Weboria/argus-wp-defence
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 118 Wiki Activity
Files
main
argus-wp-defence/includes/class-argus-update-client.php
T
ARGUSandClaude Sonnet 5 8a6c9ca4de ARGUS WordPress Defence 7.23.1 -- real, working automatic updates 
Fixes a real bug: a normal (non-critical) update was previously
detected and shown as available, but nothing ever actually installed
it -- there was no button, cron path, or any other code that did.
Automatic updates only ever worked for updates flagged critical, which
isn't what "automatic" means. Now any newer, compatible,
signature-verified update installs on its own.

This is also the first release where the self-update mechanism itself
ships in this self-distributed channel -- it was unconditionally
excluded from every previous build (a WordPress.org-only restriction
that doesn't apply here, since this channel isn't WordPress.org).

manifest.json in this repo is the real, live update manifest: signed
with Ed25519 (public key documented in README.md's Updating section),
pointing at this exact release's ZIP and its real SHA-256. Verified
end-to-end before publishing -- not just "the code looks right": ran a
full real update cycle (an older installed version checking this
manifest, downloading this exact package, verifying its signature and
hash, replacing itself, and the site continuing to work with zero
errors afterward) using the actual signing key and the actual
package this commit ships.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-09 19:19:40 +00:00

276 lines
11 KiB
PHP
Raw Permalink Blame History

<?php
if ( ! defined( 'ABSPATH' ) ) {
exit;
}
class Argus_Update_Client {
const CHECK_INTERVAL_SECS = 6 * HOUR_IN_SECONDS;
const LOCK_TRANSIENT = 'argus_wpd_update_check_lock';
const LAST_CHECK_OPTION = 'argus_wpd_update_last_check';
const MANIFEST_ETAG_OPTION = 'argus_wpd_update_manifest_etag';
const PENDING_MANIFEST_OPTION = 'argus_wpd_update_pending_manifest';
const LAST_SUCCESS_OPTION = 'argus_wpd_update_last_success';
const LAST_FAILURE_OPTION = 'argus_wpd_update_last_failure';
public static function manifest_url() {
return defined( 'ARGUS_WPD_UPDATE_MANIFEST_URL' ) ? ARGUS_WPD_UPDATE_MANIFEST_URL : '';
}
public static function public_key() {
return defined( 'ARGUS_WPD_UPDATE_PUBLIC_KEY' ) ? ARGUS_WPD_UPDATE_PUBLIC_KEY : '';
}
public static function is_configured() {
return '' !== self::manifest_url() && '' !== self::public_key();
}
public static function maybe_check() {
if ( ! self::is_configured() ) {
return;
}
$last_check = (int) get_option( self::LAST_CHECK_OPTION, 0 );
if ( ( $last_check + self::CHECK_INTERVAL_SECS ) > time() ) {
return;
}
if ( false !== get_transient( self::LOCK_TRANSIENT ) ) {
return;
}
set_transient( self::LOCK_TRANSIENT, 1, 4 * MINUTE_IN_SECONDS );
self::check_now();
delete_transient( self::LOCK_TRANSIENT );
}
public static function check_now() {
if ( ! self::is_configured() ) {
return array( 'success' => false, 'message' => __( 'No update source is configured.', 'argus-wordpress-defence' ), 'update_available' => false );
}
update_option( self::LAST_CHECK_OPTION, time(), false );
$args = array( 'timeout' => 15 );
$etag = get_option( self::MANIFEST_ETAG_OPTION, '' );
if ( $etag ) {
$args['headers'] = array( 'If-None-Match' => $etag );
}
$response = wp_remote_get( self::manifest_url(), $args );
if ( is_wp_error( $response ) ) {
return self::record_failure( __( 'Could not reach the update server.', 'argus-wordpress-defence' ) );
}
$code = wp_remote_retrieve_response_code( $response );
if ( 304 === $code ) {
return array( 'success' => true, 'message' => '', 'update_available' => false );
}
if ( 200 !== $code ) {
return self::record_failure( sprintf( 'Update server returned HTTP %d.', $code ) );
}
$new_etag = wp_remote_retrieve_header( $response, 'etag' );
if ( $new_etag ) {
update_option( self::MANIFEST_ETAG_OPTION, $new_etag, false );
}
$body = wp_remote_retrieve_body( $response );
$manifest = json_decode( $body, true );
if ( ! is_array( $manifest ) ) {
return self::record_failure( __( 'Update manifest was not valid JSON.', 'argus-wordpress-defence' ) );
}
return self::process_manifest( $manifest );
}
public static function process_manifest( array $manifest ) {
if ( ! self::verify_signature( $manifest ) ) {
return self::record_failure( __( 'Update manifest failed signature verification.', 'argus-wordpress-defence' ) );
}
$version = $manifest['version'] ?? '';
if ( '' === $version ) {
return self::record_failure( __( 'Update manifest is missing a version.', 'argus-wordpress-defence' ) );
}
if ( version_compare( $version, ARGUS_WPD_VERSION, '<=' ) ) {
return array( 'success' => true, 'message' => '', 'update_available' => false );
}
$last_installed = get_option( self::LAST_SUCCESS_OPTION, array() );
if ( ! empty( $last_installed['version'] ) && version_compare( $version, $last_installed['version'], '<=' ) ) {
return array( 'success' => true, 'message' => '', 'update_available' => false );
}
global $wp_version;
if ( ! empty( $manifest['min_php'] ) && version_compare( PHP_VERSION, $manifest['min_php'], '<' ) ) {
return self::record_failure( sprintf( 'Update %s requires PHP %s or newer.', $version, $manifest['min_php'] ) );
}
if ( ! empty( $manifest['min_wp'] ) && version_compare( $wp_version, $manifest['min_wp'], '<' ) ) {
return self::record_failure( sprintf( 'Update %s requires WordPress %s or newer.', $version, $manifest['min_wp'] ) );
}
update_option( self::PENDING_MANIFEST_OPTION, $manifest, false );
// Any newer, compatible, signature-verified version is installed --
// 'critical' is informational only (used in the success message and
// by Argus_Events severity), not an install gate. It used to be: a
// non-critical manifest was recorded as "update_available" and left
// there permanently, since nothing else ever called install_update()
// for it -- no button, no cron path, nothing. That made "automatic
// updates" only ever true for updates someone remembered to flag
// critical, which defeats the actual feature.
return self::install_update( $manifest );
}
public static function verify_signature( array $manifest ) {
if ( empty( $manifest['signature'] ) ) {
return false;
}
$signature = base64_decode( $manifest['signature'], true );
if ( false === $signature || SODIUM_CRYPTO_SIGN_BYTES !== strlen( $signature ) ) {
return false;
}
$public_key_b64 = self::public_key();
if ( '' === $public_key_b64 ) {
return false;
}
$public_key = base64_decode( $public_key_b64, true );
if ( false === $public_key ) {
return false;
}
$canonical = self::canonical_payload( $manifest );
return sodium_crypto_sign_verify_detached( $signature, $canonical, $public_key );
}
protected static function canonical_payload( array $manifest ) {
$ordered = array();
foreach ( array( 'version', 'released_at', 'package_url', 'sha256', 'min_php', 'min_wp', 'critical' ) as $key ) {
$ordered[ $key ] = $manifest[ $key ] ?? null;
}
return wp_json_encode( $ordered, JSON_UNESCAPED_SLASHES );
}
public static function install_update( array $manifest, $target_dir = null ) {
$target_dir = $target_dir ?: ( WP_PLUGIN_DIR . '/argus-wordpress-defence' );
$version = $manifest['version'];
$upgrade_dir = trailingslashit( wp_get_upload_dir()['basedir'] ) . 'argus-wpd-data/update-staging';
if ( ! is_dir( $upgrade_dir ) && ! wp_mkdir_p( $upgrade_dir ) ) {
return self::record_failure( __( 'Could not prepare the update staging directory.', 'argus-wordpress-defence' ) );
}
$package_path = trailingslashit( $upgrade_dir ) . 'package-' . $version . '-' . bin2hex( random_bytes( 4 ) ) . '.zip';
$response = wp_remote_get( $manifest['package_url'], array( 'timeout' => 120, 'stream' => true, 'filename' => $package_path ) );
if ( is_wp_error( $response ) || 200 !== (int) wp_remote_retrieve_response_code( $response ) ) {
@unlink( $package_path ); // phpcs:ignore WordPress.PHP.NoSilencedErrors, WordPress.WP.AlternativeFunctions
return self::record_failure( __( 'Could not download the update package.', 'argus-wordpress-defence' ) );
}
if ( ! hash_equals( $manifest['sha256'], hash_file( 'sha256', $package_path ) ) ) {
wp_delete_file( $package_path );
return self::record_failure( __( 'Downloaded package hash did not match the signed manifest -- rejected.', 'argus-wordpress-defence' ) );
}
$extract_root = trailingslashit( $upgrade_dir ) . 'extract-' . $version . '-' . bin2hex( random_bytes( 4 ) );
if ( ! class_exists( 'ZipArchive' ) ) {
wp_delete_file( $package_path );
return self::record_failure( __( 'The PHP zip extension is not available -- cannot install the update.', 'argus-wordpress-defence' ) );
}
$zip = new ZipArchive();
if ( true !== $zip->open( $package_path ) || true !== $zip->extractTo( $extract_root ) ) {
wp_delete_file( $package_path );
return self::record_failure( __( 'Could not extract the update package.', 'argus-wordpress-defence' ) );
}
$zip->close();
wp_delete_file( $package_path );
$extracted_plugin_dir = trailingslashit( $extract_root ) . 'argus-wordpress-defence';
$new_main_file = trailingslashit( $extracted_plugin_dir ) . 'argus-wordpress-defence.php';
if ( ! file_exists( $new_main_file ) ) {
self::rrmdir( $extract_root );
return self::record_failure( __( 'Extracted package did not contain the expected plugin file.', 'argus-wordpress-defence' ) );
}
$header_contents = file_get_contents( $new_main_file ); // phpcs:ignore WordPress.WP.AlternativeFunctions
if ( ! preg_match( '/Version:\s*([^\r\n]+)/', $header_contents, $m ) || trim( $m[1] ) !== $version ) {
self::rrmdir( $extract_root );
return self::record_failure( __( 'Extracted package version did not match the signed manifest -- rejected.', 'argus-wordpress-defence' ) );
}
$backup_dir = $target_dir . '-previous-' . time();
$had_previous = is_dir( $target_dir );
if ( $had_previous && ! rename( $target_dir, $backup_dir ) ) { // phpcs:ignore WordPress.WP.AlternativeFunctions
self::rrmdir( $extract_root );
return self::record_failure( __( 'Could not move the current plugin version aside for the update.', 'argus-wordpress-defence' ) );
}
if ( ! rename( $extracted_plugin_dir, $target_dir ) ) { // phpcs:ignore WordPress.WP.AlternativeFunctions
if ( $had_previous ) {
rename( $backup_dir, $target_dir ); // phpcs:ignore WordPress.WP.AlternativeFunctions
}
self::rrmdir( $extract_root );
return self::record_failure( __( 'Could not activate the downloaded update -- rolled back to the previous version.', 'argus-wordpress-defence' ) );
}
self::rrmdir( $extract_root );
if ( $had_previous ) {
self::rrmdir( $backup_dir );
}
delete_option( self::PENDING_MANIFEST_OPTION );
update_option(
self::LAST_SUCCESS_OPTION,
array( 'version' => $version, 'installed_at' => current_time( 'mysql', true ) ),
false
);
return array(
'success' => true,
'message' => ! empty( $manifest['critical'] )
? sprintf( __( 'A critical ARGUS security update was installed (%s).', 'argus-wordpress-defence' ), $version )
: sprintf( __( 'ARGUS Defence was updated to version %s.', 'argus-wordpress-defence' ), $version ),
'update_available' => false,
);
}
protected static function record_failure( $message ) {
update_option(
self::LAST_FAILURE_OPTION,
array( 'message' => $message, 'at' => current_time( 'mysql', true ) ),
false
);
Argus_Events::record( 'update_check_failed', 'medium', $message, array() );
return array( 'success' => false, 'message' => $message, 'update_available' => false );
}
protected static function rrmdir( $dir ) {
if ( ! is_dir( $dir ) ) {
return;
}
$items = new RecursiveIteratorIterator( new RecursiveDirectoryIterator( $dir, FilesystemIterator::SKIP_DOTS ), RecursiveIteratorIterator::CHILD_FIRST );
foreach ( $items as $item ) {
$item->isDir() ? rmdir( $item->getPathname() ) : unlink( $item->getPathname() ); // phpcs:ignore WordPress.WP.AlternativeFunctions
}
rmdir( $dir ); // phpcs:ignore WordPress.WP.AlternativeFunctions
}
public static function status() {
return array(
'current_version' => ARGUS_WPD_VERSION,
'configured' => self::is_configured(),
'last_check' => get_option( self::LAST_CHECK_OPTION, 0 ),
'last_success' => get_option( self::LAST_SUCCESS_OPTION, array() ),
'last_failure' => get_option( self::LAST_FAILURE_OPTION, array() ),
'pending' => get_option( self::PENDING_MANIFEST_OPTION, array() ),
);
}
}
Reference in New Issue View Git Blame Copy Permalink