Edit File by line

<?php

[0] Fix | Delete

/**

[1] Fix | Delete

* Update/Install Plugin/Theme administration panel.

[2] Fix | Delete

[3] Fix | Delete

* @package WordPress

[4] Fix | Delete

* @subpackage Administration

[5] Fix | Delete

[6] Fix | Delete

[7] Fix | Delete

if ( ! defined( 'IFRAME_REQUEST' )

[8] Fix | Delete

&& isset( $_GET['action'] ) && in_array( $_GET['action'], array( 'update-selected', 'activate-plugin', 'update-selected-themes' ), true )

[9] Fix | Delete

) {

[10] Fix | Delete

define( 'IFRAME_REQUEST', true );

[11] Fix | Delete

}

[12] Fix | Delete

[13] Fix | Delete

/** WordPress Administration Bootstrap */

[14] Fix | Delete

require_once __DIR__ . '/admin.php';

[15] Fix | Delete

[16] Fix | Delete

require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';

[17] Fix | Delete

[18] Fix | Delete

wp_enqueue_script( 'wp-a11y' );

[19] Fix | Delete

[20] Fix | Delete

if ( isset( $_GET['action'] ) ) {

[21] Fix | Delete

$plugin = isset( $_REQUEST['plugin'] ) ? trim( $_REQUEST['plugin'] ) : '';

[22] Fix | Delete

$theme = isset( $_REQUEST['theme'] ) ? urldecode( $_REQUEST['theme'] ) : '';

[23] Fix | Delete

$action = isset( $_REQUEST['action'] ) ? $_REQUEST['action'] : '';

[24] Fix | Delete

[25] Fix | Delete

if ( 'update-selected' === $action ) {

[26] Fix | Delete

if ( ! current_user_can( 'update_plugins' ) ) {

[27] Fix | Delete

wp_die( __( 'Sorry, you are not allowed to update plugins for this site.' ) );

[28] Fix | Delete

}

[29] Fix | Delete

[30] Fix | Delete

check_admin_referer( 'bulk-update-plugins' );

[31] Fix | Delete

[32] Fix | Delete

if ( isset( $_GET['plugins'] ) ) {

[33] Fix | Delete

$plugins = explode( ',', stripslashes( $_GET['plugins'] ) );

[34] Fix | Delete

} elseif ( isset( $_POST['checked'] ) ) {

[35] Fix | Delete

$plugins = (array) $_POST['checked'];

[36] Fix | Delete

} else {

[37] Fix | Delete

$plugins = array();

[38] Fix | Delete

}

[39] Fix | Delete

[40] Fix | Delete

$plugins = array_map( 'urldecode', $plugins );

[41] Fix | Delete

[42] Fix | Delete

$url = 'update.php?action=update-selected&plugins=' . urlencode( implode( ',', $plugins ) );

[43] Fix | Delete

$nonce = 'bulk-update-plugins';

[44] Fix | Delete

[45] Fix | Delete

wp_enqueue_script( 'updates' );

[46] Fix | Delete

iframe_header();

[47] Fix | Delete

[48] Fix | Delete

$upgrader = new Plugin_Upgrader( new Bulk_Plugin_Upgrader_Skin( compact( 'nonce', 'url' ) ) );

[49] Fix | Delete

$upgrader->bulk_upgrade( $plugins );

[50] Fix | Delete

[51] Fix | Delete

iframe_footer();

[52] Fix | Delete

[53] Fix | Delete

} elseif ( 'upgrade-plugin' === $action ) {

[54] Fix | Delete

if ( ! current_user_can( 'update_plugins' ) ) {

[55] Fix | Delete

wp_die( __( 'Sorry, you are not allowed to update plugins for this site.' ) );

[56] Fix | Delete

}

[57] Fix | Delete

[58] Fix | Delete

check_admin_referer( 'upgrade-plugin_' . $plugin );

[59] Fix | Delete

[60] Fix | Delete

$title = __( 'Update Plugin' );

[61] Fix | Delete

$parent_file = 'plugins.php';

[62] Fix | Delete

$submenu_file = 'plugins.php';

[63] Fix | Delete

[64] Fix | Delete

wp_enqueue_script( 'updates' );

[65] Fix | Delete

require_once ABSPATH . 'wp-admin/admin-header.php';

[66] Fix | Delete

[67] Fix | Delete

$nonce = 'upgrade-plugin_' . $plugin;

[68] Fix | Delete

$url = 'update.php?action=upgrade-plugin&plugin=' . urlencode( $plugin );

[69] Fix | Delete

[70] Fix | Delete

$upgrader = new Plugin_Upgrader( new Plugin_Upgrader_Skin( compact( 'title', 'nonce', 'url', 'plugin' ) ) );

[71] Fix | Delete

$upgrader->upgrade( $plugin );

[72] Fix | Delete

[73] Fix | Delete

require_once ABSPATH . 'wp-admin/admin-footer.php';

[74] Fix | Delete

[75] Fix | Delete

} elseif ( 'activate-plugin' === $action ) {

[76] Fix | Delete

if ( ! current_user_can( 'update_plugins' ) ) {

[77] Fix | Delete

wp_die( __( 'Sorry, you are not allowed to update plugins for this site.' ) );

[78] Fix | Delete

}

[79] Fix | Delete

[80] Fix | Delete

check_admin_referer( 'activate-plugin_' . $plugin );

[81] Fix | Delete

if ( ! isset( $_GET['failure'] ) && ! isset( $_GET['success'] ) ) {

[82] Fix | Delete

wp_redirect( admin_url( 'update.php?action=activate-plugin&failure=true&plugin=' . urlencode( $plugin ) . '&_wpnonce=' . $_GET['_wpnonce'] ) );

[83] Fix | Delete

activate_plugin( $plugin, '', ! empty( $_GET['networkwide'] ), true );

[84] Fix | Delete

wp_redirect( admin_url( 'update.php?action=activate-plugin&success=true&plugin=' . urlencode( $plugin ) . '&_wpnonce=' . $_GET['_wpnonce'] ) );

[85] Fix | Delete

die();

[86] Fix | Delete

}

[87] Fix | Delete

iframe_header( __( 'Plugin Reactivation' ), true );

[88] Fix | Delete

if ( isset( $_GET['success'] ) ) {

[89] Fix | Delete

echo '<p>' . __( 'Plugin reactivated successfully.' ) . '</p>';

[90] Fix | Delete

}

[91] Fix | Delete

[92] Fix | Delete

if ( isset( $_GET['failure'] ) ) {

[93] Fix | Delete

echo '<p>' . __( 'Plugin failed to reactivate due to a fatal error.' ) . '</p>';

[94] Fix | Delete

[95] Fix | Delete

[96] Fix | Delete

ini_set( 'display_errors', true ); // Ensure that fatal errors are displayed.

[97] Fix | Delete

wp_register_plugin_realpath( WP_PLUGIN_DIR . '/' . $plugin );

[98] Fix | Delete

include WP_PLUGIN_DIR . '/' . $plugin;

[99] Fix | Delete

}

[100] Fix | Delete

iframe_footer();

[101] Fix | Delete

} elseif ( 'install-plugin' === $action ) {

[102] Fix | Delete

[103] Fix | Delete

if ( ! current_user_can( 'install_plugins' ) ) {

[104] Fix | Delete

wp_die( __( 'Sorry, you are not allowed to install plugins on this site.' ) );

[105] Fix | Delete

}

[106] Fix | Delete

[107] Fix | Delete

include_once ABSPATH . 'wp-admin/includes/plugin-install.php'; // For plugins_api().

[108] Fix | Delete

[109] Fix | Delete

check_admin_referer( 'install-plugin_' . $plugin );

[110] Fix | Delete

$api = plugins_api(

[111] Fix | Delete

'plugin_information',

[112] Fix | Delete

array(

[113] Fix | Delete

'slug' => $plugin,

[114] Fix | Delete

'fields' => array(

[115] Fix | Delete

'sections' => false,

[116] Fix | Delete

[117] Fix | Delete

)

[118] Fix | Delete

);

[119] Fix | Delete

[120] Fix | Delete

if ( is_wp_error( $api ) ) {

[121] Fix | Delete

wp_die( $api );

[122] Fix | Delete

}

[123] Fix | Delete

[124] Fix | Delete

$title = __( 'Plugin Installation' );

[125] Fix | Delete

$parent_file = 'plugins.php';

[126] Fix | Delete

$submenu_file = 'plugin-install.php';

[127] Fix | Delete

require_once ABSPATH . 'wp-admin/admin-header.php';

[128] Fix | Delete

[129] Fix | Delete

/* translators: %s: Plugin name and version. */

[130] Fix | Delete

$title = sprintf( __( 'Installing Plugin: %s' ), $api->name . ' ' . $api->version );

[131] Fix | Delete

$nonce = 'install-plugin_' . $plugin;

[132] Fix | Delete

$url = 'update.php?action=install-plugin&plugin=' . urlencode( $plugin );

[133] Fix | Delete

if ( isset( $_GET['from'] ) ) {

[134] Fix | Delete

$url .= '&from=' . urlencode( stripslashes( $_GET['from'] ) );

[135] Fix | Delete

}

[136] Fix | Delete

[137] Fix | Delete

$type = 'web'; // Install plugin type, From Web or an Upload.

[138] Fix | Delete

[139] Fix | Delete

$upgrader = new Plugin_Upgrader( new Plugin_Installer_Skin( compact( 'title', 'url', 'nonce', 'plugin', 'api' ) ) );

[140] Fix | Delete

$upgrader->install( $api->download_link );

[141] Fix | Delete

[142] Fix | Delete

require_once ABSPATH . 'wp-admin/admin-footer.php';

[143] Fix | Delete

[144] Fix | Delete

} elseif ( 'upload-plugin' === $action ) {

[145] Fix | Delete

[146] Fix | Delete

if ( ! current_user_can( 'upload_plugins' ) ) {

[147] Fix | Delete

wp_die( __( 'Sorry, you are not allowed to install plugins on this site.' ) );

[148] Fix | Delete

}

[149] Fix | Delete

[150] Fix | Delete

check_admin_referer( 'plugin-upload' );

[151] Fix | Delete

[152] Fix | Delete

if ( isset( $_FILES['pluginzip']['name'] ) && ! str_ends_with( strtolower( $_FILES['pluginzip']['name'] ), '.zip' ) ) {

[153] Fix | Delete

wp_die( __( 'Only .zip archives may be uploaded.' ) );

[154] Fix | Delete

}

[155] Fix | Delete

[156] Fix | Delete

$file_upload = new File_Upload_Upgrader( 'pluginzip', 'package' );

[157] Fix | Delete

[158] Fix | Delete

$title = __( 'Upload Plugin' );

[159] Fix | Delete

$parent_file = 'plugins.php';

[160] Fix | Delete

$submenu_file = 'plugin-install.php';

[161] Fix | Delete

require_once ABSPATH . 'wp-admin/admin-header.php';

[162] Fix | Delete

[163] Fix | Delete

/* translators: %s: File name. */

[164] Fix | Delete

$title = sprintf( __( 'Installing plugin from uploaded file: %s' ), esc_html( basename( $file_upload->filename ) ) );

[165] Fix | Delete

$nonce = 'plugin-upload';

[166] Fix | Delete

$url = add_query_arg( array( 'package' => $file_upload->id ), 'update.php?action=upload-plugin' );

[167] Fix | Delete

$type = 'upload'; // Install plugin type, From Web or an Upload.

[168] Fix | Delete

[169] Fix | Delete

$overwrite = isset( $_GET['overwrite'] ) ? sanitize_text_field( $_GET['overwrite'] ) : '';

[170] Fix | Delete

$overwrite = in_array( $overwrite, array( 'update-plugin', 'downgrade-plugin' ), true ) ? $overwrite : '';

[171] Fix | Delete

[172] Fix | Delete

$upgrader = new Plugin_Upgrader( new Plugin_Installer_Skin( compact( 'type', 'title', 'nonce', 'url', 'overwrite' ) ) );

[173] Fix | Delete

$result = $upgrader->install( $file_upload->package, array( 'overwrite_package' => $overwrite ) );

[174] Fix | Delete

[175] Fix | Delete

if ( $result || is_wp_error( $result ) ) {

[176] Fix | Delete

$file_upload->cleanup();

[177] Fix | Delete

}

[178] Fix | Delete

[179] Fix | Delete

require_once ABSPATH . 'wp-admin/admin-footer.php';

[180] Fix | Delete

[181] Fix | Delete

} elseif ( 'upload-plugin-cancel-overwrite' === $action ) {

[182] Fix | Delete

if ( ! current_user_can( 'upload_plugins' ) ) {

[183] Fix | Delete

wp_die( __( 'Sorry, you are not allowed to install plugins on this site.' ) );

[184] Fix | Delete

}

[185] Fix | Delete

[186] Fix | Delete

check_admin_referer( 'plugin-upload-cancel-overwrite' );

[187] Fix | Delete

[188] Fix | Delete

// Make sure the attachment still exists, or File_Upload_Upgrader will call wp_die()

[189] Fix | Delete

// that shows a generic "Please select a file" error.

[190] Fix | Delete

if ( ! empty( $_GET['package'] ) ) {

[191] Fix | Delete

$attachment_id = (int) $_GET['package'];

[192] Fix | Delete

[193] Fix | Delete

if ( get_post( $attachment_id ) ) {

[194] Fix | Delete

$file_upload = new File_Upload_Upgrader( 'pluginzip', 'package' );

[195] Fix | Delete

$file_upload->cleanup();

[196] Fix | Delete

}

[197] Fix | Delete

}

[198] Fix | Delete

[199] Fix | Delete

wp_redirect( self_admin_url( 'plugin-install.php' ) );

[200] Fix | Delete

exit;

[201] Fix | Delete

} elseif ( 'upgrade-theme' === $action ) {

[202] Fix | Delete

[203] Fix | Delete

if ( ! current_user_can( 'update_themes' ) ) {

[204] Fix | Delete

wp_die( __( 'Sorry, you are not allowed to update themes for this site.' ) );

[205] Fix | Delete

}

[206] Fix | Delete

[207] Fix | Delete

check_admin_referer( 'upgrade-theme_' . $theme );

[208] Fix | Delete

[209] Fix | Delete

wp_enqueue_script( 'updates' );

[210] Fix | Delete

[211] Fix | Delete

$title = __( 'Update Theme' );

[212] Fix | Delete

$parent_file = 'themes.php';

[213] Fix | Delete

$submenu_file = 'themes.php';

[214] Fix | Delete

require_once ABSPATH . 'wp-admin/admin-header.php';

[215] Fix | Delete

[216] Fix | Delete

$nonce = 'upgrade-theme_' . $theme;

[217] Fix | Delete

$url = 'update.php?action=upgrade-theme&theme=' . urlencode( $theme );

[218] Fix | Delete

[219] Fix | Delete

$upgrader = new Theme_Upgrader( new Theme_Upgrader_Skin( compact( 'title', 'nonce', 'url', 'theme' ) ) );

[220] Fix | Delete

$upgrader->upgrade( $theme );

[221] Fix | Delete

[222] Fix | Delete

require_once ABSPATH . 'wp-admin/admin-footer.php';

[223] Fix | Delete

} elseif ( 'update-selected-themes' === $action ) {

[224] Fix | Delete

if ( ! current_user_can( 'update_themes' ) ) {

[225] Fix | Delete

wp_die( __( 'Sorry, you are not allowed to update themes for this site.' ) );

[226] Fix | Delete

}

[227] Fix | Delete

[228] Fix | Delete

check_admin_referer( 'bulk-update-themes' );

[229] Fix | Delete

[230] Fix | Delete

if ( isset( $_GET['themes'] ) ) {

[231] Fix | Delete

$themes = explode( ',', stripslashes( $_GET['themes'] ) );

[232] Fix | Delete

} elseif ( isset( $_POST['checked'] ) ) {

[233] Fix | Delete

$themes = (array) $_POST['checked'];

[234] Fix | Delete

} else {

[235] Fix | Delete

$themes = array();

[236] Fix | Delete

}

[237] Fix | Delete

[238] Fix | Delete

$themes = array_map( 'urldecode', $themes );

[239] Fix | Delete

[240] Fix | Delete

$url = 'update.php?action=update-selected-themes&themes=' . urlencode( implode( ',', $themes ) );

[241] Fix | Delete

$nonce = 'bulk-update-themes';

[242] Fix | Delete

[243] Fix | Delete

wp_enqueue_script( 'updates' );

[244] Fix | Delete

iframe_header();

[245] Fix | Delete

[246] Fix | Delete

$upgrader = new Theme_Upgrader( new Bulk_Theme_Upgrader_Skin( compact( 'nonce', 'url' ) ) );

[247] Fix | Delete

$upgrader->bulk_upgrade( $themes );

[248] Fix | Delete

[249] Fix | Delete

iframe_footer();

[250] Fix | Delete

} elseif ( 'install-theme' === $action ) {

[251] Fix | Delete

[252] Fix | Delete

if ( ! current_user_can( 'install_themes' ) ) {

[253] Fix | Delete

wp_die( __( 'Sorry, you are not allowed to install themes on this site.' ) );

[254] Fix | Delete

}

[255] Fix | Delete

[256] Fix | Delete

include_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php'; // For themes_api().

[257] Fix | Delete

[258] Fix | Delete

check_admin_referer( 'install-theme_' . $theme );

[259] Fix | Delete

$api = themes_api(

[260] Fix | Delete

'theme_information',

[261] Fix | Delete

array(

[262] Fix | Delete

'slug' => $theme,

[263] Fix | Delete

'fields' => array(

[264] Fix | Delete

'sections' => false,

[265] Fix | Delete

'tags' => false,

[266] Fix | Delete

[267] Fix | Delete

)

[268] Fix | Delete

); // Save on a bit of bandwidth.

[269] Fix | Delete

[270] Fix | Delete

if ( is_wp_error( $api ) ) {

[271] Fix | Delete

wp_die( $api );

[272] Fix | Delete

}

[273] Fix | Delete

[274] Fix | Delete

$title = __( 'Install Themes' );

[275] Fix | Delete

$parent_file = 'themes.php';

[276] Fix | Delete

$submenu_file = 'themes.php';

[277] Fix | Delete

require_once ABSPATH . 'wp-admin/admin-header.php';

[278] Fix | Delete

[279] Fix | Delete

/* translators: %s: Theme name and version. */

[280] Fix | Delete

$title = sprintf( __( 'Installing Theme: %s' ), $api->name . ' ' . $api->version );

[281] Fix | Delete

$nonce = 'install-theme_' . $theme;

[282] Fix | Delete

$url = 'update.php?action=install-theme&theme=' . urlencode( $theme );

[283] Fix | Delete

$type = 'web'; // Install theme type, From Web or an Upload.

[284] Fix | Delete

[285] Fix | Delete

$upgrader = new Theme_Upgrader( new Theme_Installer_Skin( compact( 'title', 'url', 'nonce', 'plugin', 'api' ) ) );

[286] Fix | Delete

$upgrader->install( $api->download_link );

[287] Fix | Delete

[288] Fix | Delete

require_once ABSPATH . 'wp-admin/admin-footer.php';

[289] Fix | Delete

[290] Fix | Delete

} elseif ( 'upload-theme' === $action ) {

[291] Fix | Delete

[292] Fix | Delete

if ( ! current_user_can( 'upload_themes' ) ) {

[293] Fix | Delete

wp_die( __( 'Sorry, you are not allowed to install themes on this site.' ) );

[294] Fix | Delete

}

[295] Fix | Delete

[296] Fix | Delete

check_admin_referer( 'theme-upload' );

[297] Fix | Delete

[298] Fix | Delete

if ( isset( $_FILES['themezip']['name'] ) && ! str_ends_with( strtolower( $_FILES['themezip']['name'] ), '.zip' ) ) {

[299] Fix | Delete

wp_die( __( 'Only .zip archives may be uploaded.' ) );

[300] Fix | Delete

}

[301] Fix | Delete

[302] Fix | Delete

$file_upload = new File_Upload_Upgrader( 'themezip', 'package' );

[303] Fix | Delete

[304] Fix | Delete

$title = __( 'Upload Theme' );

[305] Fix | Delete

$parent_file = 'themes.php';

[306] Fix | Delete

$submenu_file = 'theme-install.php';

[307] Fix | Delete

[308] Fix | Delete

require_once ABSPATH . 'wp-admin/admin-header.php';

[309] Fix | Delete

[310] Fix | Delete

/* translators: %s: File name. */

[311] Fix | Delete

$title = sprintf( __( 'Installing theme from uploaded file: %s' ), esc_html( basename( $file_upload->filename ) ) );

[312] Fix | Delete

$nonce = 'theme-upload';

[313] Fix | Delete

$url = add_query_arg( array( 'package' => $file_upload->id ), 'update.php?action=upload-theme' );

[314] Fix | Delete

$type = 'upload'; // Install theme type, From Web or an Upload.

[315] Fix | Delete

[316] Fix | Delete

$overwrite = isset( $_GET['overwrite'] ) ? sanitize_text_field( $_GET['overwrite'] ) : '';

[317] Fix | Delete

$overwrite = in_array( $overwrite, array( 'update-theme', 'downgrade-theme' ), true ) ? $overwrite : '';

[318] Fix | Delete

[319] Fix | Delete

$upgrader = new Theme_Upgrader( new Theme_Installer_Skin( compact( 'type', 'title', 'nonce', 'url', 'overwrite' ) ) );

[320] Fix | Delete

$result = $upgrader->install( $file_upload->package, array( 'overwrite_package' => $overwrite ) );

[321] Fix | Delete

[322] Fix | Delete

if ( $result || is_wp_error( $result ) ) {

[323] Fix | Delete

$file_upload->cleanup();

[324] Fix | Delete

}

[325] Fix | Delete

[326] Fix | Delete

require_once ABSPATH . 'wp-admin/admin-footer.php';

[327] Fix | Delete

[328] Fix | Delete

} elseif ( 'upload-theme-cancel-overwrite' === $action ) {

[329] Fix | Delete

if ( ! current_user_can( 'upload_themes' ) ) {

[330] Fix | Delete

wp_die( __( 'Sorry, you are not allowed to install themes on this site.' ) );

[331] Fix | Delete

}

[332] Fix | Delete

[333] Fix | Delete

check_admin_referer( 'theme-upload-cancel-overwrite' );

[334] Fix | Delete

[335] Fix | Delete

// Make sure the attachment still exists, or File_Upload_Upgrader will call wp_die()

[336] Fix | Delete

// that shows a generic "Please select a file" error.

[337] Fix | Delete

if ( ! empty( $_GET['package'] ) ) {

[338] Fix | Delete

$attachment_id = (int) $_GET['package'];

[339] Fix | Delete

[340] Fix | Delete

if ( get_post( $attachment_id ) ) {

[341] Fix | Delete

$file_upload = new File_Upload_Upgrader( 'themezip', 'package' );

[342] Fix | Delete

$file_upload->cleanup();

[343] Fix | Delete

}

[344] Fix | Delete

}

[345] Fix | Delete

[346] Fix | Delete

wp_redirect( self_admin_url( 'theme-install.php' ) );

[347] Fix | Delete

exit;

[348] Fix | Delete

} else {

[349] Fix | Delete

/**

[350] Fix | Delete

* Fires when a custom plugin or theme update request is received.

[351] Fix | Delete

[352] Fix | Delete

* The dynamic portion of the hook name, `$action`, refers to the action

[353] Fix | Delete

* provided in the request for wp-admin/update.php. Can be used to

[354] Fix | Delete

* provide custom update functionality for themes and plugins.

[355] Fix | Delete

[356] Fix | Delete

* @since 2.8.0

[357] Fix | Delete

[358] Fix | Delete

do_action( "update-custom_{$action}" ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores

[359] Fix | Delete

}

[360] Fix | Delete

}

[361] Fix | Delete

[362] Fix | Delete