1<?php
2/**
3 * Class for testing automatic updates in the WordPress code.
4 *
5 * @package WordPress
6 * @subpackage Site_Health
7 * @since 5.2.0
8 */
9
10#[AllowDynamicProperties]
11class WP_Site_Health_Auto_Updates {
12 /**
13 * WP_Site_Health_Auto_Updates constructor.
14 *
15 * @since 5.2.0
16 */
17 public function __construct() {
18 require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
19 }
20
21
22 /**
23 * Runs tests to determine if auto-updates can run.
24 *
25 * @since 5.2.0
26 *
27 * @return array The test results.
28 */
29 public function run_tests() {
30 $tests = array(
31 $this->test_constants( 'WP_AUTO_UPDATE_CORE', array( true, 'beta', 'rc', 'development', 'branch-development', 'minor' ) ),
32 $this->test_wp_version_check_attached(),
33 $this->test_filters_automatic_updater_disabled(),
34 $this->test_wp_automatic_updates_disabled(),
35 $this->test_if_failed_update(),
36 $this->test_vcs_abspath(),
37 $this->test_check_wp_filesystem_method(),
38 $this->test_all_files_writable(),
39 $this->test_accepts_dev_updates(),
40 $this->test_accepts_minor_updates(),
41 );
42
43 $tests = array_filter( $tests );
44 $tests = array_map(
45 static function ( $test ) {
46 $test = (object) $test;
47
48 if ( empty( $test->severity ) ) {
49 $test->severity = 'warning';
50 }
51
52 return $test;
53 },
54 $tests
55 );
56
57 return $tests;
58 }
59
60 /**
61 * Tests if auto-updates related constants are set correctly.
62 *
63 * @since 5.2.0
64 * @since 5.5.1 The `$value` parameter can accept an array.
65 *
66 * @param string $constant The name of the constant to check.
67 * @param bool|string|array $value The value that the constant should be, if set,
68 * or an array of acceptable values.
69 * @return array|null The test results if there are any constants set incorrectly,
70 * or null if the test passed.
71 */
72 public function test_constants( $constant, $value ) {
73 $acceptable_values = (array) $value;
74
75 if ( defined( $constant ) && ! in_array( constant( $constant ), $acceptable_values, true ) ) {
76 return array(
77 'description' => sprintf(
78 /* translators: 1: Name of the constant used. 2: Value of the constant used. */
79 __( 'The %1$s constant is defined as %2$s' ),
80 "<code>$constant</code>",
81 '<code>' . esc_html( var_export( constant( $constant ), true ) ) . '</code>'
82 ),
83 'severity' => 'fail',
84 );
85 }
86
87 return null;
88 }
89
90 /**
91 * Checks if updates are intercepted by a filter.
92 *
93 * @since 5.2.0
94 *
95 * @return array|null The test results if wp_version_check() is disabled,
96 * or null if the test passed.
97 */
98 public function test_wp_version_check_attached() {
99 if ( ( ! is_multisite() || is_main_site() && is_network_admin() )
100 && ! has_filter( 'wp_version_check', 'wp_version_check' )
101 ) {
102 return array(
103 'description' => sprintf(
104 /* translators: %s: Name of the filter used. */
105 __( 'A plugin has prevented updates by disabling %s.' ),
106 '<code>wp_version_check()</code>'
107 ),
108 'severity' => 'fail',
109 );
110 }
111
112 return null;
113 }
114
115 /**
116 * Checks if automatic updates are disabled by a filter.
117 *
118 * @since 5.2.0
119 *
120 * @return array|null The test results if the {@see 'automatic_updater_disabled'} filter is set,
121 * or null if the test passed.
122 */
123 public function test_filters_automatic_updater_disabled() {
124 /** This filter is documented in wp-admin/includes/class-wp-automatic-updater.php */
125 if ( apply_filters( 'automatic_updater_disabled', false ) ) {
126 return array(
127 'description' => sprintf(
128 /* translators: %s: Name of the filter used. */
129 __( 'The %s filter is enabled.' ),
130 '<code>automatic_updater_disabled</code>'
131 ),
132 'severity' => 'fail',
133 );
134 }
135
136 return null;
137 }
138
139 /**
140 * Checks if automatic updates are disabled.
141 *
142 * @since 5.3.0
143 *
144 * @return array|false The test results if auto-updates are disabled, false otherwise.
145 */
146 public function test_wp_automatic_updates_disabled() {
147 if ( ! class_exists( 'WP_Automatic_Updater' ) ) {
148 require_once ABSPATH . 'wp-admin/includes/class-wp-automatic-updater.php';
149 }
150
151 $auto_updates = new WP_Automatic_Updater();
152
153 if ( ! $auto_updates->is_disabled() ) {
154 return false;
155 }
156
157 return array(
158 'description' => __( 'All automatic updates are disabled.' ),
159 'severity' => 'fail',
160 );
161 }
162
163 /**
164 * Checks if automatic updates have tried to run, but failed, previously.
165 *
166 * @since 5.2.0
167 *
168 * @return array|false The test results if auto-updates previously failed, false otherwise.
169 */
170 public function test_if_failed_update() {
171 $failed = get_site_option( 'auto_core_update_failed' );
172
173 if ( ! $failed ) {
174 return false;
175 }
176
177 if ( ! empty( $failed['critical'] ) ) {
178 $description = __( 'A previous automatic background update ended with a critical failure, so updates are now disabled.' );
179 $description .= ' ' . __( 'You would have received an email because of this.' );
180 $description .= ' ' . __( "When you've been able to update using the \"Update now\" button on Dashboard > Updates, this error will be cleared for future update attempts." );
181 $description .= ' ' . sprintf(
182 /* translators: %s: Code of error shown. */
183 __( 'The error code was %s.' ),
184 '<code>' . $failed['error_code'] . '</code>'
185 );
186 return array(
187 'description' => $description,
188 'severity' => 'warning',
189 );
190 }
191
192 $description = __( 'A previous automatic background update could not occur.' );
193 if ( empty( $failed['retry'] ) ) {
194 $description .= ' ' . __( 'You would have received an email because of this.' );
195 }
196
197 $description .= ' ' . __( 'Another attempt will be made with the next release.' );
198 $description .= ' ' . sprintf(
199 /* translators: %s: Code of error shown. */
200 __( 'The error code was %s.' ),
201 '<code>' . $failed['error_code'] . '</code>'
202 );
203 return array(
204 'description' => $description,
205 'severity' => 'warning',
206 );
207 }
208
209 /**
210 * Checks if WordPress is controlled by a VCS (Git, Subversion etc).
211 *
212 * @since 5.2.0
213 *
214 * @return array The test results.
215 */
216 public function test_vcs_abspath() {
217 $context_dirs = array( ABSPATH );
218 $vcs_dirs = array( '.svn', '.git', '.hg', '.bzr' );
219 $check_dirs = array();
220
221 foreach ( $context_dirs as $context_dir ) {
222 // Walk up from $context_dir to the root.
223 do {
224 $check_dirs[] = $context_dir;
225
226 // Once we've hit '/' or 'C:\', we need to stop. dirname will keep returning the input here.
227 if ( dirname( $context_dir ) === $context_dir ) {
228 break;
229 }
230
231 // Continue one level at a time.
232 } while ( $context_dir = dirname( $context_dir ) );
233 }
234
235 $check_dirs = array_unique( $check_dirs );
236 $updater = new WP_Automatic_Updater();
237 $checkout = false;
238
239 // Search all directories we've found for evidence of version control.
240 foreach ( $vcs_dirs as $vcs_dir ) {
241 foreach ( $check_dirs as $check_dir ) {
242 if ( ! $updater->is_allowed_dir( $check_dir ) ) {
243 continue;
244 }
245
246 $checkout = is_dir( rtrim( $check_dir, '\\/' ) . "/$vcs_dir" );
247 if ( $checkout ) {
248 break 2;
249 }
250 }
251 }
252
253 /** This filter is documented in wp-admin/includes/class-wp-automatic-updater.php */
254 if ( $checkout && ! apply_filters( 'automatic_updates_is_vcs_checkout', true, ABSPATH ) ) {
255 return array(
256 'description' => sprintf(
257 /* translators: 1: Folder name. 2: Version control directory. 3: Filter name. */
258 __( 'The folder %1$s was detected as being under version control (%2$s), but the %3$s filter is allowing updates.' ),
259 '<code>' . $check_dir . '</code>',
260 "<code>$vcs_dir</code>",
261 '<code>automatic_updates_is_vcs_checkout</code>'
262 ),
263 'severity' => 'info',
264 );
265 }
266
267 if ( $checkout ) {
268 return array(
269 'description' => sprintf(
270 /* translators: 1: Folder name. 2: Version control directory. */
271 __( 'The folder %1$s was detected as being under version control (%2$s).' ),
272 '<code>' . $check_dir . '</code>',
273 "<code>$vcs_dir</code>"
274 ),
275 'severity' => 'warning',
276 );
277 }
278
279 return array(
280 'description' => __( 'No version control systems were detected.' ),
281 'severity' => 'pass',
282 );
283 }
284
285 /**
286 * Checks if we can access files without providing credentials.
287 *
288 * @since 5.2.0
289 *
290 * @return array The test results.
291 */
292 public function test_check_wp_filesystem_method() {
293 // Make sure the `request_filesystem_credentials()` function is available during our REST API call.
294 if ( ! function_exists( 'request_filesystem_credentials' ) ) {
295 require_once ABSPATH . 'wp-admin/includes/file.php';
296 }
297
298 $skin = new Automatic_Upgrader_Skin();
299 $success = $skin->request_filesystem_credentials( false, ABSPATH );
300
301 if ( ! $success ) {
302 $description = __( 'Your installation of WordPress prompts for FTP credentials to perform updates.' );
303 $description .= ' ' . __( '(Your site is performing updates over FTP due to file ownership. Talk to your hosting company.)' );
304
305 return array(
306 'description' => $description,
307 'severity' => 'fail',
308 );
309 }
310
311 return array(
312 'description' => __( 'Your installation of WordPress does not require FTP credentials to perform updates.' ),
313 'severity' => 'pass',
314 );
315 }
316
317 /**
318 * Checks if core files are writable by the web user/group.
319 *
320 * @since 5.2.0
321 *
322 * @global WP_Filesystem_Base $wp_filesystem WordPress filesystem subclass.
323 *
324 * @return array|false The test results if at least some of WordPress core files are writeable,
325 * or if a list of the checksums could not be retrieved from WordPress.org.
326 * False if the core files are not writeable.
327 */
328 public function test_all_files_writable() {
329 global $wp_filesystem;
330
331 require ABSPATH . WPINC . '/version.php'; // $wp_version; // x.y.z
332
333 $skin = new Automatic_Upgrader_Skin();
334 $success = $skin->request_filesystem_credentials( false, ABSPATH );
335
336 if ( ! $success ) {
337 return false;
338 }
339
340 WP_Filesystem();
341
342 if ( 'direct' !== $wp_filesystem->method ) {
343 return false;
344 }
345
346 // Make sure the `get_core_checksums()` function is available during our REST API call.
347 if ( ! function_exists( 'get_core_checksums' ) ) {
348 require_once ABSPATH . 'wp-admin/includes/update.php';
349 }
350
351 $checksums = get_core_checksums( $wp_version, 'en_US' );
352 $dev = ( str_contains( $wp_version, '-' ) );
353 // Get the last stable version's files and test against that.
354 if ( ! $checksums && $dev ) {
355 $checksums = get_core_checksums( (float) $wp_version - 0.1, 'en_US' );
356 }
357
358 // There aren't always checksums for development releases, so just skip the test if we still can't find any.
359 if ( ! $checksums && $dev ) {
360 return false;
361 }
362
363 if ( ! $checksums ) {
364 $description = sprintf(
365 /* translators: %s: WordPress version. */
366 __( "Couldn't retrieve a list of the checksums for WordPress %s." ),
367 $wp_version
368 );
369 $description .= ' ' . __( 'This could mean that connections are failing to WordPress.org.' );
370 return array(
371 'description' => $description,
372 'severity' => 'warning',
373 );
374 }
375
376 $unwritable_files = array();
377 foreach ( array_keys( $checksums ) as $file ) {
378 if ( str_starts_with( $file, 'wp-content' ) ) {
379 continue;
380 }
381 if ( ! file_exists( ABSPATH . $file ) ) {
382 continue;
383 }
384 if ( ! is_writable( ABSPATH . $file ) ) {
385 $unwritable_files[] = $file;
386 }
387 }
388
389 if ( $unwritable_files ) {
390 if ( count( $unwritable_files ) > 20 ) {
391 $unwritable_files = array_slice( $unwritable_files, 0, 20 );
392 $unwritable_files[] = '...';
393 }
394 return array(
395 'description' => __( 'Some files are not writable by WordPress:' ) . ' <ul><li>' . implode( '</li><li>', $unwritable_files ) . '</li></ul>',
396 'severity' => 'fail',
397 );
398 } else {
399 return array(
400 'description' => __( 'All of your WordPress files are writable.' ),
401 'severity' => 'pass',
402 );
403 }
404 }
405
406 /**
407 * Checks if the install is using a development branch and can use nightly packages.
408 *
409 * @since 5.2.0
410 *
411 * @return array|false|null The test results if development updates are blocked.
412 * False if it isn't a development version. Null if the test passed.
413 */
414 public function test_accepts_dev_updates() {
415 require ABSPATH . WPINC . '/version.php'; // $wp_version; // x.y.z
416 // Only for dev versions.
417 if ( ! str_contains( $wp_version, '-' ) ) {
418 return false;
419 }
420
421 if ( defined( 'WP_AUTO_UPDATE_CORE' ) && ( 'minor' === WP_AUTO_UPDATE_CORE || false === WP_AUTO_UPDATE_CORE ) ) {
422 return array(
423 'description' => sprintf(
424 /* translators: %s: Name of the constant used. */
425 __( 'WordPress development updates are blocked by the %s constant.' ),
426 '<code>WP_AUTO_UPDATE_CORE</code>'
427 ),
428 'severity' => 'fail',
429 );
430 }
431
432 /** This filter is documented in wp-admin/includes/class-core-upgrader.php */
433 if ( ! apply_filters( 'allow_dev_auto_core_updates', $wp_version ) ) {
434 return array(
435 'description' => sprintf(
436 /* translators: %s: Name of the filter used. */
437 __( 'WordPress development updates are blocked by the %s filter.' ),
438 '<code>allow_dev_auto_core_updates</code>'
439 ),
440 'severity' => 'fail',
441 );
442 }
443
444 return null;
445 }
446
447 /**
448 * Checks if the site supports automatic minor updates.
449 *
450 * @since 5.2.0
451 *
452 * @return array|null The test results if minor updates are blocked,
453 * or null if the test passed.
454 */
455 public function test_accepts_minor_updates() {
456 if ( defined( 'WP_AUTO_UPDATE_CORE' ) && false === WP_AUTO_UPDATE_CORE ) {
457 return array(
458 'description' => sprintf(
459 /* translators: %s: Name of the constant used. */
460 __( 'WordPress security and maintenance releases are blocked by %s.' ),
461 "<code>define( 'WP_AUTO_UPDATE_CORE', false );</code>"
462 ),
463 'severity' => 'fail',
464 );
465 }
466
467 /** This filter is documented in wp-admin/includes/class-core-upgrader.php */
468 if ( ! apply_filters( 'allow_minor_auto_core_updates', true ) ) {
469 return array(
470 'description' => sprintf(
471 /* translators: %s: Name of the filter used. */
472 __( 'WordPress security and maintenance releases are blocked by the %s filter.' ),
473 '<code>allow_minor_auto_core_updates</code>'
474 ),
475 'severity' => 'fail',
476 );
477 }
478
479 return null;
480 }
481}
482