← All changes | callback/wings/manage.php +255 -64 5.53 → 6.76 View file →

		@@ -1,14 +1,14 @@
1	1	<?php
2	2
3	3	if (!defined('ABSPATH')) exit;
4		-if (!class_exists('BVManageCallback')) :
5		-class BVManageCallback extends BVCallbackBase {
	4	+if (!class_exists('WPRManageCallback')) :
	5	+class WPRManageCallback extends WPRCallbackBase {
6	6	public $settings;
7	7	public $skin;
8	8	public $bvinfo;
9	9
10		- const MANAGE_WING_VERSION = 1.6;
	10	+ const MANAGE_WING_VERSION = 2.0;
11	11
12	12	public function __construct($callback_handler) {
13	13	$this->settings = $callback_handler->settings;
14	14	$this->bvinfo = new WPRInfo($this->settings);
		@@ -33,23 +33,30 @@
33	33	return true;
34	34	}
35	35	}
36	36
	37	+ /**
	38	+ * Load a file with require_once only if it exists, so missing files don't fatal the script.
	39	+ */
	40	+ function safe_require_once($path) {
	41	+ if ($path && file_exists($path)) {
	42	+ require_once $path;
	43	+ }
	44	+ }
	45	+
37	46	function include_files() {
38		- @include_once ABSPATH.'wp-admin/includes/file.php';
39		- @include_once ABSPATH.'wp-admin/includes/plugin.php';
40		- @include_once ABSPATH.'wp-admin/includes/theme.php';
41		- @include_once ABSPATH.'wp-admin/includes/misc.php';
42		- @include_once ABSPATH.'wp-admin/includes/template.php';
43		- @include_once ABSPATH.'wp-includes/pluggable.php';
44		- @include_once ABSPATH.'wp-admin/includes/class-wp-upgrader.php';
45		- @include_once ABSPATH.'wp-admin/includes/class-theme-upgrader.php';
46		- @include_once ABSPATH.'wp-admin/includes/class-plugin-upgrader.php';
47		- @include_once ABSPATH.'wp-admin/includes/user.php';
48		- @include_once ABSPATH.'wp-includes/registration.php';
49		- @include_once ABSPATH.'wp-admin/includes/upgrade.php';
50		- @include_once ABSPATH.'wp-admin/includes/update.php';
51		- @require_once ABSPATH.'wp-admin/includes/update-core.php';
	47	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/file.php');
	48	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/plugin.php');
	49	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/theme.php');
	50	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/misc.php');
	51	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/template.php');
	52	+ $this->safe_require_once(ABSPATH.'wp-includes/pluggable.php');
	53	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/class-wp-upgrader.php');
	54	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/class-theme-upgrader.php');
	55	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/class-plugin-upgrader.php');
	56	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/user.php');
	57	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/upgrade.php');
	58	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/update.php');
52	59	}
53	60
54	61	function edit($args) {
55	62	$result = array();
		@@ -242,9 +249,9 @@
242	249	if (!empty($valid_updates)) {
243	250	if (class_exists('Language_Pack_Upgrader')) {
244	251	if ($has_bv_skin) {
245	252	require_once( "bv_upgrader_skin.php" );
246		- $skin = new BVUpgraderSkin("upgrade_translations");
	253	+ $skin = new WPRUpgraderSkin("upgrade_translations");
247	254	$this->skin = $skin;
248	255	} else {
249	256	$skin = new Language_Pack_Upgrader_Skin(array());
250	257	}
		@@ -265,15 +272,54 @@
265	272	}
266	273
267	274	function upgradeCore($args) {
268	275	global $wp_filesystem, $wp_version;
269		- $core = $this->settings->getTransient('update_core');
270		- $core_update_index = intval($args['coreupdateindex']);
271		- if (isset($core->updates) && !empty($core->updates)) {
272		- $to_update = $core->updates[$core_update_index];
	276	+ $to_update = null;
	277	+
	278	+ // Prefer validated update data from server (BlogVault), then site transient.
	279	+ // This protects upgrades from poisoned/overridden transients.
	280	+ $validated = null;
	281	+ if (isset($args['core_validated_update']) && !empty($args['core_validated_update'])) {
	282	+ $validated = $args['core_validated_update'];
	283	+ }
	284	+
	285	+ if (!empty($validated) && is_array($validated) &&
	286	+ isset($validated['version']) && !empty($validated['version']) &&
	287	+ isset($validated['response']) && ($validated['response'] === 'upgrade')) {
	288	+ $to_update = new stdClass();
	289	+ $to_update->version = $validated['version'];
	290	+ $to_update->response = $validated['response'];
	291	+ $to_update->download = isset($validated['download']) ? $validated['download'] : '';
	292	+
	293	+ // Preserve all packages keys if provided; Core_Upgrader expects packages-like data.
	294	+ if (isset($validated['packages']) && is_array($validated['packages'])) {
	295	+ $to_update->packages = (object)$validated['packages'];
	296	+ } else {
	297	+ $to_update->packages = new stdClass();
	298	+ }
	299	+
	300	+ // WordPress uses either ->package or ->packages->full depending on path/version.
	301	+ if (isset($to_update->packages->full) && !empty($to_update->packages->full)) {
	302	+ $to_update->package = $to_update->packages->full;
	303	+ } else {
	304	+ $to_update->package = $to_update->download;
	305	+ $to_update->packages->full = $to_update->download;
	306	+ }
273	307	} else {
	308	+ // Fallback to transient-based approach
	309	+ $core = $this->settings->getTransient('update_core');
	310	+ $core_update_index = intval($args['coreupdateindex']);
	311	+ if (isset($core->updates) && !empty($core->updates)) {
	312	+ $to_update = $core->updates[$core_update_index];
	313	+ } else {
	314	+ return array('status' => "Error", "message" => "Updates not available");
	315	+ }
	316	+ }
	317	+
	318	+ if (!$to_update) {
274	319	return array('status' => "Error", "message" => "Updates not available");
275	320	}
	321	+
276	322	$resp = array("Core_Upgrader", class_exists('Core_Upgrader'));
277	323	if (version_compare($wp_version, '3.1.9', '>')) {
278	324	$core = new Core_Upgrader();
279	325	$result = $core->upgrade($to_update);
		@@ -282,18 +328,8 @@
282	328	} else {
283	329	return array('status' => 'Done');
284	330	}
285	331	} else {
286		- $resp = array("wp_update_core", function_exists('wp_update_core'));
287		- if (function_exists('wp_update_core')) {
288		- $result = wp_update_core($to_update);
289		- if (is_wp_error($result)) {
290		- return array('status' => "Error", "message" => $this->getError($result));
291		- } else {
292		- return array('status' => 'Done');
293		- }
294		- }
295		-
296	332	$resp = array("WP_Upgrader", class_exists('WP_Upgrader'));
297	333	if (class_exists('WP_Upgrader')) {
298	334	$upgrader = new WP_Upgrader();
299	335
		@@ -331,8 +367,9 @@
331	367	}
332	368
333	369	$wp_filesystem->chmod($wp_dir.'wp-admin/includes/update-core.php', FS_CHMOD_FILE);
334	370
	371	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/update-core.php');
335	372	$result = update_core($working_dir, $wp_dir);
336	373
337	374	if (is_wp_error($result)) {
338	375	return array('status' => "Error", "message" => $this->getError($result));
		@@ -342,9 +379,11 @@
342	379	}
343	380	}
344	381
345	382	function bv_plugin_bulk_upgrade($upgrader, $_plugins) {
	383	+ global $wp_version;
346	384	$plugins = array_keys($_plugins);
	385	+ $current = get_site_transient('update_plugins');
347	386	$args = array();
348	387	$defaults = array(
349	388	'clear_update_cache' => true,
350	389	);
		@@ -373,20 +412,60 @@
373	412	foreach($plugins as $plugin) {
374	413	$upgrader->update_current++;
375	414	$upgrader->skin->plugin_info = get_plugin_data(WP_PLUGIN_DIR . '/' . $plugin, false, true);
376	415	$upgrader->skin->plugin_active = is_plugin_active($plugin);
377		- $result = $upgrader->run(
378		- array(
379		- 'package' => $_plugins[$plugin],
380		- 'destination' => WP_PLUGIN_DIR,
381		- 'clear_destination' => true,
382		- 'clear_working' => true,
383		- 'is_multi' => true,
384		- 'hook_extra' => array(
385		- 'plugin' => $plugin,
386		- ),
387		- )
388		- );
	416	+ $plugin_upgrade_data = $_plugins[$plugin];
	417	+ if (isset($current->response[$plugin])) {
	418	+ if (isset($current->response[$plugin]->requires)) {
	419	+ $plugin_upgrade_data['requires'] = $current->response[$plugin]->requires;
	420	+ }
	421	+ if (isset($current->response[$plugin]->requires_php)) {
	422	+ $plugin_upgrade_data['requires_php'] = $current->response[$plugin]->requires_php;
	423	+ }
	424	+ }
	425	+ if ( isset( $plugin_upgrade_data['requires'] ) && function_exists('is_wp_version_compatible') && !is_wp_version_compatible( $plugin_upgrade_data['requires'] ) ) {
	426	+ $result = new WP_Error(
	427	+ 'incompatible_wp_required_version',
	428	+ sprintf(
	429	+ __( 'Your WordPress version is %1$s, however the new plugin version requires %2$s.' ),
	430	+ $wp_version,
	431	+ $plugin_upgrade_data['requires']
	432	+ )
	433	+ );
	434	+
	435	+ $upgrader->skin->before( $result );
	436	+ $upgrader->skin->error( $result );
	437	+ $upgrader->skin->after();
	438	+ } elseif ( isset( $plugin_upgrade_data['requires_php'] ) && function_exists('is_php_version_compatible') && !is_php_version_compatible( $plugin_upgrade_data['requires_php'] ) ) {
	439	+
	440	+ $result = new WP_Error(
	441	+ 'incompatible_php_required_version',
	442	+ sprintf(
	443	+ __( 'The PHP version on your server is %1$s, however the new plugin version requires %2$s.' ),
	444	+ PHP_VERSION,
	445	+ $plugin_upgrade_data['requires_php']
	446	+ )
	447	+ );
	448	+
	449	+ $upgrader->skin->before( $result );
	450	+ $upgrader->skin->error( $result );
	451	+ $upgrader->skin->after();
	452	+ } else {
	453	+ add_filter('upgrader_source_selection', array($upgrader, 'check_package'));
	454	+ $result = $upgrader->run(
	455	+ array(
	456	+ 'package' => $_plugins[$plugin]['package'],
	457	+ 'destination' => WP_PLUGIN_DIR,
	458	+ 'clear_destination' => true,
	459	+ 'clear_working' => true,
	460	+ 'is_multi' => true,
	461	+ 'hook_extra' => array(
	462	+ 'plugin' => $plugin,
	463	+ ),
	464	+ )
	465	+ );
	466	+ remove_filter('upgrader_source_selection', array($upgrader, 'check_package'));
	467	+ }
389	468	$results[$plugin] = $result;
390	469	if (false === $result) {
391	470	break;
392	471	}
		@@ -421,9 +500,18 @@
421	500	$result = array();
422	501	$_plugins = array();
423	502	$plugins_by_name = array();
424	503	foreach ($plugins as $plugin) {
425		- $_plugins[$plugin['file']] = $plugin['package'];
	504	+ $_plugins[$plugin['file']] = [
	505	+ 'package' => $plugin['package']
	506	+ ];
	507	+ if (isset($plugin['requires'])) {
	508	+ $_plugins[$plugin['file']]['requires'] = $plugin['requires'];
	509	+ }
	510	+
	511	+ if (isset($plugin['requires_php'])) {
	512	+ $_plugins[$plugin['file']]['requires_php'] = $plugin['requires_php'];
	513	+ }
426	514	$plugin_data = get_plugin_data(WP_PLUGIN_DIR . '/' . $plugin['file'], false, true);
427	515	$plugins_by_name[$plugin_data['Name']] = $plugin['file'];
428	516	}
429	517	if (empty(array_keys($_plugins))) {
		@@ -431,9 +519,9 @@
431	519	}
432	520	if (class_exists('Plugin_Upgrader')) {
433	521	if ($has_bv_skin) {
434	522	require_once( "bv_upgrader_skin.php" );
435		- $skin = new BVUpgraderSkin("plugin_upgrade", $plugins_by_name);
	523	+ $skin = new WPRUpgraderSkin("plugin_upgrade", $plugins_by_name);
436	524	$this->skin = $skin;
437	525	} else {
438	526	$skin = new Bulk_Plugin_Upgrader_Skin();
439	527	}
		@@ -443,8 +531,11 @@
443	531	$result = $this->bv_plugin_bulk_upgrade($upgrader, $_plugins);
444	532	} else {
445	533	$result = $upgrader->bulk_upgrade(array_keys($_plugins));
446	534	}
	535	+ if (!is_array($result)) {
	536	+ return array('status' => "Error", 'message' =>'result is not an array');
	537	+ }
447	538	foreach (array_keys($_plugins) as $file) {
448	539	if (!array_key_exists($file, $result)) {
449	540	$result[$file] = array('status' => "Error");
450	541	} else {
		@@ -460,9 +551,11 @@
460	551	return $result;
461	552	}
462	553
463	554	function bv_theme_bulk_upgrade($upgrader, $_themes) {
	555	+ global $wp_version;
464	556	$themes = array_keys($_themes);
	557	+ $current = get_site_transient('update_themes');
465	558	$args = array();
466	559	$defaults = array(
467	560	'clear_update_cache' => true,
468	561	);
		@@ -492,21 +585,59 @@
492	585	$upgrader->update_current = 0;
493	586	foreach ($themes as $theme) {
494	587	$upgrader->update_current++;
495	588	$upgrader->skin->theme_info = $upgrader->theme_info($theme);
496		- $result = $upgrader->run(
497		- array(
498		- 'package' => $_themes[$theme],
499		- 'destination' => get_theme_root($theme),
500		- 'clear_destination' => true,
501		- 'clear_working' => true,
502		- 'is_multi' => true,
503		- 'hook_extra' => array(
504		- 'theme' => $theme,
505		- ),
506		- )
507		- );
	589	+ $theme_upgrade_data = $_themes[$theme];
	590	+ if (isset($current->response[$theme])) {
	591	+ if (isset($current->response[$theme]['requires'])) {
	592	+ $theme_upgrade_data['requires'] = $current->response[$theme]['requires'];
	593	+ }
	594	+ if (isset($current->response[$theme]['requires_php'])) {
	595	+ $theme_upgrade_data['requires_php'] = $current->response[$theme]['requires_php'];
	596	+ }
	597	+ }
	598	+ if ( isset( $theme_upgrade_data['requires'] ) && function_exists('is_wp_version_compatible') && !is_wp_version_compatible( $theme_upgrade_data['requires'] ) ) {
	599	+ $result = new WP_Error(
	600	+ 'incompatible_wp_required_version',
	601	+ sprintf(
	602	+ __( 'Your WordPress version is %1$s, however the new theme version requires %2$s.' ),
	603	+ $wp_version,
	604	+ $theme_upgrade_data['requires']
	605	+ )
	606	+ );
508	607
	608	+ $upgrader->skin->before( $result );
	609	+ $upgrader->skin->error( $result );
	610	+ $upgrader->skin->after();
	611	+ } elseif ( isset( $theme_upgrade_data['requires_php'] ) && function_exists('is_php_version_compatible') && !is_php_version_compatible( $theme_upgrade_data['requires_php'] ) ) {
	612	+ $result = new WP_Error(
	613	+ 'incompatible_php_required_version',
	614	+ sprintf(
	615	+ __( 'The PHP version on your server is %1$s, however the new theme version requires %2$s.' ),
	616	+ PHP_VERSION,
	617	+ $theme_upgrade_data['requires_php']
	618	+ )
	619	+ );
	620	+
	621	+ $upgrader->skin->before( $result );
	622	+ $upgrader->skin->error( $result );
	623	+ $upgrader->skin->after();
	624	+ } else {
	625	+ add_filter('upgrader_source_selection', array($upgrader, 'check_package'));
	626	+ $result = $upgrader->run(
	627	+ array(
	628	+ 'package' => $_themes[$theme]['package'],
	629	+ 'destination' => get_theme_root($theme),
	630	+ 'clear_destination' => true,
	631	+ 'clear_working' => true,
	632	+ 'is_multi' => true,
	633	+ 'hook_extra' => array(
	634	+ 'theme' => $theme,
	635	+ ),
	636	+ )
	637	+ );
	638	+ remove_filter('upgrader_source_selection', array($upgrader, 'check_package'));
	639	+ }
509	640	$results[$theme] = $result;
510	641	if (false === $result) {
511	642	break;
512	643	}
		@@ -542,9 +673,17 @@
542	673	function upgradeThemes($themes, $has_bv_skin = false, $bv_bulk_upgrade = false) {
543	674	$result = array();
544	675	$_themes = array();
545	676	foreach ($themes as $theme) {
546		- $_themes[$theme['stylesheet']] = $theme['package'];
	677	+ $_themes[$theme['stylesheet']] = [
	678	+ 'package' => $theme['package']
	679	+ ];
	680	+ if (isset($theme['requires'])) {
	681	+ $_themes[$theme['stylesheet']]['requires'] = $theme['requires'];
	682	+ }
	683	+ if (isset($theme['requires_php'])) {
	684	+ $_themes[$theme['stylesheet']]['requires_php'] = $theme['requires_php'];
	685	+ }
547	686	}
548	687	if (empty(array_keys($_themes))) {
549	688	return $result;
550	689	}
		@@ -550,9 +689,9 @@
550	689	}
551	690	if (class_exists('Theme_Upgrader')) {
552	691	if ($has_bv_skin) {
553	692	require_once( "bv_upgrader_skin.php" );
554		- $skin = new BVUpgraderSkin("theme_upgrade");
	693	+ $skin = new WPRUpgraderSkin("theme_upgrade");
555	694	$this->skin = $skin;
556	695	} else {
557	696	$skin = new Bulk_Theme_Upgrader_Skin();
558	697	}
		@@ -561,8 +700,11 @@
561	700	$result = $this->bv_theme_bulk_upgrade($upgrader, $_themes);
562	701	} else {
563	702	$result = $upgrader->bulk_upgrade(array_keys($_themes));
564	703	}
	704	+ if (!is_array($result)) {
	705	+ return array('status' => "Error", 'message' =>'result is not an array');
	706	+ }
565	707	foreach (array_keys($_themes) as $stylesheet) {
566	708	if (!array_key_exists($stylesheet, $result)) {
567	709	$result[$stylesheet] = array('status' => "Error");
568	710	} else {
		@@ -614,9 +756,9 @@
614	756	return array('status' => "Error", 'message' => "Invalid package domain");
615	757	}
616	758	if ($has_bv_skin) {
617	759	require_once( "bv_upgrader_skin.php" );
618		- $skin = new BVUpgraderSkin("installer", array(), $params['package']);
	760	+ $skin = new WPRUpgraderSkin("installer", array(), $params['package']);
619	761	$this->skin = $skin;
620	762	} else {
621	763	$skin = new WP_Upgrader_Skin();
622	764	}
		@@ -630,10 +772,14 @@
630	772	$upgrader->init();
631	773	$destination = $params['dest'];
632	774	$clear_destination = isset($params['cleardest']) ? $params['cleardest'] : false;
633	775	$package_url = $params['package'];
	776	+ $is_parent_theme_install_disabled = isset($params['is_parent_theme_install_disabled']) ? $params['is_parent_theme_install_disabled'] : false;
634	777	$key = basename($package_url);
635	778	add_filter('upgrader_source_selection', array($upgrader, 'check_package'));
	779	+ if ("theme" === $type && false === $is_parent_theme_install_disabled) {
	780	+ add_filter('upgrader_post_install', array($upgrader, 'check_parent_theme_filter'), 10, 3);
	781	+ }
636	782	$res = $upgrader->run(
637	783	array(
638	784	'package' => $package_url,
639	785	'destination' => $destination,
		@@ -645,8 +791,11 @@
645	791	),
646	792	)
647	793	);
648	794	remove_filter('upgrader_source_selection', array($upgrader, 'check_package'));
	795	+ if ("theme" === $type && false === $is_parent_theme_install_disabled) {
	796	+ remove_filter('upgrader_post_install', array($upgrader, 'check_parent_theme_filter'), 10);
	797	+ }
649	798	if (is_wp_error($res)) {
650	799	$res = array('status' => "Error", 'message' => $this->getError($res));
651	800	} else {
652	801	$res = array( 'status' => "Done");
		@@ -661,9 +810,17 @@
661	810	function getPremiumUpgradesInfo() {
662	811	return apply_filters( 'mwp_premium_perform_update', array() );
663	812	}
664	813
665		- function autoLogin($username, $isHttps) {
	814	+ function autoLogin($username, $isHttps, $auto_login_token = null) {
	815	+ # Validate nonce if provided (other plugin compatibility: allow login if token missing)
	816	+ if ($auto_login_token !== null && $auto_login_token !== '') {
	817	+ $validation_result = $this->validateAutoLoginToken($auto_login_token);
	818	+ if ($validation_result !== true) {
	819	+ return $validation_result;
	820	+ }
	821	+ }
	822	+
666	823	$user = get_user_by('login', $username);
667	824	if ($user != FALSE) {
668	825	wp_set_current_user( $user->ID );
669	826	if ($isHttps) {
		@@ -678,8 +835,41 @@
678	835	exit;
679	836	}
680	837	}
681	838
	839	+ private function validateAutoLoginToken($auto_login_token) {
	840	+ # Get plugin name for transient key prefix
	841	+ $plugname = $this->bvinfo->plugname;
	842	+ if (empty($plugname)) {
	843	+ return array(
	844	+ 'status' => 'Error',
	845	+ 'message' => 'PLUGIN_NAME_NOT_FOUND',
	846	+ 'error_code' => 'PLUGIN_NAME_ERROR'
	847	+ );
	848	+ }
	849	+
	850	+ # Construct transient key: {plugname}_auto_login_tk_{token}
	851	+ $transient_key = $plugname . '_auto_login_tk_' . $auto_login_token;
	852	+
	853	+ # Check if token has already been used
	854	+ $used_token = $this->settings->getTransient($transient_key);
	855	+ if ($used_token !== false) {
	856	+ # Token already used - prevent replay attack
	857	+ return array(
	858	+ 'status' => 'Error',
	859	+ 'message' => 'AUTO_LOGIN_TOKEN_ALREADY_USED',
	860	+ 'error_code' => 'AUTO_LOGIN_TOKEN_ERROR'
	861	+ );
	862	+ }
	863	+
	864	+ # Store token as used for 24 hours to prevent reuse
	865	+ # WordPress will automatically clean up expired transients
	866	+ $this->settings->setTransient($transient_key, true, DAY_IN_SECONDS);
	867	+
	868	+ # Token is valid and has been marked as used
	869	+ return true;
	870	+ }
	871	+
682	872	public function refreshPluginUpdates() {
683	873	global $wp_current_filter;
684	874	$wp_current_filter[] = 'load-update-core.php';
685	875
		@@ -872,9 +1062,10 @@
872	1062	case "atolgn":
873	1063	$isHttps = false;
874	1064	if (array_key_exists('https', $params))
875	1065	$isHttps = true;
876		- $resp = array("autologin" => $this->autoLogin($params['username'], $isHttps));
	1066	+ $auto_login_token = array_key_exists('auto_login_token', $params) ? $params['auto_login_token'] : null;
	1067	+ $resp = array("autologin" => $this->autoLogin($params['username'], $isHttps, $auto_login_token));
877	1068	break;
878	1069	case "updatedb":
879	1070	$resp = array("status" => $this->upgrade_db());
880	1071	break;
		@@ -903,5 +1094,5 @@
903	1094	}
904	1095	return $resp;
905	1096	}
906	1097	}
907		-endif;
	1098	+endif;