JsonFileFeed.php
525 lines
| 1 | <?php |
| 2 | /** |
| 3 | * JSON File Feed class. |
| 4 | * |
| 5 | * @package Automattic\WooCommerce\Internal\ProductFeed |
| 6 | */ |
| 7 | |
| 8 | declare(strict_types=1); |
| 9 | |
| 10 | namespace Automattic\WooCommerce\Internal\ProductFeed\Storage; |
| 11 | |
| 12 | use Automattic\WooCommerce\Internal\Utilities\FilesystemUtil; |
| 13 | use Automattic\WooCommerce\Internal\ProductFeed\Feed\FeedInterface; |
| 14 | use Automattic\WooCommerce\Internal\ProductFeed\Feed\FeedLockException; |
| 15 | use Automattic\WooCommerce\Internal\ProductFeed\Feed\ResumableFeedInterface; |
| 16 | use Exception; |
| 17 | |
| 18 | // This file works directly with local files. That's fine. |
| 19 | // phpcs:disable WordPress.WP.AlternativeFunctions |
| 20 | |
| 21 | /** |
| 22 | * File-backed JSON feed storage. |
| 23 | * |
| 24 | * This class writes JSON directly to a file, entry by entry, without keeping everything in memory. |
| 25 | * |
| 26 | * @since 10.5.0 |
| 27 | */ |
| 28 | class JsonFileFeed implements ResumableFeedInterface { |
| 29 | public const UPLOAD_DIR = 'product-feeds'; |
| 30 | |
| 31 | /** |
| 32 | * The number of entries added to the feed. |
| 33 | * |
| 34 | * @var int |
| 35 | */ |
| 36 | private $entry_count = 0; |
| 37 | |
| 38 | /** |
| 39 | * The base name of the feed file. |
| 40 | * |
| 41 | * @var string |
| 42 | */ |
| 43 | private $base_name; |
| 44 | |
| 45 | /** |
| 46 | * The name of the feed file, no directory. |
| 47 | * |
| 48 | * @var string |
| 49 | */ |
| 50 | private $file_name; |
| 51 | |
| 52 | /** |
| 53 | * The path to the feed file. |
| 54 | * |
| 55 | * @var string |
| 56 | */ |
| 57 | private $file_path; |
| 58 | |
| 59 | /** |
| 60 | * The file handle. |
| 61 | * |
| 62 | * Only ever a resource or null: open_handle() throws instead of storing a failed fopen(). |
| 63 | * |
| 64 | * @var resource|null |
| 65 | */ |
| 66 | private $file_handle = null; |
| 67 | |
| 68 | /** |
| 69 | * Indicates if the feed file has been completed. |
| 70 | * |
| 71 | * @var bool |
| 72 | */ |
| 73 | private $file_completed = false; |
| 74 | |
| 75 | /** |
| 76 | * The URL of the feed file. |
| 77 | * |
| 78 | * @var string|null |
| 79 | */ |
| 80 | private $file_url = null; |
| 81 | |
| 82 | /** |
| 83 | * Cached upload directory details (path and URL), resolved once per feed instance. |
| 84 | * |
| 85 | * @var array|null |
| 86 | */ |
| 87 | private $prepared_upload_dir = null; |
| 88 | |
| 89 | /** |
| 90 | * Constructor. |
| 91 | * |
| 92 | * @param string $base_name The base name of the feed file. |
| 93 | */ |
| 94 | public function __construct( string $base_name ) { |
| 95 | $this->base_name = $base_name; |
| 96 | } |
| 97 | |
| 98 | /** |
| 99 | * {@inheritDoc} |
| 100 | * |
| 101 | * Simple one-shot entry point for non-resumable generation. This is a thin adapter over the |
| 102 | * resumable {@see open()}: it starts a fresh feed and discards the returned identifier. It exists |
| 103 | * to honor the base {@see FeedInterface} contract; chunked callers use {@see open()} directly. |
| 104 | * |
| 105 | * @return void |
| 106 | * @throws Exception If the feed directory or file cannot be created/opened. |
| 107 | */ |
| 108 | public function start(): void { |
| 109 | $this->open(); |
| 110 | } |
| 111 | |
| 112 | /** |
| 113 | * {@inheritDoc} |
| 114 | * |
| 115 | * A feed can be written across separate processes (and possibly servers), so it is created |
| 116 | * directly in the shared upload directory rather than a per-request temp directory. |
| 117 | * |
| 118 | * @param string|null $resume_identifier Identifier of an existing feed to resume, or null to start fresh. |
| 119 | * @param int $entries_written The number of entries already written by previous chunks. |
| 120 | * @return string The identifier of the feed that was started. |
| 121 | * @throws Exception If the feed directory or file cannot be created/opened, a resumed feed is missing, |
| 122 | * or the feed file is already locked by another generation process (FeedLockException). |
| 123 | */ |
| 124 | public function open( ?string $resume_identifier = null, int $entries_written = 0 ): string { |
| 125 | $upload_dir = $this->get_upload_dir(); |
| 126 | |
| 127 | $this->file_completed = false; |
| 128 | $this->file_url = null; |
| 129 | |
| 130 | if ( null !== $resume_identifier ) { |
| 131 | if ( ! $this->is_valid_feed_identifier( $resume_identifier ) ) { |
| 132 | throw new Exception( |
| 133 | esc_html( |
| 134 | sprintf( |
| 135 | /* translators: %s: feed identifier */ |
| 136 | __( 'Invalid feed file identifier: %s', 'woocommerce' ), |
| 137 | $resume_identifier |
| 138 | ) |
| 139 | ) |
| 140 | ); |
| 141 | } |
| 142 | |
| 143 | $this->file_name = $resume_identifier; |
| 144 | $this->file_path = $upload_dir['path'] . $resume_identifier; |
| 145 | |
| 146 | // The partial must still be there to append to. If it has vanished (e.g. cleaned up by the |
| 147 | // host), fail rather than write a corrupt feed; the caller restarts generation from scratch. |
| 148 | if ( ! is_file( $this->file_path ) ) { |
| 149 | throw new Exception( |
| 150 | esc_html( |
| 151 | sprintf( |
| 152 | /* translators: %s: file path */ |
| 153 | __( 'Cannot resume feed; file does not exist: %s', 'woocommerce' ), |
| 154 | $this->file_path |
| 155 | ) |
| 156 | ) |
| 157 | ); |
| 158 | } |
| 159 | |
| 160 | // Seed the entry count so add_entry()'s separator accounts for entries already written. |
| 161 | $this->entry_count = $entries_written; |
| 162 | $handle = $this->open_handle( $this->file_path, 'a' ); |
| 163 | $this->acquire_lock( $handle ); |
| 164 | |
| 165 | return $this->file_name; |
| 166 | } |
| 167 | |
| 168 | $this->entry_count = 0; |
| 169 | $this->file_name = $this->generate_file_name(); |
| 170 | $this->file_path = $upload_dir['path'] . $this->file_name; |
| 171 | |
| 172 | // Open with 'c' (create, do not truncate) rather than 'w' so the exclusive lock is acquired |
| 173 | // *before* any existing content is cleared. An overlapping process that fails to get the lock |
| 174 | // must not truncate a feed the lock holder is still writing; only once the lock is held is it |
| 175 | // safe to clear stale content and write the array from the top. |
| 176 | $handle = $this->open_handle( $this->file_path, 'c' ); |
| 177 | $this->acquire_lock( $handle ); |
| 178 | |
| 179 | if ( ! ftruncate( $handle, 0 ) || ! rewind( $handle ) ) { |
| 180 | fclose( $handle ); |
| 181 | $this->file_handle = null; |
| 182 | throw new Exception( |
| 183 | esc_html( |
| 184 | sprintf( |
| 185 | /* translators: %s: file path */ |
| 186 | __( 'Unable to reset feed file for writing: %s', 'woocommerce' ), |
| 187 | $this->file_path |
| 188 | ) |
| 189 | ) |
| 190 | ); |
| 191 | } |
| 192 | |
| 193 | fwrite( $handle, '[' ); |
| 194 | |
| 195 | return $this->file_name; |
| 196 | } |
| 197 | |
| 198 | /** |
| 199 | * Add an entry to the feed. |
| 200 | * |
| 201 | * @param array $entry The entry to add. |
| 202 | * @return void |
| 203 | */ |
| 204 | public function add_entry( array $entry ): void { |
| 205 | if ( ! is_resource( $this->file_handle ) ) { |
| 206 | return; |
| 207 | } |
| 208 | |
| 209 | $json = wp_json_encode( $entry ); |
| 210 | if ( false === $json ) { |
| 211 | return; |
| 212 | } |
| 213 | |
| 214 | if ( $this->entry_count > 0 ) { |
| 215 | fwrite( $this->file_handle, ',' ); |
| 216 | } |
| 217 | |
| 218 | fwrite( $this->file_handle, $json ); |
| 219 | ++$this->entry_count; |
| 220 | } |
| 221 | |
| 222 | /** |
| 223 | * {@inheritDoc} |
| 224 | */ |
| 225 | public function end(): void { |
| 226 | if ( ! is_resource( $this->file_handle ) ) { |
| 227 | return; |
| 228 | } |
| 229 | |
| 230 | fwrite( $this->file_handle, ']' ); |
| 231 | // Do not unlock explicitly before closing: fclose() flushes PHP's userspace stream buffer to the |
| 232 | // OS and only then releases the lock. Unlocking first would open a window in which another process |
| 233 | // could acquire the lock and start writing while this process's buffered bytes are still pending, |
| 234 | // interleaving output — the exact corruption the lock prevents. |
| 235 | fclose( $this->file_handle ); |
| 236 | $this->file_handle = null; |
| 237 | $this->file_completed = true; |
| 238 | } |
| 239 | |
| 240 | /** |
| 241 | * {@inheritDoc} |
| 242 | */ |
| 243 | public function flush(): void { |
| 244 | if ( is_resource( $this->file_handle ) ) { |
| 245 | // Rely on fclose() to release the lock: it flushes the userspace buffer first and only then |
| 246 | // unlocks, so the lock stays held until the buffered bytes are durable. An explicit LOCK_UN |
| 247 | // here would release it while pending bytes are still buffered (see end()). |
| 248 | fclose( $this->file_handle ); |
| 249 | $this->file_handle = null; |
| 250 | } |
| 251 | } |
| 252 | |
| 253 | /** |
| 254 | * {@inheritDoc} |
| 255 | * |
| 256 | * @param string $identifier The identifier returned by open(). |
| 257 | * @return void |
| 258 | */ |
| 259 | public function delete( string $identifier ): void { |
| 260 | // Never turn an identifier that is actually a path into a delete outside the feed directory. |
| 261 | if ( ! $this->is_valid_feed_identifier( $identifier ) ) { |
| 262 | return; |
| 263 | } |
| 264 | |
| 265 | $path = $this->feed_file_path( $identifier ); |
| 266 | if ( is_file( $path ) ) { |
| 267 | wp_delete_file( $path ); |
| 268 | } |
| 269 | } |
| 270 | |
| 271 | /** |
| 272 | * Checks that a feed identifier is a plain feed file name, not a path. |
| 273 | * |
| 274 | * Identifiers round-trip through the persisted status option and are accepted by the public |
| 275 | * {@see delete()}, so a corrupted or hostile value (e.g. containing `../`) must never be |
| 276 | * concatenated into a path that escapes the feed directory. |
| 277 | * |
| 278 | * @param string $identifier The feed file identifier to check. |
| 279 | * @return bool True if the identifier is a safe, plain `.json` file name. |
| 280 | */ |
| 281 | private function is_valid_feed_identifier( string $identifier ): bool { |
| 282 | return '' !== $identifier |
| 283 | && wp_basename( $identifier ) === $identifier |
| 284 | && 'json' === strtolower( (string) pathinfo( $identifier, PATHINFO_EXTENSION ) ); |
| 285 | } |
| 286 | |
| 287 | /** |
| 288 | * Resolves a feed file's path from its identifier without creating the upload directory. |
| 289 | * |
| 290 | * Unlike {@see get_upload_dir()} (used when writing), this must not create the directory as a side effect. |
| 291 | * Callers must validate the identifier with {@see is_valid_feed_identifier()} first. |
| 292 | * |
| 293 | * @param string $identifier The feed file name. |
| 294 | * @return string The absolute path to the feed file. |
| 295 | */ |
| 296 | private function feed_file_path( string $identifier ): string { |
| 297 | $upload_dir = wp_upload_dir( null, false ); |
| 298 | return $upload_dir['basedir'] . DIRECTORY_SEPARATOR . self::UPLOAD_DIR . DIRECTORY_SEPARATOR . $identifier; |
| 299 | } |
| 300 | |
| 301 | /** |
| 302 | * Opens the feed file handle, throwing if it cannot be opened. |
| 303 | * |
| 304 | * @param string $path The file path to open. |
| 305 | * @param string $mode The fopen() mode. |
| 306 | * @return resource The opened file handle. |
| 307 | * @throws Exception If the file cannot be opened. |
| 308 | */ |
| 309 | private function open_handle( string $path, string $mode ) { |
| 310 | $handle = fopen( $path, $mode ); |
| 311 | if ( false === $handle ) { |
| 312 | throw new Exception( |
| 313 | esc_html( |
| 314 | sprintf( |
| 315 | /* translators: %s: file path */ |
| 316 | __( 'Unable to open feed file: %s', 'woocommerce' ), |
| 317 | $path |
| 318 | ) |
| 319 | ) |
| 320 | ); |
| 321 | } |
| 322 | |
| 323 | $this->file_handle = $handle; |
| 324 | return $handle; |
| 325 | } |
| 326 | |
| 327 | /** |
| 328 | * Acquires an exclusive, non-blocking lock on the open feed file handle. |
| 329 | * |
| 330 | * A feed file is written across separate, short-lived processes (one Action Scheduler action per |
| 331 | * chunk). A stuck in-progress job can be treated as stuck and have a fresh generation enqueued |
| 332 | * while the original is still running, so two processes can end up writing the same file at once; |
| 333 | * without mutual exclusion their unbuffered writes interleave into malformed JSON. The lock makes |
| 334 | * each chunk's write to the shared file exclusive, so overlapping generations cannot interleave. |
| 335 | * |
| 336 | * The lock is advisory, which is sufficient because every writer goes through this class. It is |
| 337 | * released when the handle is closed in flush()/end(), including when a process is killed and the |
| 338 | * OS closes its descriptors — so a killed job leaves no stale lock, and its partial file is handled |
| 339 | * by the heartbeat-based stuck-job recovery instead. |
| 340 | * |
| 341 | * @param resource $handle The open feed file handle. |
| 342 | * @return void |
| 343 | * @throws FeedLockException If the lock is already held by another process. |
| 344 | */ |
| 345 | private function acquire_lock( $handle ): void { |
| 346 | if ( ! flock( $handle, LOCK_EX | LOCK_NB ) ) { |
| 347 | fclose( $handle ); |
| 348 | $this->file_handle = null; |
| 349 | throw new FeedLockException( |
| 350 | esc_html( |
| 351 | sprintf( |
| 352 | /* translators: %s: file path */ |
| 353 | __( 'Feed file is locked by another generation process: %s', 'woocommerce' ), |
| 354 | $this->file_path |
| 355 | ) |
| 356 | ) |
| 357 | ); |
| 358 | } |
| 359 | } |
| 360 | |
| 361 | /** |
| 362 | * Generate the feed file name based on the base name and the current time. |
| 363 | * |
| 364 | * @return string The feed file name. |
| 365 | */ |
| 366 | private function generate_file_name(): string { |
| 367 | /** |
| 368 | * Allows the current time to be overridden before a feed is stored. |
| 369 | * |
| 370 | * @param int $time The current time. |
| 371 | * @param FeedInterface $feed The feed instance. |
| 372 | * @return int The current time. |
| 373 | * @since 10.5.0 |
| 374 | */ |
| 375 | $current_time = apply_filters( 'woocommerce_product_feed_time', time(), $this ); |
| 376 | $hash_data = $this->base_name . gmdate( 'r', $current_time ); |
| 377 | |
| 378 | return sprintf( |
| 379 | '%s-%s-%s.json', |
| 380 | $this->base_name, |
| 381 | gmdate( 'Y-m-d', $current_time ), |
| 382 | wp_hash( $hash_data ) |
| 383 | ); |
| 384 | } |
| 385 | |
| 386 | /** |
| 387 | * {@inheritDoc} |
| 388 | */ |
| 389 | public function get_entry_count(): int { |
| 390 | return $this->entry_count; |
| 391 | } |
| 392 | |
| 393 | /** |
| 394 | * {@inheritDoc} |
| 395 | */ |
| 396 | public function get_file_path(): ?string { |
| 397 | if ( ! $this->file_completed ) { |
| 398 | return null; |
| 399 | } |
| 400 | |
| 401 | return $this->file_path; |
| 402 | } |
| 403 | |
| 404 | /** |
| 405 | * {@inheritDoc} |
| 406 | * |
| 407 | * @throws Exception If the upload directory cannot be created. |
| 408 | */ |
| 409 | public function get_file_url(): ?string { |
| 410 | if ( ! $this->file_completed ) { |
| 411 | return null; |
| 412 | } |
| 413 | |
| 414 | // Resolve the upload directory (also refreshes its .htaccess for file access) and build the URL. |
| 415 | $upload_dir = $this->get_upload_dir(); |
| 416 | $this->file_url = $upload_dir['url'] . $this->file_name; |
| 417 | |
| 418 | return $this->file_url; |
| 419 | } |
| 420 | |
| 421 | /** |
| 422 | * Get the upload directory for the feed. |
| 423 | * |
| 424 | * @return array { |
| 425 | * The upload directory for the feed. Both fields end with the right trailing slash. |
| 426 | * |
| 427 | * @type string $path The path to the upload directory. |
| 428 | * @type string $url The URL to the upload directory. |
| 429 | * } |
| 430 | * @throws Exception If the upload directory cannot be created. |
| 431 | */ |
| 432 | private function get_upload_dir(): array { |
| 433 | // Resolve once per feed instance. |
| 434 | if ( null !== $this->prepared_upload_dir ) { |
| 435 | return $this->prepared_upload_dir; |
| 436 | } |
| 437 | |
| 438 | $upload_dir = wp_upload_dir( null, true ); |
| 439 | $directory_path = $upload_dir['basedir'] . DIRECTORY_SEPARATOR . self::UPLOAD_DIR . DIRECTORY_SEPARATOR; |
| 440 | |
| 441 | // Create the directory if it does not exist, allowing file access so the generated feed |
| 442 | // files can be served by URL while directory listing stays disabled. If the directory |
| 443 | // already exists, refresh its .htaccess in place so installs created before file access |
| 444 | // was enabled also serve feeds correctly. |
| 445 | if ( ! is_dir( $directory_path ) ) { |
| 446 | FilesystemUtil::mkdir_p_not_indexable( $directory_path, true ); |
| 447 | } else { |
| 448 | $this->ensure_feed_dir_file_access( $directory_path ); |
| 449 | } |
| 450 | |
| 451 | // `mkdir_p_not_indexable()` returns `void`, we have to check again. |
| 452 | if ( ! is_dir( $directory_path ) ) { |
| 453 | throw new Exception( |
| 454 | esc_html( |
| 455 | sprintf( |
| 456 | /* translators: %s: directory path */ |
| 457 | __( 'Unable to create feed directory: %s', 'woocommerce' ), |
| 458 | $directory_path |
| 459 | ) |
| 460 | ) |
| 461 | ); |
| 462 | } |
| 463 | |
| 464 | $directory_url = $upload_dir['baseurl'] . '/' . self::UPLOAD_DIR . '/'; |
| 465 | |
| 466 | // Follow the format, returned by `wp_upload_dir()`. |
| 467 | $this->prepared_upload_dir = array( |
| 468 | 'path' => $directory_path, |
| 469 | 'url' => $directory_url, |
| 470 | ); |
| 471 | return $this->prepared_upload_dir; |
| 472 | } |
| 473 | |
| 474 | /** |
| 475 | * Upgrades a legacy `deny from all` .htaccess in an existing feed directory to allow file access. |
| 476 | * |
| 477 | * Installs created before file access was enabled have a `deny from all` .htaccess here, which |
| 478 | * blocks feed downloads. This upgrades only that known legacy directive, in place. Anything else |
| 479 | * — an already-correct directive, custom rules a site or host added, a file we cannot read, or a |
| 480 | * missing file — is left untouched. (The directory's initial .htaccess is written when the |
| 481 | * directory is first created, by `mkdir_p_not_indexable()`.) |
| 482 | * |
| 483 | * Native file functions are used here (like the feed writes elsewhere in this class) rather |
| 484 | * than WP_Filesystem: the directory is local, and routing through a possibly FTP/SSH-backed |
| 485 | * filesystem could fail to initialize and leave the old `deny from all` in place even though |
| 486 | * the feed file itself was written natively. A failure is ignored (and logged) so it can never |
| 487 | * interrupt feed generation. |
| 488 | * |
| 489 | * @param string $directory_path The feed directory path (trailing-slashed). |
| 490 | * @return void |
| 491 | */ |
| 492 | private function ensure_feed_dir_file_access( string $directory_path ): void { |
| 493 | $htaccess_path = $directory_path . '.htaccess'; |
| 494 | |
| 495 | // Only act on an existing file. A missing .htaccess does not block downloads, so there is |
| 496 | // nothing to fix — and we should not create a file the directory did not already have. |
| 497 | if ( ! is_file( $htaccess_path ) ) { |
| 498 | return; |
| 499 | } |
| 500 | |
| 501 | // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged |
| 502 | $current_content = @file_get_contents( $htaccess_path ); |
| 503 | |
| 504 | // Upgrade only the known legacy `deny from all` directive. Leave anything else — already |
| 505 | // correct, custom rules, or a file we cannot read — untouched, never clobbering content |
| 506 | // we did not write. |
| 507 | if ( false === $current_content || FilesystemUtil::HTACCESS_DENY_ALL !== trim( $current_content ) ) { |
| 508 | return; |
| 509 | } |
| 510 | |
| 511 | // Best effort: a failure must never interrupt feed generation, but log it — otherwise the |
| 512 | // feed would silently stay 403 behind the stale rule. |
| 513 | // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged |
| 514 | if ( false === @file_put_contents( $htaccess_path, FilesystemUtil::HTACCESS_ALLOW_FILE_ACCESS ) ) { |
| 515 | wc_get_logger()->warning( |
| 516 | 'Could not update the product feed .htaccess to allow file access; generated feeds may remain inaccessible.', |
| 517 | array( |
| 518 | 'source' => 'product-feed', |
| 519 | 'path' => $htaccess_path, |
| 520 | ) |
| 521 | ); |
| 522 | } |
| 523 | } |
| 524 | } |
| 525 |