← All changes | class/class-mainwp-backup-handler.php +20 -8 6.0.11 → 6.2.2 View file →

		@@ -252,9 +252,9 @@
252	252
253	253	if ( ! empty( $temp ) ) {
254	254	if ( 'stalled' === $temp['status'] ) {
255	255	if ( 5 > $backupTaskProgress->attempts ) {
256		- $backupTaskProgress = MainWP_DB_Backup::instance()->update_backup_task_progress( $taskId, $website->id, array( 'attempts' => $backupTaskProgress->attempts ++ ) );
	256	+ $backupTaskProgress = MainWP_DB_Backup::instance()->update_backup_task_progress( $taskId, $website->id, array( 'attempts' => $backupTaskProgress->attempts++ ) );
257	257
258	258	try {
259	259	$information = MainWP_Connect::fetch_url_authed(
260	260	$website,
		@@ -315,9 +315,9 @@
315	315
316	316	$backupTaskProgress = MainWP_DB_Backup::instance()->update_backup_task_progress( $taskId, $website->id, array( 'fetchResult' => wp_json_encode( $information ) ) );
317	317	}
318	318	} elseif ( 5 > $backupTaskProgress->attempts ) {
319		- $backupTaskProgress = MainWP_DB_Backup::instance()->update_backup_task_progress( $taskId, $website->id, array( 'attempts' => $backupTaskProgress->attempts ++ ) );
	319	+ $backupTaskProgress = MainWP_DB_Backup::instance()->update_backup_task_progress( $taskId, $website->id, array( 'attempts' => $backupTaskProgress->attempts++ ) );
320	320	} else {
321	321	throw new MainWP_Exception( 'Backup failed after 5 retries.' );
322	322	}
323	323	}
		@@ -343,9 +343,9 @@
343	343	global $wp_filesystem;
344	344
345	345	$dir = MainWP_System_Utility::get_mainwp_specific_dir( $website->id );
346	346
347		- $wp_filesystem->mkdir( $dir, 0777 );
	347	+ $wp_filesystem->mkdir( $dir, 0750 ); // MWP-1558: tightened from 0777; per-site backup dumps.
348	348
349	349	if ( ! $wp_filesystem->exists( $dir . 'index.php' ) ) {
350	350	$wp_filesystem->touch( $dir . 'index.php' );
351	351	}
		@@ -442,9 +442,13 @@
442	442	$localBackupFile = $backupTaskProgress->downloadedDB;
443	443	}
444	444
445	445	if ( 0 === (int) $backupTaskProgress->downloadedDBComplete ) {
446		- MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $information['db'], 'fdl' ), $localBackupFile, $information['size'], $website->http_user, $website->http_pass );
	446	+ // MWP-1548: decrypt at the boundary so download_to_file
	447	+ // sees plaintext credentials.
	448	+ $http_user_plain = MainWP_Credential_Storage::decrypt_credential( $website->http_user );
	449	+ $http_pass_plain = MainWP_Credential_Storage::decrypt_credential( $website->http_pass );
	450	+ MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $information['db'], 'fdl' ), $localBackupFile, $information['size'], $http_user_plain, $http_pass_plain );
447	451	$backupTaskProgress = MainWP_DB_Backup::instance()->update_backup_task_progress( $taskId, $website->id, array( 'downloadedDBComplete' => 1 ) );
448	452	}
449	453	}
450	454
		@@ -505,9 +509,12 @@
505	509	return false;
506	510	}
507	511	}
508	512
509		- MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $information['full'], 'fdl' ), $localBackupFile, $information['size'], $website->http_user, $website->http_pass );
	513	+ // MWP-1548: decrypt at the boundary.
	514	+ $http_user_plain = MainWP_Credential_Storage::decrypt_credential( $website->http_user );
	515	+ $http_pass_plain = MainWP_Credential_Storage::decrypt_credential( $website->http_pass );
	516	+ MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $information['full'], 'fdl' ), $localBackupFile, $information['size'], $http_user_plain, $http_pass_plain );
510	517	MainWP_Connect::fetch_url_authed( $website, 'delete_backup', array( 'del' => $information['full'] ) );
511	518	$backupTaskProgress = MainWP_DB_Backup::instance()->update_backup_task_progress( $taskId, $website->id, array( 'downloadedFULLComplete' => 1 ) );
512	519	}
513	520	}
		@@ -556,9 +563,9 @@
556	563	*/
557	564	global $wp_filesystem;
558	565
559	566	$dir = dirname( $pFile ) . '/';
560		- $wp_filesystem->mkdir( $dir, 0777 );
	567	+ $wp_filesystem->mkdir( $dir, 0750 ); // MWP-1558: tightened from 0777; backup download destination.
561	568	if ( ! $wp_filesystem->exists( $dir . 'index.php' ) ) {
562	569	$wp_filesystem->touch( $dir . 'index.php' );
563	570	}
564	571	// Clean old backups from our system.
		@@ -609,14 +616,19 @@
609	616
610	617	$website = MainWP_DB::instance()->get_website_by_id( $pSiteId );
611	618	MainWP_Utility::end_session();
612	619
	620	+ // MWP-1548: decrypt once at function boundary; both branches use
	621	+ // the same credentials.
	622	+ $http_user_plain = MainWP_Credential_Storage::decrypt_credential( $website->http_user );
	623	+ $http_pass_plain = MainWP_Credential_Storage::decrypt_credential( $website->http_pass );
	624	+
613	625	if ( 'db' === $pType ) {
614		- MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $pUrl, 'fdl' ), $pFile, false, $website->http_user, $website->http_pass );
	626	+ MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $pUrl, 'fdl' ), $pFile, false, $http_user_plain, $http_pass_plain );
615	627	}
616	628
617	629	if ( 'full' === $pType ) {
618		- MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $pUrl, 'fdl' ), $pFile, false, $website->http_user, $website->http_pass );
	630	+ MainWP_Connect::download_to_file( MainWP_Connect::get_get_data_authed( $website, $pUrl, 'fdl' ), $pFile, false, $http_user_plain, $http_pass_plain );
619	631	}
620	632
621	633	return true;
622	634	}