Ticket #18201: 18201.diff

wp-admin/includes/class-wp-filesystem-base.php

@@ -39 +39 @@
         var $method = '';
 
         /**
+         * Whether this filesystem supports file MD5s
+         *
+         * @since 3.7
+         * @access public
+         * @var bool
+         */
+        var $supports_md5 = false;
+
+        /**
          * Returns the path on the remote filesystem of ABSPATH
          *
          * @since 2.7

wp-admin/includes/class-wp-filesystem-ftpsockets.php

@@ -266 +266 @@
                 return false;
         }
 
+        function md5( $file ) {
+                return false;
+        }
+
         function mkdir($path, $chmod = false, $chown = false, $chgrp = false ) {
                 $path = untrailingslashit($path);
                 if ( empty($path) )

wp-admin/includes/update-core.php

@@ -656 +656 @@
                 return new WP_Error( 'insane_distro', __('The update could not be unpacked') );
         }
 
+        // Check if we have the correct files
+        include_once( $from . $distro . 'wp-admin/includes/update-core-file-hashes.php' );
+        if ( empty( $file_hashes ) ) {
+                $wp_filesystem->delete( $from, true );
+                return new WP_Error( 'no_file_hashes', __( 'The update did not contain file hashes' ) );
+        }
+
+        if ( $wp_filesystem->supports_md5 ) {
+                foreach ( $file_hashes as $file => $hash ) {
+                        if ( $hash !== $wp_filesystem->md5( $file ) ) {
+                                $wp_filesystem->delete( $from, true );
+                                return new WP_Error( 'bad_file_hashes', __( 'The update did not match the included file hashes' ) );
+                        }
+                }
+        }
+
         // Import $wp_version, $required_php_version, and $required_mysql_version from the new version
         // $wp_filesystem->wp_content_dir() returned unslashed pre-2.8
         $versions_file = trailingslashit( $wp_filesystem->wp_content_dir() ) . 'upgrade/version-current.php';

wp-admin/includes/class-wp-filesystem-direct.php

@@ -22 +22 @@
          * @param mixed $arg ignored argument
          */
         function __construct($arg) {
-                $this->method = 'direct';
-                $this->errors = new WP_Error();
+                $this->method       = 'direct';
+                $this->errors       = new WP_Error();
+                $this->supports_md5 = true;
         }
         /**
          * connect filesystem.
@@ -283 +284 @@
                 return @touch($file, $time, $atime);
         }
 
+        function md5( $file ) {
+                return @md5_file( $file );
+        }
+
         function mkdir($path, $chmod = false, $chown = false, $chgrp = false) {
                 // safe mode fails with a trailing slash under certain PHP versions.
                 $path = untrailingslashit($path);
@@ -346 +351 @@
                         $struc['lastmod']   = date('M j',$struc['lastmodunix']);
                         $struc['time']          = date('h:i:s',$struc['lastmodunix']);
                         $struc['type']          = $this->is_dir($path.'/'.$entry) ? 'd' : 'f';
+                        $struc['md5']       = $this->md5( $path . '/' . $entry );
 
                         if ( 'd' == $struc['type'] ) {
                                 if ( $recursive )

wp-admin/includes/class-wp-filesystem-ftpext.php

@@ -246 +246 @@
         function touch($file, $time = 0, $atime = 0) {
                 return false;
         }
+
+        function md5( $file ) {
+                return false;
+        }
+
         function mkdir($path, $chmod = false, $chown = false, $chgrp = false) {
                 $path = untrailingslashit($path);
                 if ( empty($path) )

wp-admin/includes/class-wp-filesystem-ssh2.php

@@ -49 +49 @@
         var $options = array();
 
         function __construct($opt='') {
-                $this->method = 'ssh2';
-                $this->errors = new WP_Error();
+                $this->method       = 'ssh2';
+                $this->errors       = new WP_Error();
+                $this->supports_md5 = true;
 
                 //Check if possible to use ssh2 functions.
                 if ( ! extension_loaded('ssh2') ) {
@@ -309 +310 @@
                 //Not implemented.
         }
 
+        function md5( $file ) {
+                $file = ltrim( $file, '/' );
+                return md5_file( 'ssh2.sftp://' . $this->sftp_link . '/' . $file );
+        }
+
         function mkdir($path, $chmod = false, $chown = false, $chgrp = false) {
                 $path = untrailingslashit($path);
                 if ( empty($path) )
@@ -369 +375 @@
                         $struc['lastmod']   = date('M j',$struc['lastmodunix']);
                         $struc['time']          = date('h:i:s',$struc['lastmodunix']);
                         $struc['type']          = $this->is_dir($path.'/'.$entry) ? 'd' : 'f';
+                        $struc['md5']       = $this->md5( $path . '/' . $entry );
 
                         if ( 'd' == $struc['type'] ) {
                                 if ( $recursive )