( 'install_themes', 'update_themes' );
57
58	/**
59	* Error codes we are willing to surface to the caller. Anything outside
60	* this list is collapsed to 'install_failed' with a generic message to
61	* avoid leaking filesystem paths from Theme_Upgrader internals.
62	*
63	* Kept aligned with codes actually emitted by `WP_Upgrader` /
64	* `Theme_Upgrader` — $this->strings[] message keys are NOT error codes
65	* and do not belong here.
66	*
67	* @var array
68	*/
69	protected static $allowed_error_codes = array(
70	'no_package',
71	'bad_request',
72	'files_not_writable',
73	'copy_dir_failed',
74	'remove_old_failed',
75	'source_read_failed',
76	'new_source_read_failed',
77	'mkdir_failed_destination',
78	'folder_exists',
79	'incompatible_archive',
80	'incompatible_archive_empty',
81	'incompatible_archive_theme_no_style',
82	'incompatible_archive_theme_no_name',
83	'incompatible_archive_theme_no_index',
84	'incompatible_php_required_version',
85	'incompatible_wp_required_version',
86	'unable_to_connect_to_filesystem',
87	'fs_unavailable',
88	'fs_error',
89	'fs_no_themes_dir',
90	'fs_no_folder',
91	'fs_no_root_dir',
92	'fs_no_content_dir',
93	'fs_no_temp_backup_dir',
94	'fs_temp_backup_mkdir',
95	'fs_temp_backup_move',
96	);
97
98	/**
99	* Install, replacing any existing theme at the same slug.
100	*
101	* @return bool\|WP_Error
102	*/
103	public function install() {
104	$args = $this->input();
105
106	if ( ! isset( $args['zip'][0]['id'] ) \|\| ! is_scalar( $args['zip'][0]['id'] ) ) {
107	return new WP_Error( 'no_theme_installed', __( 'No theme zip file was provided.', 'jetpack' ), 400 );
108	}
109
110	$expected_slug = isset( $args['slug'] ) && is_scalar( $args['slug'] )
111	? strtolower( (string) $args['slug'] )
112	: '';
113	if ( ! preg_match( '/^[a-z0-9][a-z0-9_-]*$/', $expected_slug ) ) {
114	return new WP_Error( 'missing_slug', __( 'A valid theme slug is required; the replace endpoint refuses to overwrite a theme whose slug the caller has not declared.', 'jetpack' ), 400 );
115	}
116
117	$attachment_id = (int) $args['zip'][0]['id'];
118
119	// Re-checked here so direct invocations of install() (notably the test stubs)
120	// can't accidentally bypass the ownership guard that validate_call() runs on
121	// the live request path.
122	$ownership = $this->validate_attachment_ownership( $attachment_id );
123	if ( is_wp_error( $ownership ) ) {
124	return $ownership;
125	}
126
127	$zip_check = $this->validate_attachment_is_zip( $attachment_id );
128	if ( is_wp_error( $zip_check ) ) {
129	wp_delete_attachment( $attachment_id, true );
130	return $zip_check;
131	}
132
133	$local_file = get_attached_file( $attachment_id );
134	if ( ! $local_file ) {
135	wp_delete_attachment( $attachment_id, true );
136	return new WP_Error( 'local-file-does-not-exist', __( 'Uploaded theme zip could not be found on disk.', 'jetpack' ), 400 );
137	}
138
139	$skin = new Automatic_Install_Skin();
140	$upgrader = new Theme_Upgrader( $skin );
141
142	$result = $upgrader->install(
143	$local_file,
144	array( 'overwrite_package' => true )
145	);
146
147	wp_delete_attachment( $attachment_id, true );
148
149	if ( is_wp_error( $result ) ) {
150	return $this->sanitize_upgrader_error( $result );
151	}
152
153	if ( ! $result ) {
154	$error_code = $skin->get_main_error_code();
155	if ( 'download_failed' === $error_code ) {
156	$error_code = 'no_package';
157	}
158	if ( empty( $error_code ) \|\| ! in_array( $error_code, self::$allowed_error_codes, true ) ) {
159	$error_code = 'install_failed';
160	}
161	return new WP_Error( $error_code, __( 'Theme installation failed.', 'jetpack' ), 400 );
162	}
163
164	$theme_info = $upgrader->theme_info();
165	$theme_slug = $theme_info ? $theme_info->get_stylesheet() : '';
166	if ( empty( $theme_slug ) ) {
167	return new WP_Error( 'theme_replace_info_missing', __( 'Theme was installed but its identifier could not be determined.', 'jetpack' ), 500 );
168	}
169
170	// `overwrite_package=true` trusts the zip's own folder name, so a zip whose
171	// top-level folder differs from the declared slug would clobber an unrelated
172	// theme. Verify the post-install identifier matches the caller's contract.
173	if ( strtolower( $theme_slug ) !== $expected_slug ) {
174	return new WP_Error( 'slug_mismatch', __( 'The installed theme does not match the declared slug.', 'jetpack' ), 400 );
175	}
176
177	$this->themes = array( $theme_slug );
178	$this->log[ $theme_slug ] = $upgrader->skin->get_upgrade_messages();
179
180	return true;
181	}
182
183	/**
184	* See class docblock — runs the attachment-ownership check before delegating
185	* to the parent's validate_call(), which deletes the referenced attachment
186	* on capability-check failure without verifying ownership.
187	*
188	* @param int $_blog_id Blog ID.
189	* @param string $capability Capability.
190	* @param bool $check_manage_active Whether to check manage-is-active.
191	* @return bool\|WP_Error
192	*/
193	protected function validate_call( $_blog_id, $capability, $check_manage_active = true ) {
194	$args = $this->input();
195	if ( isset( $args['zip'][0]['id'] ) && is_scalar( $args['zip'][0]['id'] ) ) {
196	$ownership = $this->validate_attachment_ownership( (int) $args['zip'][0]['id'] );
197	if ( is_wp_error( $ownership ) ) {
198	return $ownership;
199	}
200	}
201	return parent::validate_call( $_blog_id, $capability, $check_manage_active );
202	}
203
204	/**
205	* Collapse unknown error codes and strip potentially path-leaking messages
206	* from WP_Error instances returned by Theme_Upgrader.
207	*
208	* @param WP_Error $error Raw upgrader error.
209	* @return WP_Error
210	*/
211	protected function sanitize_upgrader_error( WP_Error $error ) {
212	$code = $error->get_error_code();
213	if ( empty( $code ) \|\| ! in_array( $code, self::$allowed_error_codes, true ) ) {
214	return new WP_Error( 'install_failed', __( 'Theme installation failed.', 'jetpack' ), 400 );
215	}
216	return new WP_Error( $code, __( 'Theme installation failed.', 'jetpack' ), 400 );
217	}
218	}
219
220	// POST /sites/%s/themes/replace
221	new Jetpack_JSON_API_Themes_Replace_Endpoint(
222	array(
223	'description' => 'Install or replace a theme on a Jetpack site by uploading a zip file. If a theme with the same slug is already installed, its destination folder is replaced in place, mirroring wp-admin\'s "Replace current with uploaded" upload flow.',
224	'group' => '__do_not_document',
225	'stat' => 'themes:replace',
226	'method' => 'POST',
227	'path' => '/sites/%s/themes/replace',
228	'path_labels' => array(
229	'$site' => '(int\|string) Site ID or domain',
230	),
231	'request_format' => array(
232	'zip' => '(array) Reference to an uploaded theme package zip file.',
233	'slug' => '(string) The theme slug the uploaded zip must resolve to. Required; the endpoint rejects zips whose top-level folder does not match.',
234	),
235	'response_format' => Jetpack_JSON_API_Themes_Endpoint::$_response_format,
236	'allow_jetpack_site_auth' => true,
237	'example_request_data' => array(
238	'headers' => array(
239	'authorization' => 'Bearer YOUR_API_TOKEN',
240	),
241	),
242	'example_request' => 'https://public-api.wordpress.com/rest/v1/sites/example.wordpress.org/themes/replace',
243	)
244	);
245