← All changes | class/class-mainwp-backup-handler.php +25 -8 5.2 → 6.2.1 View file →

		@@ -6,8 +6,13 @@
6	6	*/
7	7
8	8	namespace MainWP\Dashboard;
9	9
	10	+// Exit if accessed directly.
	11	+if ( ! defined( 'ABSPATH' ) ) {
	12	+ exit;
	13	+}
	14	+
10	15	/**
11	16	* Class MainWP_Backup_Handler
12	17	*
13	18	* @package MainWP\Dashboard
		@@ -247,9 +252,9 @@
247	252
248	253	if ( ! empty( $temp ) ) {
249	254	if ( 'stalled' === $temp['status'] ) {
250	255	if ( 5 > $backupTaskProgress->attempts ) {
251		- $backupTaskProgress = MainWP_DB_Backup::instance()->update_backup_task_progress( $taskId, $website->id, array( 'attempts' => $backupTaskProgress->attempts ++ ) );
	256	+ $backupTaskProgress = MainWP_DB_Backup::instance()->update_backup_task_progress( $taskId, $website->id, array( 'attempts' => $backupTaskProgress->attempts++ ) );
252	257
253	258	try {
254	259	$information = MainWP_Connect::fetch_url_authed(
255	260	$website,
		@@ -310,9 +315,9 @@
310	315
311	316	$backupTaskProgress = MainWP_DB_Backup::instance()->update_backup_task_progress( $taskId, $website->id, array( 'fetchResult' => wp_json_encode( $information ) ) );
312	317	}
313	318	} elseif ( 5 > $backupTaskProgress->attempts ) {
314		- $backupTaskProgress = MainWP_DB_Backup::instance()->update_backup_task_progress( $taskId, $website->id, array( 'attempts' => $backupTaskProgress->attempts ++ ) );
	319	+ $backupTaskProgress = MainWP_DB_Backup::instance()->update_backup_task_progress( $taskId, $website->id, array( 'attempts' => $backupTaskProgress->attempts++ ) );
315	320	} else {
316	321	throw new MainWP_Exception( 'Backup failed after 5 retries.' );
317	322	}
318	323	}
		@@ -338,9 +343,9 @@
338	343	global $wp_filesystem;
339	344
340	345	$dir = MainWP_System_Utility::get_mainwp_specific_dir( $website->id );
341	346
342		- $wp_filesystem->mkdir( $dir, 0777 );
	347	+ $wp_filesystem->mkdir( $dir, 0750 ); // MWP-1558: tightened from 0777; per-site backup dumps.
343	348
344	349	if ( ! $wp_filesystem->exists( $dir . 'index.php' ) ) {
345	350	$wp_filesystem->touch( $dir . 'index.php' );
346	351	}
		@@ -437,9 +442,13 @@
437	442	$localBackupFile = $backupTaskProgress->downloadedDB;
438	443	}
439	444
440	445	if ( 0 === (int) $backupTaskProgress->downloadedDBComplete ) {
441		- MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $information['db'], 'fdl' ), $localBackupFile, $information['size'], $website->http_user, $website->http_pass );
	446	+ // MWP-1548: decrypt at the boundary so download_to_file
	447	+ // sees plaintext credentials.
	448	+ $http_user_plain = MainWP_Credential_Storage::decrypt_credential( $website->http_user );
	449	+ $http_pass_plain = MainWP_Credential_Storage::decrypt_credential( $website->http_pass );
	450	+ MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $information['db'], 'fdl' ), $localBackupFile, $information['size'], $http_user_plain, $http_pass_plain );
442	451	$backupTaskProgress = MainWP_DB_Backup::instance()->update_backup_task_progress( $taskId, $website->id, array( 'downloadedDBComplete' => 1 ) );
443	452	}
444	453	}
445	454
		@@ -500,9 +509,12 @@
500	509	return false;
501	510	}
502	511	}
503	512
504		- MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $information['full'], 'fdl' ), $localBackupFile, $information['size'], $website->http_user, $website->http_pass );
	513	+ // MWP-1548: decrypt at the boundary.
	514	+ $http_user_plain = MainWP_Credential_Storage::decrypt_credential( $website->http_user );
	515	+ $http_pass_plain = MainWP_Credential_Storage::decrypt_credential( $website->http_pass );
	516	+ MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $information['full'], 'fdl' ), $localBackupFile, $information['size'], $http_user_plain, $http_pass_plain );
505	517	MainWP_Connect::fetch_url_authed( $website, 'delete_backup', array( 'del' => $information['full'] ) );
506	518	$backupTaskProgress = MainWP_DB_Backup::instance()->update_backup_task_progress( $taskId, $website->id, array( 'downloadedFULLComplete' => 1 ) );
507	519	}
508	520	}
		@@ -551,9 +563,9 @@
551	563	*/
552	564	global $wp_filesystem;
553	565
554	566	$dir = dirname( $pFile ) . '/';
555		- $wp_filesystem->mkdir( $dir, 0777 );
	567	+ $wp_filesystem->mkdir( $dir, 0750 ); // MWP-1558: tightened from 0777; backup download destination.
556	568	if ( ! $wp_filesystem->exists( $dir . 'index.php' ) ) {
557	569	$wp_filesystem->touch( $dir . 'index.php' );
558	570	}
559	571	// Clean old backups from our system.
		@@ -604,14 +616,19 @@
604	616
605	617	$website = MainWP_DB::instance()->get_website_by_id( $pSiteId );
606	618	MainWP_Utility::end_session();
607	619
	620	+ // MWP-1548: decrypt once at function boundary; both branches use
	621	+ // the same credentials.
	622	+ $http_user_plain = MainWP_Credential_Storage::decrypt_credential( $website->http_user );
	623	+ $http_pass_plain = MainWP_Credential_Storage::decrypt_credential( $website->http_pass );
	624	+
608	625	if ( 'db' === $pType ) {
609		- MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $pUrl, 'fdl' ), $pFile, false, $website->http_user, $website->http_pass );
	626	+ MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $pUrl, 'fdl' ), $pFile, false, $http_user_plain, $http_pass_plain );
610	627	}
611	628
612	629	if ( 'full' === $pType ) {
613		- MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $pUrl, 'fdl' ), $pFile, false, $website->http_user, $website->http_pass );
	630	+ MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $pUrl, 'fdl' ), $pFile, false, $http_user_plain, $http_pass_plain );
614	631	}
615	632
616	633	return true;
617	634	}