← All changes | callback/wings/manage.php +255 -63 5.68 → 6.76 View file →

		@@ -1,14 +1,14 @@
1	1	<?php
2	2
3	3	if (!defined('ABSPATH')) exit;
4		-if (!class_exists('BVManageCallback')) :
5		-class BVManageCallback extends BVCallbackBase {
	4	+if (!class_exists('WPRManageCallback')) :
	5	+class WPRManageCallback extends WPRCallbackBase {
6	6	public $settings;
7	7	public $skin;
8	8	public $bvinfo;
9	9
10		- const MANAGE_WING_VERSION = 1.6;
	10	+ const MANAGE_WING_VERSION = 2.0;
11	11
12	12	public function __construct($callback_handler) {
13	13	$this->settings = $callback_handler->settings;
14	14	$this->bvinfo = new WPRInfo($this->settings);
		@@ -33,22 +33,30 @@
33	33	return true;
34	34	}
35	35	}
36	36
	37	+ /**
	38	+ * Load a file with require_once only if it exists, so missing files don't fatal the script.
	39	+ */
	40	+ function safe_require_once($path) {
	41	+ if ($path && file_exists($path)) {
	42	+ require_once $path;
	43	+ }
	44	+ }
	45	+
37	46	function include_files() {
38		- @include_once ABSPATH.'wp-admin/includes/file.php';
39		- @include_once ABSPATH.'wp-admin/includes/plugin.php';
40		- @include_once ABSPATH.'wp-admin/includes/theme.php';
41		- @include_once ABSPATH.'wp-admin/includes/misc.php';
42		- @include_once ABSPATH.'wp-admin/includes/template.php';
43		- @include_once ABSPATH.'wp-includes/pluggable.php';
44		- @include_once ABSPATH.'wp-admin/includes/class-wp-upgrader.php';
45		- @include_once ABSPATH.'wp-admin/includes/class-theme-upgrader.php';
46		- @include_once ABSPATH.'wp-admin/includes/class-plugin-upgrader.php';
47		- @include_once ABSPATH.'wp-admin/includes/user.php';
48		- @include_once ABSPATH.'wp-admin/includes/upgrade.php';
49		- @include_once ABSPATH.'wp-admin/includes/update.php';
50		- @require_once ABSPATH.'wp-admin/includes/update-core.php';
	47	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/file.php');
	48	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/plugin.php');
	49	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/theme.php');
	50	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/misc.php');
	51	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/template.php');
	52	+ $this->safe_require_once(ABSPATH.'wp-includes/pluggable.php');
	53	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/class-wp-upgrader.php');
	54	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/class-theme-upgrader.php');
	55	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/class-plugin-upgrader.php');
	56	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/user.php');
	57	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/upgrade.php');
	58	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/update.php');
51	59	}
52	60
53	61	function edit($args) {
54	62	$result = array();
		@@ -241,9 +249,9 @@
241	249	if (!empty($valid_updates)) {
242	250	if (class_exists('Language_Pack_Upgrader')) {
243	251	if ($has_bv_skin) {
244	252	require_once( "bv_upgrader_skin.php" );
245		- $skin = new BVUpgraderSkin("upgrade_translations");
	253	+ $skin = new WPRUpgraderSkin("upgrade_translations");
246	254	$this->skin = $skin;
247	255	} else {
248	256	$skin = new Language_Pack_Upgrader_Skin(array());
249	257	}
		@@ -264,15 +272,54 @@
264	272	}
265	273
266	274	function upgradeCore($args) {
267	275	global $wp_filesystem, $wp_version;
268		- $core = $this->settings->getTransient('update_core');
269		- $core_update_index = intval($args['coreupdateindex']);
270		- if (isset($core->updates) && !empty($core->updates)) {
271		- $to_update = $core->updates[$core_update_index];
	276	+ $to_update = null;
	277	+
	278	+ // Prefer validated update data from server (BlogVault), then site transient.
	279	+ // This protects upgrades from poisoned/overridden transients.
	280	+ $validated = null;
	281	+ if (isset($args['core_validated_update']) && !empty($args['core_validated_update'])) {
	282	+ $validated = $args['core_validated_update'];
	283	+ }
	284	+
	285	+ if (!empty($validated) && is_array($validated) &&
	286	+ isset($validated['version']) && !empty($validated['version']) &&
	287	+ isset($validated['response']) && ($validated['response'] === 'upgrade')) {
	288	+ $to_update = new stdClass();
	289	+ $to_update->version = $validated['version'];
	290	+ $to_update->response = $validated['response'];
	291	+ $to_update->download = isset($validated['download']) ? $validated['download'] : '';
	292	+
	293	+ // Preserve all packages keys if provided; Core_Upgrader expects packages-like data.
	294	+ if (isset($validated['packages']) && is_array($validated['packages'])) {
	295	+ $to_update->packages = (object)$validated['packages'];
	296	+ } else {
	297	+ $to_update->packages = new stdClass();
	298	+ }
	299	+
	300	+ // WordPress uses either ->package or ->packages->full depending on path/version.
	301	+ if (isset($to_update->packages->full) && !empty($to_update->packages->full)) {
	302	+ $to_update->package = $to_update->packages->full;
	303	+ } else {
	304	+ $to_update->package = $to_update->download;
	305	+ $to_update->packages->full = $to_update->download;
	306	+ }
272	307	} else {
	308	+ // Fallback to transient-based approach
	309	+ $core = $this->settings->getTransient('update_core');
	310	+ $core_update_index = intval($args['coreupdateindex']);
	311	+ if (isset($core->updates) && !empty($core->updates)) {
	312	+ $to_update = $core->updates[$core_update_index];
	313	+ } else {
	314	+ return array('status' => "Error", "message" => "Updates not available");
	315	+ }
	316	+ }
	317	+
	318	+ if (!$to_update) {
273	319	return array('status' => "Error", "message" => "Updates not available");
274	320	}
	321	+
275	322	$resp = array("Core_Upgrader", class_exists('Core_Upgrader'));
276	323	if (version_compare($wp_version, '3.1.9', '>')) {
277	324	$core = new Core_Upgrader();
278	325	$result = $core->upgrade($to_update);
		@@ -281,18 +328,8 @@
281	328	} else {
282	329	return array('status' => 'Done');
283	330	}
284	331	} else {
285		- $resp = array("wp_update_core", function_exists('wp_update_core'));
286		- if (function_exists('wp_update_core')) {
287		- $result = wp_update_core($to_update);
288		- if (is_wp_error($result)) {
289		- return array('status' => "Error", "message" => $this->getError($result));
290		- } else {
291		- return array('status' => 'Done');
292		- }
293		- }
294		-
295	332	$resp = array("WP_Upgrader", class_exists('WP_Upgrader'));
296	333	if (class_exists('WP_Upgrader')) {
297	334	$upgrader = new WP_Upgrader();
298	335
		@@ -330,8 +367,9 @@
330	367	}
331	368
332	369	$wp_filesystem->chmod($wp_dir.'wp-admin/includes/update-core.php', FS_CHMOD_FILE);
333	370
	371	+ $this->safe_require_once(ABSPATH.'wp-admin/includes/update-core.php');
334	372	$result = update_core($working_dir, $wp_dir);
335	373
336	374	if (is_wp_error($result)) {
337	375	return array('status' => "Error", "message" => $this->getError($result));
		@@ -341,9 +379,11 @@
341	379	}
342	380	}
343	381
344	382	function bv_plugin_bulk_upgrade($upgrader, $_plugins) {
	383	+ global $wp_version;
345	384	$plugins = array_keys($_plugins);
	385	+ $current = get_site_transient('update_plugins');
346	386	$args = array();
347	387	$defaults = array(
348	388	'clear_update_cache' => true,
349	389	);
		@@ -372,20 +412,60 @@
372	412	foreach($plugins as $plugin) {
373	413	$upgrader->update_current++;
374	414	$upgrader->skin->plugin_info = get_plugin_data(WP_PLUGIN_DIR . '/' . $plugin, false, true);
375	415	$upgrader->skin->plugin_active = is_plugin_active($plugin);
376		- $result = $upgrader->run(
377		- array(
378		- 'package' => $_plugins[$plugin],
379		- 'destination' => WP_PLUGIN_DIR,
380		- 'clear_destination' => true,
381		- 'clear_working' => true,
382		- 'is_multi' => true,
383		- 'hook_extra' => array(
384		- 'plugin' => $plugin,
385		- ),
386		- )
387		- );
	416	+ $plugin_upgrade_data = $_plugins[$plugin];
	417	+ if (isset($current->response[$plugin])) {
	418	+ if (isset($current->response[$plugin]->requires)) {
	419	+ $plugin_upgrade_data['requires'] = $current->response[$plugin]->requires;
	420	+ }
	421	+ if (isset($current->response[$plugin]->requires_php)) {
	422	+ $plugin_upgrade_data['requires_php'] = $current->response[$plugin]->requires_php;
	423	+ }
	424	+ }
	425	+ if ( isset( $plugin_upgrade_data['requires'] ) && function_exists('is_wp_version_compatible') && !is_wp_version_compatible( $plugin_upgrade_data['requires'] ) ) {
	426	+ $result = new WP_Error(
	427	+ 'incompatible_wp_required_version',
	428	+ sprintf(
	429	+ __( 'Your WordPress version is %1$s, however the new plugin version requires %2$s.' ),
	430	+ $wp_version,
	431	+ $plugin_upgrade_data['requires']
	432	+ )
	433	+ );
	434	+
	435	+ $upgrader->skin->before( $result );
	436	+ $upgrader->skin->error( $result );
	437	+ $upgrader->skin->after();
	438	+ } elseif ( isset( $plugin_upgrade_data['requires_php'] ) && function_exists('is_php_version_compatible') && !is_php_version_compatible( $plugin_upgrade_data['requires_php'] ) ) {
	439	+
	440	+ $result = new WP_Error(
	441	+ 'incompatible_php_required_version',
	442	+ sprintf(
	443	+ __( 'The PHP version on your server is %1$s, however the new plugin version requires %2$s.' ),
	444	+ PHP_VERSION,
	445	+ $plugin_upgrade_data['requires_php']
	446	+ )
	447	+ );
	448	+
	449	+ $upgrader->skin->before( $result );
	450	+ $upgrader->skin->error( $result );
	451	+ $upgrader->skin->after();
	452	+ } else {
	453	+ add_filter('upgrader_source_selection', array($upgrader, 'check_package'));
	454	+ $result = $upgrader->run(
	455	+ array(
	456	+ 'package' => $_plugins[$plugin]['package'],
	457	+ 'destination' => WP_PLUGIN_DIR,
	458	+ 'clear_destination' => true,
	459	+ 'clear_working' => true,
	460	+ 'is_multi' => true,
	461	+ 'hook_extra' => array(
	462	+ 'plugin' => $plugin,
	463	+ ),
	464	+ )
	465	+ );
	466	+ remove_filter('upgrader_source_selection', array($upgrader, 'check_package'));
	467	+ }
388	468	$results[$plugin] = $result;
389	469	if (false === $result) {
390	470	break;
391	471	}
		@@ -420,9 +500,18 @@
420	500	$result = array();
421	501	$_plugins = array();
422	502	$plugins_by_name = array();
423	503	foreach ($plugins as $plugin) {
424		- $_plugins[$plugin['file']] = $plugin['package'];
	504	+ $_plugins[$plugin['file']] = [
	505	+ 'package' => $plugin['package']
	506	+ ];
	507	+ if (isset($plugin['requires'])) {
	508	+ $_plugins[$plugin['file']]['requires'] = $plugin['requires'];
	509	+ }
	510	+
	511	+ if (isset($plugin['requires_php'])) {
	512	+ $_plugins[$plugin['file']]['requires_php'] = $plugin['requires_php'];
	513	+ }
425	514	$plugin_data = get_plugin_data(WP_PLUGIN_DIR . '/' . $plugin['file'], false, true);
426	515	$plugins_by_name[$plugin_data['Name']] = $plugin['file'];
427	516	}
428	517	if (empty(array_keys($_plugins))) {
		@@ -430,9 +519,9 @@
430	519	}
431	520	if (class_exists('Plugin_Upgrader')) {
432	521	if ($has_bv_skin) {
433	522	require_once( "bv_upgrader_skin.php" );
434		- $skin = new BVUpgraderSkin("plugin_upgrade", $plugins_by_name);
	523	+ $skin = new WPRUpgraderSkin("plugin_upgrade", $plugins_by_name);
435	524	$this->skin = $skin;
436	525	} else {
437	526	$skin = new Bulk_Plugin_Upgrader_Skin();
438	527	}
		@@ -442,8 +531,11 @@
442	531	$result = $this->bv_plugin_bulk_upgrade($upgrader, $_plugins);
443	532	} else {
444	533	$result = $upgrader->bulk_upgrade(array_keys($_plugins));
445	534	}
	535	+ if (!is_array($result)) {
	536	+ return array('status' => "Error", 'message' =>'result is not an array');
	537	+ }
446	538	foreach (array_keys($_plugins) as $file) {
447	539	if (!array_key_exists($file, $result)) {
448	540	$result[$file] = array('status' => "Error");
449	541	} else {
		@@ -459,9 +551,11 @@
459	551	return $result;
460	552	}
461	553
462	554	function bv_theme_bulk_upgrade($upgrader, $_themes) {
	555	+ global $wp_version;
463	556	$themes = array_keys($_themes);
	557	+ $current = get_site_transient('update_themes');
464	558	$args = array();
465	559	$defaults = array(
466	560	'clear_update_cache' => true,
467	561	);
		@@ -491,21 +585,59 @@
491	585	$upgrader->update_current = 0;
492	586	foreach ($themes as $theme) {
493	587	$upgrader->update_current++;
494	588	$upgrader->skin->theme_info = $upgrader->theme_info($theme);
495		- $result = $upgrader->run(
496		- array(
497		- 'package' => $_themes[$theme],
498		- 'destination' => get_theme_root($theme),
499		- 'clear_destination' => true,
500		- 'clear_working' => true,
501		- 'is_multi' => true,
502		- 'hook_extra' => array(
503		- 'theme' => $theme,
504		- ),
505		- )
506		- );
	589	+ $theme_upgrade_data = $_themes[$theme];
	590	+ if (isset($current->response[$theme])) {
	591	+ if (isset($current->response[$theme]['requires'])) {
	592	+ $theme_upgrade_data['requires'] = $current->response[$theme]['requires'];
	593	+ }
	594	+ if (isset($current->response[$theme]['requires_php'])) {
	595	+ $theme_upgrade_data['requires_php'] = $current->response[$theme]['requires_php'];
	596	+ }
	597	+ }
	598	+ if ( isset( $theme_upgrade_data['requires'] ) && function_exists('is_wp_version_compatible') && !is_wp_version_compatible( $theme_upgrade_data['requires'] ) ) {
	599	+ $result = new WP_Error(
	600	+ 'incompatible_wp_required_version',
	601	+ sprintf(
	602	+ __( 'Your WordPress version is %1$s, however the new theme version requires %2$s.' ),
	603	+ $wp_version,
	604	+ $theme_upgrade_data['requires']
	605	+ )
	606	+ );
507	607
	608	+ $upgrader->skin->before( $result );
	609	+ $upgrader->skin->error( $result );
	610	+ $upgrader->skin->after();
	611	+ } elseif ( isset( $theme_upgrade_data['requires_php'] ) && function_exists('is_php_version_compatible') && !is_php_version_compatible( $theme_upgrade_data['requires_php'] ) ) {
	612	+ $result = new WP_Error(
	613	+ 'incompatible_php_required_version',
	614	+ sprintf(
	615	+ __( 'The PHP version on your server is %1$s, however the new theme version requires %2$s.' ),
	616	+ PHP_VERSION,
	617	+ $theme_upgrade_data['requires_php']
	618	+ )
	619	+ );
	620	+
	621	+ $upgrader->skin->before( $result );
	622	+ $upgrader->skin->error( $result );
	623	+ $upgrader->skin->after();
	624	+ } else {
	625	+ add_filter('upgrader_source_selection', array($upgrader, 'check_package'));
	626	+ $result = $upgrader->run(
	627	+ array(
	628	+ 'package' => $_themes[$theme]['package'],
	629	+ 'destination' => get_theme_root($theme),
	630	+ 'clear_destination' => true,
	631	+ 'clear_working' => true,
	632	+ 'is_multi' => true,
	633	+ 'hook_extra' => array(
	634	+ 'theme' => $theme,
	635	+ ),
	636	+ )
	637	+ );
	638	+ remove_filter('upgrader_source_selection', array($upgrader, 'check_package'));
	639	+ }
508	640	$results[$theme] = $result;
509	641	if (false === $result) {
510	642	break;
511	643	}
		@@ -541,9 +673,17 @@
541	673	function upgradeThemes($themes, $has_bv_skin = false, $bv_bulk_upgrade = false) {
542	674	$result = array();
543	675	$_themes = array();
544	676	foreach ($themes as $theme) {
545		- $_themes[$theme['stylesheet']] = $theme['package'];
	677	+ $_themes[$theme['stylesheet']] = [
	678	+ 'package' => $theme['package']
	679	+ ];
	680	+ if (isset($theme['requires'])) {
	681	+ $_themes[$theme['stylesheet']]['requires'] = $theme['requires'];
	682	+ }
	683	+ if (isset($theme['requires_php'])) {
	684	+ $_themes[$theme['stylesheet']]['requires_php'] = $theme['requires_php'];
	685	+ }
546	686	}
547	687	if (empty(array_keys($_themes))) {
548	688	return $result;
549	689	}
		@@ -549,9 +689,9 @@
549	689	}
550	690	if (class_exists('Theme_Upgrader')) {
551	691	if ($has_bv_skin) {
552	692	require_once( "bv_upgrader_skin.php" );
553		- $skin = new BVUpgraderSkin("theme_upgrade");
	693	+ $skin = new WPRUpgraderSkin("theme_upgrade");
554	694	$this->skin = $skin;
555	695	} else {
556	696	$skin = new Bulk_Theme_Upgrader_Skin();
557	697	}
		@@ -560,8 +700,11 @@
560	700	$result = $this->bv_theme_bulk_upgrade($upgrader, $_themes);
561	701	} else {
562	702	$result = $upgrader->bulk_upgrade(array_keys($_themes));
563	703	}
	704	+ if (!is_array($result)) {
	705	+ return array('status' => "Error", 'message' =>'result is not an array');
	706	+ }
564	707	foreach (array_keys($_themes) as $stylesheet) {
565	708	if (!array_key_exists($stylesheet, $result)) {
566	709	$result[$stylesheet] = array('status' => "Error");
567	710	} else {
		@@ -613,9 +756,9 @@
613	756	return array('status' => "Error", 'message' => "Invalid package domain");
614	757	}
615	758	if ($has_bv_skin) {
616	759	require_once( "bv_upgrader_skin.php" );
617		- $skin = new BVUpgraderSkin("installer", array(), $params['package']);
	760	+ $skin = new WPRUpgraderSkin("installer", array(), $params['package']);
618	761	$this->skin = $skin;
619	762	} else {
620	763	$skin = new WP_Upgrader_Skin();
621	764	}
		@@ -629,10 +772,14 @@
629	772	$upgrader->init();
630	773	$destination = $params['dest'];
631	774	$clear_destination = isset($params['cleardest']) ? $params['cleardest'] : false;
632	775	$package_url = $params['package'];
	776	+ $is_parent_theme_install_disabled = isset($params['is_parent_theme_install_disabled']) ? $params['is_parent_theme_install_disabled'] : false;
633	777	$key = basename($package_url);
634	778	add_filter('upgrader_source_selection', array($upgrader, 'check_package'));
	779	+ if ("theme" === $type && false === $is_parent_theme_install_disabled) {
	780	+ add_filter('upgrader_post_install', array($upgrader, 'check_parent_theme_filter'), 10, 3);
	781	+ }
635	782	$res = $upgrader->run(
636	783	array(
637	784	'package' => $package_url,
638	785	'destination' => $destination,
		@@ -644,8 +791,11 @@
644	791	),
645	792	)
646	793	);
647	794	remove_filter('upgrader_source_selection', array($upgrader, 'check_package'));
	795	+ if ("theme" === $type && false === $is_parent_theme_install_disabled) {
	796	+ remove_filter('upgrader_post_install', array($upgrader, 'check_parent_theme_filter'), 10);
	797	+ }
648	798	if (is_wp_error($res)) {
649	799	$res = array('status' => "Error", 'message' => $this->getError($res));
650	800	} else {
651	801	$res = array( 'status' => "Done");
		@@ -660,9 +810,17 @@
660	810	function getPremiumUpgradesInfo() {
661	811	return apply_filters( 'mwp_premium_perform_update', array() );
662	812	}
663	813
664		- function autoLogin($username, $isHttps) {
	814	+ function autoLogin($username, $isHttps, $auto_login_token = null) {
	815	+ # Validate nonce if provided (other plugin compatibility: allow login if token missing)
	816	+ if ($auto_login_token !== null && $auto_login_token !== '') {
	817	+ $validation_result = $this->validateAutoLoginToken($auto_login_token);
	818	+ if ($validation_result !== true) {
	819	+ return $validation_result;
	820	+ }
	821	+ }
	822	+
665	823	$user = get_user_by('login', $username);
666	824	if ($user != FALSE) {
667	825	wp_set_current_user( $user->ID );
668	826	if ($isHttps) {
		@@ -677,8 +835,41 @@
677	835	exit;
678	836	}
679	837	}
680	838
	839	+ private function validateAutoLoginToken($auto_login_token) {
	840	+ # Get plugin name for transient key prefix
	841	+ $plugname = $this->bvinfo->plugname;
	842	+ if (empty($plugname)) {
	843	+ return array(
	844	+ 'status' => 'Error',
	845	+ 'message' => 'PLUGIN_NAME_NOT_FOUND',
	846	+ 'error_code' => 'PLUGIN_NAME_ERROR'
	847	+ );
	848	+ }
	849	+
	850	+ # Construct transient key: {plugname}_auto_login_tk_{token}
	851	+ $transient_key = $plugname . '_auto_login_tk_' . $auto_login_token;
	852	+
	853	+ # Check if token has already been used
	854	+ $used_token = $this->settings->getTransient($transient_key);
	855	+ if ($used_token !== false) {
	856	+ # Token already used - prevent replay attack
	857	+ return array(
	858	+ 'status' => 'Error',
	859	+ 'message' => 'AUTO_LOGIN_TOKEN_ALREADY_USED',
	860	+ 'error_code' => 'AUTO_LOGIN_TOKEN_ERROR'
	861	+ );
	862	+ }
	863	+
	864	+ # Store token as used for 24 hours to prevent reuse
	865	+ # WordPress will automatically clean up expired transients
	866	+ $this->settings->setTransient($transient_key, true, DAY_IN_SECONDS);
	867	+
	868	+ # Token is valid and has been marked as used
	869	+ return true;
	870	+ }
	871	+
681	872	public function refreshPluginUpdates() {
682	873	global $wp_current_filter;
683	874	$wp_current_filter[] = 'load-update-core.php';
684	875
		@@ -871,9 +1062,10 @@
871	1062	case "atolgn":
872	1063	$isHttps = false;
873	1064	if (array_key_exists('https', $params))
874	1065	$isHttps = true;
875		- $resp = array("autologin" => $this->autoLogin($params['username'], $isHttps));
	1066	+ $auto_login_token = array_key_exists('auto_login_token', $params) ? $params['auto_login_token'] : null;
	1067	+ $resp = array("autologin" => $this->autoLogin($params['username'], $isHttps, $auto_login_token));
876	1068	break;
877	1069	case "updatedb":
878	1070	$resp = array("status" => $this->upgrade_db());
879	1071	break;
		@@ -902,5 +1094,5 @@
902	1094	}
903	1095	return $resp;
904	1096	}
905	1097	}
906		-endif;
	1098	+endif;