* @param array $file Reference to a single element of `$_FILES`.

[1000] Fix | Delete

* Call the function once for each uploaded file.

[1001] Fix | Delete

* @param array|false $overrides Optional. An associative array of names => values

[1002] Fix | Delete

* to override default variables. Default false.

[1003] Fix | Delete

* @param string $time Optional. Time formatted in 'yyyy/mm'. Default null.

[1004] Fix | Delete

* @return array On success, returns an associative array of file attributes.

[1005] Fix | Delete

* On failure, returns `$overrides['upload_error_handler']( &$file, $message )`

[1006] Fix | Delete

* or `array( 'error' => $message )`.

[1007] Fix | Delete

*/

[1008] Fix | Delete

function wp_handle_upload( &$file, $overrides = false, $time = null ) {

[1009] Fix | Delete

/*

[1010] Fix | Delete

* $_POST['action'] must be set and its value must equal $overrides['action']

[1011] Fix | Delete

* or this:

[1012] Fix | Delete

*/

[1013] Fix | Delete

$action = 'wp_handle_upload';

[1014] Fix | Delete

if ( isset( $overrides['action'] ) ) {

[1015] Fix | Delete

$action = $overrides['action'];

[1016] Fix | Delete

}

[1017] Fix | Delete

[1018] Fix | Delete

return _wp_handle_upload( $file, $overrides, $time, $action );

[1019] Fix | Delete

}

[1020] Fix | Delete

[1021] Fix | Delete

/**

[1022] Fix | Delete

* Wrapper for _wp_handle_upload().

[1023] Fix | Delete

*

[1024] Fix | Delete

* Passes the {@see 'wp_handle_sideload'} action.

[1025] Fix | Delete

*

[1026] Fix | Delete

* @since 2.6.0

[1027] Fix | Delete

*

[1028] Fix | Delete

* @see _wp_handle_upload()

[1029] Fix | Delete

*

[1030] Fix | Delete

* @param array $file Reference to a single element of `$_FILES`.

[1031] Fix | Delete

* Call the function once for each uploaded file.

[1032] Fix | Delete

* @param array|false $overrides Optional. An associative array of names => values

[1033] Fix | Delete

* to override default variables. Default false.

[1034] Fix | Delete

* @param string $time Optional. Time formatted in 'yyyy/mm'. Default null.

[1035] Fix | Delete

* @return array On success, returns an associative array of file attributes.

[1036] Fix | Delete

* On failure, returns `$overrides['upload_error_handler']( &$file, $message )`

[1037] Fix | Delete

* or `array( 'error' => $message )`.

[1038] Fix | Delete

*/

[1039] Fix | Delete

function wp_handle_sideload( &$file, $overrides = false, $time = null ) {

[1040] Fix | Delete

/*

[1041] Fix | Delete

* $_POST['action'] must be set and its value must equal $overrides['action']

[1042] Fix | Delete

* or this:

[1043] Fix | Delete

*/

[1044] Fix | Delete

$action = 'wp_handle_sideload';

[1045] Fix | Delete

if ( isset( $overrides['action'] ) ) {

[1046] Fix | Delete

$action = $overrides['action'];

[1047] Fix | Delete

}

[1048] Fix | Delete

[1049] Fix | Delete

return _wp_handle_upload( $file, $overrides, $time, $action );

[1050] Fix | Delete

}

[1051] Fix | Delete

[1052] Fix | Delete

/**

[1053] Fix | Delete

* Downloads a URL to a local temporary file using the WordPress HTTP API.

[1054] Fix | Delete

*

[1055] Fix | Delete

* Please note that the calling function must unlink() the file.

[1056] Fix | Delete

*

[1057] Fix | Delete

* @since 2.5.0

[1058] Fix | Delete

* @since 5.2.0 Signature Verification with SoftFail was added.

[1059] Fix | Delete

*

[1060] Fix | Delete

* @param string $url The URL of the file to download.

[1061] Fix | Delete

* @param int $timeout The timeout for the request to download the file.

[1062] Fix | Delete

* Default 300 seconds.

[1063] Fix | Delete

* @param bool $signature_verification Whether to perform Signature Verification.

[1064] Fix | Delete

* Default false.

[1065] Fix | Delete

* @return string|WP_Error Filename on success, WP_Error on failure.

[1066] Fix | Delete

*/

[1067] Fix | Delete

function download_url( $url, $timeout = 300, $signature_verification = false ) {

[1068] Fix | Delete

// WARNING: The file is not automatically deleted, the script must unlink() the file.

[1069] Fix | Delete

if ( ! $url ) {

[1070] Fix | Delete

return new WP_Error( 'http_no_url', __( 'Invalid URL Provided.' ) );

[1071] Fix | Delete

}

[1072] Fix | Delete

[1073] Fix | Delete

$url_filename = basename( parse_url( $url, PHP_URL_PATH ) );

[1074] Fix | Delete

[1075] Fix | Delete

$tmpfname = wp_tempnam( $url_filename );

[1076] Fix | Delete

if ( ! $tmpfname ) {

[1077] Fix | Delete

return new WP_Error( 'http_no_file', __( 'Could not create Temporary file.' ) );

[1078] Fix | Delete

}

[1079] Fix | Delete

[1080] Fix | Delete

$response = wp_safe_remote_get(

[1081] Fix | Delete

$url,

[1082] Fix | Delete

array(

[1083] Fix | Delete

'timeout' => $timeout,

[1084] Fix | Delete

'stream' => true,

[1085] Fix | Delete

'filename' => $tmpfname,

[1086] Fix | Delete

)

[1087] Fix | Delete

);

[1088] Fix | Delete

[1089] Fix | Delete

if ( is_wp_error( $response ) ) {

[1090] Fix | Delete

unlink( $tmpfname );

[1091] Fix | Delete

return $response;

[1092] Fix | Delete

}

[1093] Fix | Delete

[1094] Fix | Delete

$response_code = wp_remote_retrieve_response_code( $response );

[1095] Fix | Delete

[1096] Fix | Delete

if ( 200 != $response_code ) {

[1097] Fix | Delete

$data = array(

[1098] Fix | Delete

'code' => $response_code,

[1099] Fix | Delete

);

[1100] Fix | Delete

[1101] Fix | Delete

// Retrieve a sample of the response body for debugging purposes.

[1102] Fix | Delete

$tmpf = fopen( $tmpfname, 'rb' );

[1103] Fix | Delete

if ( $tmpf ) {

[1104] Fix | Delete

/**

[1105] Fix | Delete

* Filters the maximum error response body size in `download_url()`.

[1106] Fix | Delete

*

[1107] Fix | Delete

* @since 5.1.0

[1108] Fix | Delete

*

[1109] Fix | Delete

* @see download_url()

[1110] Fix | Delete

*

[1111] Fix | Delete

* @param int $size The maximum error response body size. Default 1 KB.

[1112] Fix | Delete

*/

[1113] Fix | Delete

$response_size = apply_filters( 'download_url_error_max_body_size', KB_IN_BYTES );

[1114] Fix | Delete

$data['body'] = fread( $tmpf, $response_size );

[1115] Fix | Delete

fclose( $tmpf );

[1116] Fix | Delete

}

[1117] Fix | Delete

[1118] Fix | Delete

unlink( $tmpfname );

[1119] Fix | Delete

return new WP_Error( 'http_404', trim( wp_remote_retrieve_response_message( $response ) ), $data );

[1120] Fix | Delete

}

[1121] Fix | Delete

[1122] Fix | Delete

$content_md5 = wp_remote_retrieve_header( $response, 'content-md5' );

[1123] Fix | Delete

if ( $content_md5 ) {

[1124] Fix | Delete

$md5_check = verify_file_md5( $tmpfname, $content_md5 );

[1125] Fix | Delete

if ( is_wp_error( $md5_check ) ) {

[1126] Fix | Delete

unlink( $tmpfname );

[1127] Fix | Delete

return $md5_check;

[1128] Fix | Delete

}

[1129] Fix | Delete

}

[1130] Fix | Delete

[1131] Fix | Delete

// If the caller expects signature verification to occur, check to see if this URL supports it.

[1132] Fix | Delete

if ( $signature_verification ) {

[1133] Fix | Delete

/**

[1134] Fix | Delete

* Filters the list of hosts which should have Signature Verification attempted on.

[1135] Fix | Delete

*

[1136] Fix | Delete

* @since 5.2.0

[1137] Fix | Delete

*

[1138] Fix | Delete

* @param string[] $hostnames List of hostnames.

[1139] Fix | Delete

*/

[1140] Fix | Delete

$signed_hostnames = apply_filters( 'wp_signature_hosts', array( 'wordpress.org', 'downloads.wordpress.org', 's.w.org' ) );

[1141] Fix | Delete

$signature_verification = in_array( parse_url( $url, PHP_URL_HOST ), $signed_hostnames, true );

[1142] Fix | Delete

}

[1143] Fix | Delete

[1144] Fix | Delete

// Perform signature valiation if supported.

[1145] Fix | Delete

if ( $signature_verification ) {

[1146] Fix | Delete

$signature = wp_remote_retrieve_header( $response, 'x-content-signature' );

[1147] Fix | Delete

if ( ! $signature ) {

[1148] Fix | Delete

// Retrieve signatures from a file if the header wasn't included.

[1149] Fix | Delete

// WordPress.org stores signatures at $package_url.sig.

[1150] Fix | Delete

[1151] Fix | Delete

$signature_url = false;

[1152] Fix | Delete

$url_path = parse_url( $url, PHP_URL_PATH );

[1153] Fix | Delete

[1154] Fix | Delete

if ( '.zip' === substr( $url_path, -4 ) || '.tar.gz' === substr( $url_path, -7 ) ) {

[1155] Fix | Delete

$signature_url = str_replace( $url_path, $url_path . '.sig', $url );

[1156] Fix | Delete

}

[1157] Fix | Delete

[1158] Fix | Delete

/**

[1159] Fix | Delete

* Filters the URL where the signature for a file is located.

[1160] Fix | Delete

*

[1161] Fix | Delete

* @since 5.2.0

[1162] Fix | Delete

*

[1163] Fix | Delete

* @param false|string $signature_url The URL where signatures can be found for a file, or false if none are known.

[1164] Fix | Delete

* @param string $url The URL being verified.

[1165] Fix | Delete

*/

[1166] Fix | Delete

$signature_url = apply_filters( 'wp_signature_url', $signature_url, $url );

[1167] Fix | Delete

[1168] Fix | Delete

if ( $signature_url ) {

[1169] Fix | Delete

$signature_request = wp_safe_remote_get(

[1170] Fix | Delete

$signature_url,

[1171] Fix | Delete

array(

[1172] Fix | Delete

'limit_response_size' => 10 * KB_IN_BYTES, // 10KB should be large enough for quite a few signatures.

[1173] Fix | Delete

)

[1174] Fix | Delete

);

[1175] Fix | Delete

[1176] Fix | Delete

if ( ! is_wp_error( $signature_request ) && 200 === wp_remote_retrieve_response_code( $signature_request ) ) {

[1177] Fix | Delete

$signature = explode( "\n", wp_remote_retrieve_body( $signature_request ) );

[1178] Fix | Delete

}

[1179] Fix | Delete

}

[1180] Fix | Delete

}

[1181] Fix | Delete

[1182] Fix | Delete

// Perform the checks.

[1183] Fix | Delete

$signature_verification = verify_file_signature( $tmpfname, $signature, basename( parse_url( $url, PHP_URL_PATH ) ) );

[1184] Fix | Delete

}

[1185] Fix | Delete

[1186] Fix | Delete

if ( is_wp_error( $signature_verification ) ) {

[1187] Fix | Delete

if (

[1188] Fix | Delete

/**

[1189] Fix | Delete

* Filters whether Signature Verification failures should be allowed to soft fail.

[1190] Fix | Delete

*

[1191] Fix | Delete

* WARNING: This may be removed from a future release.

[1192] Fix | Delete

*

[1193] Fix | Delete

* @since 5.2.0

[1194] Fix | Delete

*

[1195] Fix | Delete

* @param bool $signature_softfail If a softfail is allowed.

[1196] Fix | Delete

* @param string $url The url being accessed.

[1197] Fix | Delete

*/

[1198] Fix | Delete

apply_filters( 'wp_signature_softfail', true, $url )

[1199] Fix | Delete

) {

[1200] Fix | Delete

$signature_verification->add_data( $tmpfname, 'softfail-filename' );

[1201] Fix | Delete

} else {

[1202] Fix | Delete

// Hard-fail.

[1203] Fix | Delete

unlink( $tmpfname );

[1204] Fix | Delete

}

[1205] Fix | Delete

[1206] Fix | Delete

return $signature_verification;

[1207] Fix | Delete

}

[1208] Fix | Delete

[1209] Fix | Delete

return $tmpfname;

[1210] Fix | Delete

}

[1211] Fix | Delete

[1212] Fix | Delete

/**

[1213] Fix | Delete

* Calculates and compares the MD5 of a file to its expected value.

[1214] Fix | Delete

*

[1215] Fix | Delete

* @since 3.7.0

[1216] Fix | Delete

*

[1217] Fix | Delete

* @param string $filename The filename to check the MD5 of.

[1218] Fix | Delete

* @param string $expected_md5 The expected MD5 of the file, either a base64-encoded raw md5,

[1219] Fix | Delete

* or a hex-encoded md5.

[1220] Fix | Delete

* @return bool|WP_Error True on success, false when the MD5 format is unknown/unexpected,

[1221] Fix | Delete

* WP_Error on failure.

[1222] Fix | Delete

*/

[1223] Fix | Delete

function verify_file_md5( $filename, $expected_md5 ) {

[1224] Fix | Delete

if ( 32 == strlen( $expected_md5 ) ) {

[1225] Fix | Delete

$expected_raw_md5 = pack( 'H*', $expected_md5 );

[1226] Fix | Delete

} elseif ( 24 == strlen( $expected_md5 ) ) {

[1227] Fix | Delete

$expected_raw_md5 = base64_decode( $expected_md5 );

[1228] Fix | Delete

} else {

[1229] Fix | Delete

return false; // Unknown format.

[1230] Fix | Delete

}

[1231] Fix | Delete

[1232] Fix | Delete

$file_md5 = md5_file( $filename, true );

[1233] Fix | Delete

[1234] Fix | Delete

if ( $file_md5 === $expected_raw_md5 ) {

[1235] Fix | Delete

return true;

[1236] Fix | Delete

}

[1237] Fix | Delete

[1238] Fix | Delete

return new WP_Error(

[1239] Fix | Delete

'md5_mismatch',

[1240] Fix | Delete

sprintf(

[1241] Fix | Delete

/* translators: 1: File checksum, 2: Expected checksum value. */

[1242] Fix | Delete

__( 'The checksum of the file (%1$s) does not match the expected checksum value (%2$s).' ),

[1243] Fix | Delete

bin2hex( $file_md5 ),

[1244] Fix | Delete

bin2hex( $expected_raw_md5 )

[1245] Fix | Delete

)

[1246] Fix | Delete

);

[1247] Fix | Delete

}

[1248] Fix | Delete

[1249] Fix | Delete

/**

[1250] Fix | Delete

* Verifies the contents of a file against its ED25519 signature.

[1251] Fix | Delete

*

[1252] Fix | Delete

* @since 5.2.0

[1253] Fix | Delete

*

[1254] Fix | Delete

* @param string $filename The file to validate.

[1255] Fix | Delete

* @param string|array $signatures A Signature provided for the file.

[1256] Fix | Delete

* @param string|false $filename_for_errors Optional. A friendly filename for errors.

[1257] Fix | Delete

* @return bool|WP_Error True on success, false if verification not attempted,

[1258] Fix | Delete

* or WP_Error describing an error condition.

[1259] Fix | Delete

*/

[1260] Fix | Delete

function verify_file_signature( $filename, $signatures, $filename_for_errors = false ) {

[1261] Fix | Delete

if ( ! $filename_for_errors ) {

[1262] Fix | Delete

$filename_for_errors = wp_basename( $filename );

[1263] Fix | Delete

}

[1264] Fix | Delete

[1265] Fix | Delete

// Check we can process signatures.

[1266] Fix | Delete

if ( ! function_exists( 'sodium_crypto_sign_verify_detached' ) || ! in_array( 'sha384', array_map( 'strtolower', hash_algos() ), true ) ) {

[1267] Fix | Delete

return new WP_Error(

[1268] Fix | Delete

'signature_verification_unsupported',

[1269] Fix | Delete

sprintf(

[1270] Fix | Delete

/* translators: %s: The filename of the package. */

[1271] Fix | Delete

__( 'The authenticity of %s could not be verified as signature verification is unavailable on this system.' ),

[1272] Fix | Delete

'<span class="code">' . esc_html( $filename_for_errors ) . '</span>'

[1273] Fix | Delete

),

[1274] Fix | Delete

( ! function_exists( 'sodium_crypto_sign_verify_detached' ) ? 'sodium_crypto_sign_verify_detached' : 'sha384' )

[1275] Fix | Delete

);

[1276] Fix | Delete

}

[1277] Fix | Delete

[1278] Fix | Delete

// Check for a edge-case affecting PHP Maths abilities.

[1279] Fix | Delete

if (

[1280] Fix | Delete

! extension_loaded( 'sodium' ) &&

[1281] Fix | Delete

in_array( PHP_VERSION_ID, array( 70200, 70201, 70202 ), true ) &&

[1282] Fix | Delete

extension_loaded( 'opcache' )

[1283] Fix | Delete

) {

[1284] Fix | Delete

// Sodium_Compat isn't compatible with PHP 7.2.0~7.2.2 due to a bug in the PHP Opcache extension, bail early as it'll fail.

[1285] Fix | Delete

// https://bugs.php.net/bug.php?id=75938

[1286] Fix | Delete

[1287] Fix | Delete

return new WP_Error(

[1288] Fix | Delete

'signature_verification_unsupported',

[1289] Fix | Delete

sprintf(

[1290] Fix | Delete

/* translators: %s: The filename of the package. */

[1291] Fix | Delete

__( 'The authenticity of %s could not be verified as signature verification is unavailable on this system.' ),

[1292] Fix | Delete

'<span class="code">' . esc_html( $filename_for_errors ) . '</span>'

[1293] Fix | Delete

),

[1294] Fix | Delete

array(

[1295] Fix | Delete

'php' => phpversion(),

[1296] Fix | Delete

// phpcs:ignore PHPCompatibility.Constants.NewConstants.sodium_library_versionFound

[1297] Fix | Delete

'sodium' => defined( 'SODIUM_LIBRARY_VERSION' ) ? SODIUM_LIBRARY_VERSION : ( defined( 'ParagonIE_Sodium_Compat::VERSION_STRING' ) ? ParagonIE_Sodium_Compat::VERSION_STRING : false ),

[1298] Fix | Delete

)

[1299] Fix | Delete

);

[1300] Fix | Delete

[1301] Fix | Delete

}

[1302] Fix | Delete

[1303] Fix | Delete

// Verify runtime speed of Sodium_Compat is acceptable.

[1304] Fix | Delete

if ( ! extension_loaded( 'sodium' ) && ! ParagonIE_Sodium_Compat::polyfill_is_fast() ) {

[1305] Fix | Delete

$sodium_compat_is_fast = false;

[1306] Fix | Delete

[1307] Fix | Delete

// Allow for an old version of Sodium_Compat being loaded before the bundled WordPress one.

[1308] Fix | Delete

if ( method_exists( 'ParagonIE_Sodium_Compat', 'runtime_speed_test' ) ) {

[1309] Fix | Delete

// Run `ParagonIE_Sodium_Compat::runtime_speed_test()` in optimized integer mode, as that's what WordPress utilises during signing verifications.

[1310] Fix | Delete

// phpcs:disable WordPress.NamingConventions.ValidVariableName

[1311] Fix | Delete

$old_fastMult = ParagonIE_Sodium_Compat::$fastMult;

[1312] Fix | Delete

ParagonIE_Sodium_Compat::$fastMult = true;

[1313] Fix | Delete

$sodium_compat_is_fast = ParagonIE_Sodium_Compat::runtime_speed_test( 100, 10 );

[1314] Fix | Delete

ParagonIE_Sodium_Compat::$fastMult = $old_fastMult;

[1315] Fix | Delete

// phpcs:enable

[1316] Fix | Delete

}

[1317] Fix | Delete

[1318] Fix | Delete

// This cannot be performed in a reasonable amount of time.

[1319] Fix | Delete

// https://github.com/paragonie/sodium_compat#help-sodium_compat-is-slow-how-can-i-make-it-fast

[1320] Fix | Delete

if ( ! $sodium_compat_is_fast ) {

[1321] Fix | Delete

return new WP_Error(

[1322] Fix | Delete

'signature_verification_unsupported',

[1323] Fix | Delete

sprintf(

[1324] Fix | Delete

/* translators: %s: The filename of the package. */

[1325] Fix | Delete

__( 'The authenticity of %s could not be verified as signature verification is unavailable on this system.' ),

[1326] Fix | Delete

'<span class="code">' . esc_html( $filename_for_errors ) . '</span>'

[1327] Fix | Delete

),

[1328] Fix | Delete

array(

[1329] Fix | Delete

'php' => phpversion(),

[1330] Fix | Delete

// phpcs:ignore PHPCompatibility.Constants.NewConstants.sodium_library_versionFound

[1331] Fix | Delete

'sodium' => defined( 'SODIUM_LIBRARY_VERSION' ) ? SODIUM_LIBRARY_VERSION : ( defined( 'ParagonIE_Sodium_Compat::VERSION_STRING' ) ? ParagonIE_Sodium_Compat::VERSION_STRING : false ),

[1332] Fix | Delete

'polyfill_is_fast' => false,

[1333] Fix | Delete

'max_execution_time' => ini_get( 'max_execution_time' ),

[1334] Fix | Delete

)

[1335] Fix | Delete

);

[1336] Fix | Delete

}

[1337] Fix | Delete

}

[1338] Fix | Delete

[1339] Fix | Delete

if ( ! $signatures ) {

[1340] Fix | Delete

return new WP_Error(

[1341] Fix | Delete

'signature_verification_no_signature',

[1342] Fix | Delete

sprintf(

[1343] Fix | Delete

/* translators: %s: The filename of the package. */

[1344] Fix | Delete

__( 'The authenticity of %s could not be verified as no signature was found.' ),

[1345] Fix | Delete

'<span class="code">' . esc_html( $filename_for_errors ) . '</span>'

[1346] Fix | Delete

),

[1347] Fix | Delete

array(

[1348] Fix | Delete

'filename' => $filename_for_errors,

[1349] Fix | Delete

)

[1350] Fix | Delete

);

[1351] Fix | Delete

}

[1352] Fix | Delete

[1353] Fix | Delete

$trusted_keys = wp_trusted_keys();

[1354] Fix | Delete

$file_hash = hash_file( 'sha384', $filename, true );

[1355] Fix | Delete

[1356] Fix | Delete

mbstring_binary_safe_encoding();

[1357] Fix | Delete

[1358] Fix | Delete

$skipped_key = 0;

[1359] Fix | Delete

$skipped_signature = 0;

[1360] Fix | Delete

[1361] Fix | Delete

foreach ( (array) $signatures as $signature ) {

[1362] Fix | Delete

$signature_raw = base64_decode( $signature );

[1363] Fix | Delete

[1364] Fix | Delete

// Ensure only valid-length signatures are considered.

[1365] Fix | Delete

if ( SODIUM_CRYPTO_SIGN_BYTES !== strlen( $signature_raw ) ) {

[1366] Fix | Delete

$skipped_signature++;

[1367] Fix | Delete

continue;

[1368] Fix | Delete

}

[1369] Fix | Delete

[1370] Fix | Delete

foreach ( (array) $trusted_keys as $key ) {

[1371] Fix | Delete

$key_raw = base64_decode( $key );

[1372] Fix | Delete

[1373] Fix | Delete

// Only pass valid public keys through.

[1374] Fix | Delete

if ( SODIUM_CRYPTO_SIGN_PUBLICKEYBYTES !== strlen( $key_raw ) ) {

[1375] Fix | Delete

$skipped_key++;

[1376] Fix | Delete

continue;

[1377] Fix | Delete

}

[1378] Fix | Delete

[1379] Fix | Delete

if ( sodium_crypto_sign_verify_detached( $signature_raw, $file_hash, $key_raw ) ) {

[1380] Fix | Delete

reset_mbstring_encoding();

[1381] Fix | Delete

return true;

[1382] Fix | Delete

}

[1383] Fix | Delete

}

[1384] Fix | Delete

}

[1385] Fix | Delete

[1386] Fix | Delete

reset_mbstring_encoding();

[1387] Fix | Delete

[1388] Fix | Delete

return new WP_Error(

[1389] Fix | Delete

'signature_verification_failed',

[1390] Fix | Delete

sprintf(

[1391] Fix | Delete

/* translators: %s: The filename of the package. */

[1392] Fix | Delete

__( 'The authenticity of %s could not be verified.' ),

[1393] Fix | Delete

'<span class="code">' . esc_html( $filename_for_errors ) . '</span>'

[1394] Fix | Delete

),

[1395] Fix | Delete

// Error data helpful for debugging:

[1396] Fix | Delete

array(

[1397] Fix | Delete

'filename' => $filename_for_errors,

[1398] Fix | Delete

'keys' => $trusted_keys,

[1399] Fix | Delete

'signatures' => $signatures,

[1400] Fix | Delete

'hash' => bin2hex( $file_hash ),

[1401] Fix | Delete

'skipped_key' => $skipped_key,

[1402] Fix | Delete

'skipped_sig' => $skipped_signature,

[1403] Fix | Delete

'php' => phpversion(),

[1404] Fix | Delete

// phpcs:ignore PHPCompatibility.Constants.NewConstants.sodium_library_versionFound

[1405] Fix | Delete

'sodium' => defined( 'SODIUM_LIBRARY_VERSION' ) ? SODIUM_LIBRARY_VERSION : ( defined( 'ParagonIE_Sodium_Compat::VERSION_STRING' ) ? ParagonIE_Sodium_Compat::VERSION_STRING : false ),

[1406] Fix | Delete

)

[1407] Fix | Delete

);

[1408] Fix | Delete

}

[1409] Fix | Delete

[1410] Fix | Delete

/**

[1411] Fix | Delete

* Retrieves the list of signing keys trusted by WordPress.

[1412] Fix | Delete

*

[1413] Fix | Delete

* @since 5.2.0

[1414] Fix | Delete

*

[1415] Fix | Delete

* @return string[] Array of base64-encoded signing keys.

[1416] Fix | Delete

*/

[1417] Fix | Delete

function wp_trusted_keys() {

[1418] Fix | Delete

$trusted_keys = array();

[1419] Fix | Delete

[1420] Fix | Delete

if ( time() < 1617235200 ) {

[1421] Fix | Delete

// WordPress.org Key #1 - This key is only valid before April 1st, 2021.

[1422] Fix | Delete

$trusted_keys[] = 'fRPyrxb/MvVLbdsYi+OOEv4xc+Eqpsj+kkAS6gNOkI0=';

[1423] Fix | Delete

}

[1424] Fix | Delete

[1425] Fix | Delete

// TODO: Add key #2 with longer expiration.

[1426] Fix | Delete

[1427] Fix | Delete

/**

[1428] Fix | Delete

* Filters the valid signing keys used to verify the contents of files.

[1429] Fix | Delete

*

[1430] Fix | Delete

* @since 5.2.0

[1431] Fix | Delete

*

[1432] Fix | Delete

* @param string[] $trusted_keys The trusted keys that may sign packages.

[1433] Fix | Delete

*/

[1434] Fix | Delete

return apply_filters( 'wp_trusted_keys', $trusted_keys );

[1435] Fix | Delete

}

[1436] Fix | Delete

[1437] Fix | Delete

/**

[1438] Fix | Delete

* Unzips a specified ZIP file to a location on the filesystem via the WordPress

[1439] Fix | Delete

* Filesystem Abstraction.

[1440] Fix | Delete

*

[1441] Fix | Delete

* Assumes that WP_Filesystem() has already been called and set up. Does not extract

[1442] Fix | Delete

* a root-level __MACOSX directory, if present.

[1443] Fix | Delete

*

[1444] Fix | Delete

* Attempts to increase the PHP memory limit to 256M before uncompressing. However,

[1445] Fix | Delete

* the most memory required shouldn't be much larger than the archive itself.

[1446] Fix | Delete

*

[1447] Fix | Delete

* @since 2.5.0

[1448] Fix | Delete

*

[1449] Fix | Delete

* @global WP_Filesystem_Base $wp_filesystem WordPress filesystem subclass.

[1450] Fix | Delete

*

[1451] Fix | Delete

* @param string $file Full path and filename of ZIP archive.

[1452] Fix | Delete

* @param string $to Full path on the filesystem to extract archive to.

[1453] Fix | Delete

* @return true|WP_Error True on success, WP_Error on failure.

[1454] Fix | Delete

*/

[1455] Fix | Delete

function unzip_file( $file, $to ) {

[1456] Fix | Delete

global $wp_filesystem;

[1457] Fix | Delete

[1458] Fix | Delete

if ( ! $wp_filesystem || ! is_object( $wp_filesystem ) ) {

[1459] Fix | Delete

return new WP_Error( 'fs_unavailable', __( 'Could not access filesystem.' ) );

[1460] Fix | Delete

}

[1461] Fix | Delete

[1462] Fix | Delete

// Unzip can use a lot of memory, but not this much hopefully.

[1463] Fix | Delete

wp_raise_memory_limit( 'admin' );

[1464] Fix | Delete

[1465] Fix | Delete

$needed_dirs = array();

[1466] Fix | Delete

$to = trailingslashit( $to );

[1467] Fix | Delete

[1468] Fix | Delete

// Determine any parent directories needed (of the upgrade directory).

[1469] Fix | Delete

if ( ! $wp_filesystem->is_dir( $to ) ) { // Only do parents if no children exist.

[1470] Fix | Delete

$path = preg_split( '![/\\\]!', untrailingslashit( $to ) );

[1471] Fix | Delete

for ( $i = count( $path ); $i >= 0; $i-- ) {

[1472] Fix | Delete

if ( empty( $path[ $i ] ) ) {

[1473] Fix | Delete

continue;

[1474] Fix | Delete

}

[1475] Fix | Delete

[1476] Fix | Delete

$dir = implode( '/', array_slice( $path, 0, $i + 1 ) );

[1477] Fix | Delete

if ( preg_match( '!^[a-z]:$!i', $dir ) ) { // Skip it if it looks like a Windows Drive letter.

[1478] Fix | Delete

continue;

[1479] Fix | Delete

}

[1480] Fix | Delete

[1481] Fix | Delete

if ( ! $wp_filesystem->is_dir( $dir ) ) {

[1482] Fix | Delete

$needed_dirs[] = $dir;

[1483] Fix | Delete

} else {

[1484] Fix | Delete

break; // A folder exists, therefore we don't need to check the levels below this.

[1485] Fix | Delete

}

[1486] Fix | Delete

}

[1487] Fix | Delete

}

[1488] Fix | Delete

[1489] Fix | Delete

/**

[1490] Fix | Delete

* Filters whether to use ZipArchive to unzip archives.

[1491] Fix | Delete

*

[1492] Fix | Delete

* @since 3.0.0

[1493] Fix | Delete

*

[1494] Fix | Delete

* @param bool $ziparchive Whether to use ZipArchive. Default true.

[1495] Fix | Delete

*/

[1496] Fix | Delete

if ( class_exists( 'ZipArchive', false ) && apply_filters( 'unzip_file_use_ziparchive', true ) ) {

[1497] Fix | Delete

$result = _unzip_file_ziparchive( $file, $to, $needed_dirs );

[1498] Fix | Delete

if ( true === $result ) {

[1499] Fix | Delete