1<?php
2/**
3 * Update/Install Plugin/Theme administration panel.
4 *
5 * @package WordPress
6 * @subpackage Administration
7 */
8
9if ( ! defined( 'IFRAME_REQUEST' )
10 && isset( $_GET['action'] ) && in_array( $_GET['action'], array( 'update-selected', 'activate-plugin', 'update-selected-themes' ), true )
11) {
12 define( 'IFRAME_REQUEST', true );
13}
14
15/** WordPress Administration Bootstrap */
16require_once __DIR__ . '/admin.php';
17
18require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php';
19
20wp_enqueue_script( 'wp-a11y' );
21
22if ( isset( $_GET['action'] ) ) {
23 $plugin = isset( $_REQUEST['plugin'] ) ? trim( $_REQUEST['plugin'] ) : '';
24 $theme = isset( $_REQUEST['theme'] ) ? urldecode( $_REQUEST['theme'] ) : '';
25 $action = isset( $_REQUEST['action'] ) ? $_REQUEST['action'] : '';
26
27 if ( 'update-selected' === $action ) {
28 if ( ! current_user_can( 'update_plugins' ) ) {
29 wp_die( __( 'Sorry, you are not allowed to update plugins for this site.' ) );
30 }
31
32 check_admin_referer( 'bulk-update-plugins' );
33
34 if ( isset( $_GET['plugins'] ) ) {
35 $plugins = explode( ',', stripslashes( $_GET['plugins'] ) );
36 } elseif ( isset( $_POST['checked'] ) ) {
37 $plugins = (array) $_POST['checked'];
38 } else {
39 $plugins = array();
40 }
41
42 $plugins = array_map( 'urldecode', $plugins );
43
44 $url = 'update.php?action=update-selected&plugins=' . urlencode( implode( ',', $plugins ) );
45 $nonce = 'bulk-update-plugins';
46
47 wp_enqueue_script( 'updates' );
48 iframe_header();
49
50 $upgrader = new Plugin_Upgrader( new Bulk_Plugin_Upgrader_Skin( compact( 'nonce', 'url' ) ) );
51 $upgrader->bulk_upgrade( $plugins );
52
53 iframe_footer();
54
55 } elseif ( 'upgrade-plugin' === $action ) {
56 if ( ! current_user_can( 'update_plugins' ) ) {
57 wp_die( __( 'Sorry, you are not allowed to update plugins for this site.' ) );
58 }
59
60 check_admin_referer( 'upgrade-plugin_' . $plugin );
61
62 // Used in the HTML title tag.
63 $title = __( 'Update Plugin' );
64 $parent_file = 'plugins.php';
65 $submenu_file = 'plugins.php';
66
67 wp_enqueue_script( 'updates' );
68 require_once ABSPATH . 'wp-admin/admin-header.php';
69
70 $nonce = 'upgrade-plugin_' . $plugin;
71 $url = 'update.php?action=upgrade-plugin&plugin=' . urlencode( $plugin );
72
73 $upgrader = new Plugin_Upgrader( new Plugin_Upgrader_Skin( compact( 'title', 'nonce', 'url', 'plugin' ) ) );
74 $upgrader->upgrade( $plugin );
75
76 require_once ABSPATH . 'wp-admin/admin-footer.php';
77
78 } elseif ( 'activate-plugin' === $action ) {
79 if ( ! current_user_can( 'update_plugins' ) ) {
80 wp_die( __( 'Sorry, you are not allowed to update plugins for this site.' ) );
81 }
82
83 check_admin_referer( 'activate-plugin_' . $plugin );
84 if ( ! isset( $_GET['failure'] ) && ! isset( $_GET['success'] ) ) {
85 wp_redirect( admin_url( 'update.php?action=activate-plugin&failure=true&plugin=' . urlencode( $plugin ) . '&_wpnonce=' . $_GET['_wpnonce'] ) );
86 activate_plugin( $plugin, '', ! empty( $_GET['networkwide'] ), true );
87 wp_redirect( admin_url( 'update.php?action=activate-plugin&success=true&plugin=' . urlencode( $plugin ) . '&_wpnonce=' . $_GET['_wpnonce'] ) );
88 die();
89 }
90 iframe_header( __( 'Plugin Reactivation' ), true );
91 if ( isset( $_GET['success'] ) ) {
92 echo '<p>' . __( 'Plugin reactivated successfully.' ) . '</p>';
93 }
94
95 if ( isset( $_GET['failure'] ) ) {
96 echo '<p>' . __( 'Plugin failed to reactivate due to a fatal error.' ) . '</p>';
97
98 error_reporting( E_CORE_ERROR | E_CORE_WARNING | E_COMPILE_ERROR | E_ERROR | E_WARNING | E_PARSE | E_USER_ERROR | E_USER_WARNING | E_RECOVERABLE_ERROR );
99 ini_set( 'display_errors', true ); // Ensure that fatal errors are displayed.
100 wp_register_plugin_realpath( WP_PLUGIN_DIR . '/' . $plugin );
101 include WP_PLUGIN_DIR . '/' . $plugin;
102 }
103 iframe_footer();
104 } elseif ( 'install-plugin' === $action ) {
105
106 if ( ! current_user_can( 'install_plugins' ) ) {
107 wp_die( __( 'Sorry, you are not allowed to install plugins on this site.' ) );
108 }
109
110 require_once ABSPATH . 'wp-admin/includes/plugin-install.php'; // For plugins_api().
111
112 check_admin_referer( 'install-plugin_' . $plugin );
113 $api = plugins_api(
114 'plugin_information',
115 array(
116 'slug' => $plugin,
117 'fields' => array(
118 'sections' => false,
119 ),
120 )
121 );
122
123 if ( is_wp_error( $api ) ) {
124 wp_die( $api );
125 }
126
127 // Used in the HTML title tag.
128 $title = __( 'Plugin Installation' );
129 $parent_file = 'plugins.php';
130 $submenu_file = 'plugin-install.php';
131
132 require_once ABSPATH . 'wp-admin/admin-header.php';
133
134 /* translators: %s: Plugin name and version. */
135 $title = sprintf( __( 'Installing Plugin: %s' ), $api->name . ' ' . $api->version );
136 $nonce = 'install-plugin_' . $plugin;
137 $url = 'update.php?action=install-plugin&plugin=' . urlencode( $plugin );
138 if ( isset( $_GET['from'] ) ) {
139 $url .= '&from=' . urlencode( stripslashes( $_GET['from'] ) );
140 }
141
142 $type = 'web'; // Install plugin type, From Web or an Upload.
143
144 $upgrader = new Plugin_Upgrader( new Plugin_Installer_Skin( compact( 'title', 'url', 'nonce', 'plugin', 'api' ) ) );
145 $upgrader->install( $api->download_link );
146
147 require_once ABSPATH . 'wp-admin/admin-footer.php';
148
149 } elseif ( 'upload-plugin' === $action ) {
150
151 if ( ! current_user_can( 'upload_plugins' ) ) {
152 wp_die( __( 'Sorry, you are not allowed to install plugins on this site.' ) );
153 }
154
155 check_admin_referer( 'plugin-upload' );
156
157 if ( isset( $_FILES['pluginzip']['name'] ) && ! str_ends_with( strtolower( $_FILES['pluginzip']['name'] ), '.zip' ) ) {
158 wp_die( __( 'Only .zip archives may be uploaded.' ) );
159 }
160
161 $file_upload = new File_Upload_Upgrader( 'pluginzip', 'package' );
162
163 // Used in the HTML title tag.
164 $title = __( 'Upload Plugin' );
165 $parent_file = 'plugins.php';
166 $submenu_file = 'plugin-install.php';
167
168 require_once ABSPATH . 'wp-admin/admin-header.php';
169
170 /* translators: %s: File name. */
171 $title = sprintf( __( 'Installing plugin from uploaded file: %s' ), esc_html( basename( $file_upload->filename ) ) );
172 $nonce = 'plugin-upload';
173 $url = add_query_arg( array( 'package' => $file_upload->id ), 'update.php?action=upload-plugin' );
174 $type = 'upload'; // Install plugin type, From Web or an Upload.
175
176 $overwrite = isset( $_GET['overwrite'] ) ? sanitize_text_field( $_GET['overwrite'] ) : '';
177 $overwrite = in_array( $overwrite, array( 'update-plugin', 'downgrade-plugin' ), true ) ? $overwrite : '';
178
179 $upgrader = new Plugin_Upgrader( new Plugin_Installer_Skin( compact( 'type', 'title', 'nonce', 'url', 'overwrite' ) ) );
180 $result = $upgrader->install( $file_upload->package, array( 'overwrite_package' => $overwrite ) );
181
182 if ( $result || is_wp_error( $result ) ) {
183 $file_upload->cleanup();
184 }
185
186 require_once ABSPATH . 'wp-admin/admin-footer.php';
187
188 } elseif ( 'upload-plugin-cancel-overwrite' === $action ) {
189 if ( ! current_user_can( 'upload_plugins' ) ) {
190 wp_die( __( 'Sorry, you are not allowed to install plugins on this site.' ) );
191 }
192
193 check_admin_referer( 'plugin-upload-cancel-overwrite' );
194
195 // Make sure the attachment still exists, or File_Upload_Upgrader will call wp_die()
196 // that shows a generic "Please select a file" error.
197 if ( ! empty( $_GET['package'] ) ) {
198 $attachment_id = (int) $_GET['package'];
199
200 if ( get_post( $attachment_id ) ) {
201 $file_upload = new File_Upload_Upgrader( 'pluginzip', 'package' );
202 $file_upload->cleanup();
203 }
204 }
205
206 wp_redirect( self_admin_url( 'plugin-install.php' ) );
207 exit;
208 } elseif ( 'upgrade-theme' === $action ) {
209
210 if ( ! current_user_can( 'update_themes' ) ) {
211 wp_die( __( 'Sorry, you are not allowed to update themes for this site.' ) );
212 }
213
214 check_admin_referer( 'upgrade-theme_' . $theme );
215
216 wp_enqueue_script( 'updates' );
217
218 // Used in the HTML title tag.
219 $title = __( 'Update Theme' );
220 $parent_file = 'themes.php';
221 $submenu_file = 'themes.php';
222
223 require_once ABSPATH . 'wp-admin/admin-header.php';
224
225 $nonce = 'upgrade-theme_' . $theme;
226 $url = 'update.php?action=upgrade-theme&theme=' . urlencode( $theme );
227
228 $upgrader = new Theme_Upgrader( new Theme_Upgrader_Skin( compact( 'title', 'nonce', 'url', 'theme' ) ) );
229 $upgrader->upgrade( $theme );
230
231 require_once ABSPATH . 'wp-admin/admin-footer.php';
232 } elseif ( 'update-selected-themes' === $action ) {
233 if ( ! current_user_can( 'update_themes' ) ) {
234 wp_die( __( 'Sorry, you are not allowed to update themes for this site.' ) );
235 }
236
237 check_admin_referer( 'bulk-update-themes' );
238
239 if ( isset( $_GET['themes'] ) ) {
240 $themes = explode( ',', stripslashes( $_GET['themes'] ) );
241 } elseif ( isset( $_POST['checked'] ) ) {
242 $themes = (array) $_POST['checked'];
243 } else {
244 $themes = array();
245 }
246
247 $themes = array_map( 'urldecode', $themes );
248
249 $url = 'update.php?action=update-selected-themes&themes=' . urlencode( implode( ',', $themes ) );
250 $nonce = 'bulk-update-themes';
251
252 wp_enqueue_script( 'updates' );
253 iframe_header();
254
255 $upgrader = new Theme_Upgrader( new Bulk_Theme_Upgrader_Skin( compact( 'nonce', 'url' ) ) );
256 $upgrader->bulk_upgrade( $themes );
257
258 iframe_footer();
259 } elseif ( 'install-theme' === $action ) {
260
261 if ( ! current_user_can( 'install_themes' ) ) {
262 wp_die( __( 'Sorry, you are not allowed to install themes on this site.' ) );
263 }
264
265 require_once ABSPATH . 'wp-admin/includes/class-wp-upgrader.php'; // For themes_api().
266
267 check_admin_referer( 'install-theme_' . $theme );
268 $api = themes_api(
269 'theme_information',
270 array(
271 'slug' => $theme,
272 'fields' => array(
273 'sections' => false,
274 'tags' => false,
275 ),
276 )
277 ); // Save on a bit of bandwidth.
278
279 if ( is_wp_error( $api ) ) {
280 wp_die( $api );
281 }
282
283 // Used in the HTML title tag.
284 $title = __( 'Install Themes' );
285 $parent_file = 'themes.php';
286 $submenu_file = 'themes.php';
287
288 require_once ABSPATH . 'wp-admin/admin-header.php';
289
290 /* translators: %s: Theme name and version. */
291 $title = sprintf( __( 'Installing Theme: %s' ), $api->name . ' ' . $api->version );
292 $nonce = 'install-theme_' . $theme;
293 $url = 'update.php?action=install-theme&theme=' . urlencode( $theme );
294 $type = 'web'; // Install theme type, From Web or an Upload.
295
296 $upgrader = new Theme_Upgrader( new Theme_Installer_Skin( compact( 'title', 'url', 'nonce', 'plugin', 'api' ) ) );
297 $upgrader->install( $api->download_link );
298
299 require_once ABSPATH . 'wp-admin/admin-footer.php';
300
301 } elseif ( 'upload-theme' === $action ) {
302
303 if ( ! current_user_can( 'upload_themes' ) ) {
304 wp_die( __( 'Sorry, you are not allowed to install themes on this site.' ) );
305 }
306
307 check_admin_referer( 'theme-upload' );
308
309 if ( isset( $_FILES['themezip']['name'] ) && ! str_ends_with( strtolower( $_FILES['themezip']['name'] ), '.zip' ) ) {
310 wp_die( __( 'Only .zip archives may be uploaded.' ) );
311 }
312
313 $file_upload = new File_Upload_Upgrader( 'themezip', 'package' );
314
315 // Used in the HTML title tag.
316 $title = __( 'Upload Theme' );
317 $parent_file = 'themes.php';
318 $submenu_file = 'theme-install.php';
319
320 require_once ABSPATH . 'wp-admin/admin-header.php';
321
322 /* translators: %s: File name. */
323 $title = sprintf( __( 'Installing theme from uploaded file: %s' ), esc_html( basename( $file_upload->filename ) ) );
324 $nonce = 'theme-upload';
325 $url = add_query_arg( array( 'package' => $file_upload->id ), 'update.php?action=upload-theme' );
326 $type = 'upload'; // Install theme type, From Web or an Upload.
327
328 $overwrite = isset( $_GET['overwrite'] ) ? sanitize_text_field( $_GET['overwrite'] ) : '';
329 $overwrite = in_array( $overwrite, array( 'update-theme', 'downgrade-theme' ), true ) ? $overwrite : '';
330
331 $upgrader = new Theme_Upgrader( new Theme_Installer_Skin( compact( 'type', 'title', 'nonce', 'url', 'overwrite' ) ) );
332 $result = $upgrader->install( $file_upload->package, array( 'overwrite_package' => $overwrite ) );
333
334 if ( $result || is_wp_error( $result ) ) {
335 $file_upload->cleanup();
336 }
337
338 require_once ABSPATH . 'wp-admin/admin-footer.php';
339
340 } elseif ( 'upload-theme-cancel-overwrite' === $action ) {
341 if ( ! current_user_can( 'upload_themes' ) ) {
342 wp_die( __( 'Sorry, you are not allowed to install themes on this site.' ) );
343 }
344
345 check_admin_referer( 'theme-upload-cancel-overwrite' );
346
347 // Make sure the attachment still exists, or File_Upload_Upgrader will call wp_die()
348 // that shows a generic "Please select a file" error.
349 if ( ! empty( $_GET['package'] ) ) {
350 $attachment_id = (int) $_GET['package'];
351
352 if ( get_post( $attachment_id ) ) {
353 $file_upload = new File_Upload_Upgrader( 'themezip', 'package' );
354 $file_upload->cleanup();
355 }
356 }
357
358 wp_redirect( self_admin_url( 'theme-install.php' ) );
359 exit;
360 } else {
361 /**
362 * Fires when a custom plugin or theme update request is received.
363 *
364 * The dynamic portion of the hook name, `$action`, refers to the action
365 * provided in the request for wp-admin/update.php. Can be used to
366 * provide custom update functionality for themes and plugins.
367 *
368 * @since 2.8.0
369 */
370 do_action( "update-custom_{$action}" ); // phpcs:ignore WordPress.NamingConventions.ValidHookName.UseUnderscores
371 }
372}
373