|
| 1 | +<?php |
| 2 | + |
| 3 | +declare(strict_types=1); |
| 4 | + |
| 5 | +if (!defined('ABSPATH')) { |
| 6 | + exit; |
| 7 | +} |
| 8 | + |
| 9 | +/** |
| 10 | + * Self-hosted update mechanism (CDN distribution ONLY). |
| 11 | + * |
| 12 | + * This lets self-hosted installs receive updates from cdn.webdecoy.com when the |
| 13 | + * WEBDECOY_SELF_HOSTED constant is defined. It is deliberately kept in its own |
| 14 | + * file and instantiated only under that constant. |
| 15 | + * |
| 16 | + * IMPORTANT: WordPress.org-distributed copies MUST NOT include this file. |
| 17 | + * The .org plugin guidelines prohibit a plugin serving its own updates — .org |
| 18 | + * is the sole update source there. `build.sh --org` removes this file, and the |
| 19 | + * main plugin guards the require with file_exists(), so its absence cleanly |
| 20 | + * disables self-hosted updating. |
| 21 | + */ |
| 22 | +class WebDecoy_Updater |
| 23 | +{ |
| 24 | + public function __construct() |
| 25 | + { |
| 26 | + add_filter('pre_set_site_transient_update_plugins', [$this, 'check_for_updates']); |
| 27 | + add_filter('plugins_api', [$this, 'plugin_info'], 10, 3); |
| 28 | + // Verify the downloaded package's checksum before WordPress installs it. |
| 29 | + add_filter('upgrader_pre_download', [$this, 'verify_update_package'], 10, 3); |
| 30 | + } |
| 31 | + |
| 32 | + /** |
| 33 | + * Check for updates against the CDN update manifest. |
| 34 | + * |
| 35 | + * @param object $transient Update transient |
| 36 | + * @return object Modified transient |
| 37 | + */ |
| 38 | + public function check_for_updates($transient) |
| 39 | + { |
| 40 | + if (empty($transient->checked)) { |
| 41 | + return $transient; |
| 42 | + } |
| 43 | + |
| 44 | + $update_info = get_transient('webdecoy_update_info'); |
| 45 | + |
| 46 | + if ($update_info === false) { |
| 47 | + $response = wp_remote_get('https://cdn.webdecoy.com/wordpress/update-info.json', [ |
| 48 | + 'timeout' => 10, |
| 49 | + 'headers' => [ |
| 50 | + 'Accept' => 'application/json', |
| 51 | + ], |
| 52 | + ]); |
| 53 | + |
| 54 | + if (is_wp_error($response) || wp_remote_retrieve_response_code($response) !== 200) { |
| 55 | + return $transient; |
| 56 | + } |
| 57 | + |
| 58 | + $update_info = json_decode(wp_remote_retrieve_body($response), true); |
| 59 | + |
| 60 | + if (!$update_info || !isset($update_info['version'])) { |
| 61 | + return $transient; |
| 62 | + } |
| 63 | + |
| 64 | + set_transient('webdecoy_update_info', $update_info, 12 * HOUR_IN_SECONDS); |
| 65 | + } |
| 66 | + |
| 67 | + if (version_compare(WEBDECOY_VERSION, $update_info['version'], '<')) { |
| 68 | + // Host-pin the package URL: WordPress installs whatever is at |
| 69 | + // `package` with full privileges, so refuse any URL that is not an |
| 70 | + // HTTPS link on our own CDN (prevents a tampered manifest → RCE). |
| 71 | + $download_url = $update_info['download_url'] ?? ''; |
| 72 | + if (!$this->is_trusted_package_url($download_url)) { |
| 73 | + return $transient; |
| 74 | + } |
| 75 | + |
| 76 | + $transient->response[WEBDECOY_PLUGIN_BASENAME] = (object) [ |
| 77 | + 'slug' => 'webdecoy', |
| 78 | + 'plugin' => WEBDECOY_PLUGIN_BASENAME, |
| 79 | + 'new_version' => $update_info['version'], |
| 80 | + 'package' => $download_url, |
| 81 | + 'url' => $update_info['details_url'] ?? 'https://webdecoy.com/wordpress', |
| 82 | + 'icons' => $update_info['icons'] ?? [], |
| 83 | + 'banners' => $update_info['banners'] ?? [], |
| 84 | + 'tested' => $update_info['tested'] ?? '', |
| 85 | + 'requires_php' => $update_info['requires_php'] ?? '7.4', |
| 86 | + ]; |
| 87 | + } |
| 88 | + |
| 89 | + return $transient; |
| 90 | + } |
| 91 | + |
| 92 | + /** |
| 93 | + * Whether a package download URL is an HTTPS link on our own CDN host. |
| 94 | + */ |
| 95 | + private function is_trusted_package_url(string $url): bool |
| 96 | + { |
| 97 | + if ($url === '') { |
| 98 | + return false; |
| 99 | + } |
| 100 | + $parts = wp_parse_url($url); |
| 101 | + if (empty($parts['scheme']) || empty($parts['host'])) { |
| 102 | + return false; |
| 103 | + } |
| 104 | + return strtolower($parts['scheme']) === 'https' |
| 105 | + && strtolower($parts['host']) === 'cdn.webdecoy.com'; |
| 106 | + } |
| 107 | + |
| 108 | + /** |
| 109 | + * Verify the integrity of the self-hosted update package before installation. |
| 110 | + * |
| 111 | + * @param bool|WP_Error $reply Short-circuit value (false to continue). |
| 112 | + * @param string $package The package URL being downloaded. |
| 113 | + * @param object $upgrader The upgrader instance. |
| 114 | + * @return bool|string|\WP_Error |
| 115 | + */ |
| 116 | + public function verify_update_package($reply, $package, $upgrader) |
| 117 | + { |
| 118 | + if (!is_string($package) || !$this->is_trusted_package_url($package)) { |
| 119 | + return $reply; |
| 120 | + } |
| 121 | + |
| 122 | + $update_info = get_transient('webdecoy_update_info'); |
| 123 | + $expected = is_array($update_info) ? ($update_info['sha256'] ?? '') : ''; |
| 124 | + $expected = is_string($expected) ? strtolower(trim($expected)) : ''; |
| 125 | + |
| 126 | + if (!preg_match('/^[a-f0-9]{64}$/', $expected)) { |
| 127 | + return new \WP_Error( |
| 128 | + 'webdecoy_no_checksum', |
| 129 | + __('WebDecoy update aborted: no valid checksum was provided for the package.', 'webdecoy') |
| 130 | + ); |
| 131 | + } |
| 132 | + |
| 133 | + if (!function_exists('download_url')) { |
| 134 | + require_once ABSPATH . 'wp-admin/includes/file.php'; |
| 135 | + } |
| 136 | + |
| 137 | + $tmp_file = download_url($package); |
| 138 | + if (is_wp_error($tmp_file)) { |
| 139 | + return $tmp_file; |
| 140 | + } |
| 141 | + |
| 142 | + $actual = hash_file('sha256', $tmp_file); |
| 143 | + if (!hash_equals($expected, (string) $actual)) { |
| 144 | + wp_delete_file($tmp_file); |
| 145 | + return new \WP_Error( |
| 146 | + 'webdecoy_checksum_mismatch', |
| 147 | + __('WebDecoy update aborted: package checksum did not match the expected value.', 'webdecoy') |
| 148 | + ); |
| 149 | + } |
| 150 | + |
| 151 | + return $tmp_file; |
| 152 | + } |
| 153 | + |
| 154 | + /** |
| 155 | + * Plugin information for the update details popup. |
| 156 | + * |
| 157 | + * @param false|object|array $result |
| 158 | + * @param string $action |
| 159 | + * @param object $args |
| 160 | + * @return false|object |
| 161 | + */ |
| 162 | + public function plugin_info($result, $action, $args) |
| 163 | + { |
| 164 | + if ($action !== 'plugin_information' || !isset($args->slug) || $args->slug !== 'webdecoy') { |
| 165 | + return $result; |
| 166 | + } |
| 167 | + |
| 168 | + $response = wp_remote_get('https://cdn.webdecoy.com/wordpress/plugin-info.json', [ |
| 169 | + 'timeout' => 10, |
| 170 | + 'headers' => [ |
| 171 | + 'Accept' => 'application/json', |
| 172 | + ], |
| 173 | + ]); |
| 174 | + |
| 175 | + if (is_wp_error($response) || wp_remote_retrieve_response_code($response) !== 200) { |
| 176 | + return $result; |
| 177 | + } |
| 178 | + |
| 179 | + $info = json_decode(wp_remote_retrieve_body($response), true); |
| 180 | + |
| 181 | + if (!$info) { |
| 182 | + return $result; |
| 183 | + } |
| 184 | + |
| 185 | + return (object) [ |
| 186 | + 'name' => $info['name'] ?? 'WebDecoy Bot Detection', |
| 187 | + 'slug' => 'webdecoy', |
| 188 | + 'version' => $info['version'] ?? WEBDECOY_VERSION, |
| 189 | + 'author' => $info['author'] ?? '<a href="https://webdecoy.com">WebDecoy</a>', |
| 190 | + 'author_profile' => $info['author_profile'] ?? 'https://webdecoy.com', |
| 191 | + 'requires' => $info['requires'] ?? '5.6', |
| 192 | + 'tested' => $info['tested'] ?? '', |
| 193 | + 'requires_php' => $info['requires_php'] ?? '7.4', |
| 194 | + 'sections' => $info['sections'] ?? [ |
| 195 | + 'description' => 'Protect your WordPress site from bots, spam, and carding attacks.', |
| 196 | + 'changelog' => $info['changelog'] ?? '', |
| 197 | + ], |
| 198 | + 'download_link' => $info['download_url'] ?? '', |
| 199 | + 'banners' => $info['banners'] ?? [], |
| 200 | + 'icons' => $info['icons'] ?? [], |
| 201 | + ]; |
| 202 | + } |
| 203 | +} |
0 commit comments