Ticket #20074: 20074.diff

wp-admin/includes/file.php

@@ -492 +492 @@
  *
  * @param string $url the URL of the file to download
  * @param int $timeout The timeout for the request to download the file default 300 seconds
- * @return mixed WP_Error on failure, string Filename on success.
+ * @param bool $full_response Whether to return the full response instead of just the filename
+ * @return mixed WP_Error on failure, string Filename or HTTP API response array on success.
  */
-function download_url( $url, $timeout = 300 ) {
+function download_url( $url, $timeout = 300, $full_response = false ) {
         //WARNING: The file is not automatically deleted, The script must unlink() the file.
         if ( ! $url )
                 return new WP_Error('http_no_url', __('Invalid URL Provided.'));
@@ -515 +516 @@
                 return new WP_Error( 'http_404', trim( wp_remote_retrieve_response_message( $response ) ) );
         }
 
-        return $tmpfname;
+        if ( $full_response )
+                return $response;
+        else
+                return $tmpfname;
 }
 
 /**

wp-admin/includes/class-wp-upgrader.php

@@ -49 +49 @@
                 $this->strings['fs_no_folder'] = __('Unable to locate needed folder (%s).');
 
                 $this->strings['download_failed'] = __('Download failed.');
+                $this->strings['download_verification_failed'] = __('Unable to verify download.');
                 $this->strings['installing_package'] = __('Installing the latest version…');
                 $this->strings['folder_exists'] = __('Destination folder already exists.');
                 $this->strings['mkdir_failed'] = __('Could not create directory.');
@@ -115 +116 @@
 
                 $this->skin->feedback('downloading_package', $package);
 
-                $download_file = download_url($package);
+                $response = download_url($package, 300, true);
 
-                if ( is_wp_error($download_file) )
-                        return new WP_Error('download_failed', $this->strings['download_failed'], $download_file->get_error_message());
+                if ( is_wp_error($response) )
+                        return new WP_Error('download_failed', $this->strings['download_failed'], $response->get_error_message());
 
+                $download_file = $response['filename'];
+
+                $content_md5 = wp_remote_retrieve_header( $response, 'content-md5' );
+
+                if ( ! empty( $content_md5 ) ) {
+                        $this->skin->feedback('verifying_package');
+                        $md5_file = md5_file( $download_file );
+                        if ( $md5_file != $content_md5 )
+                                return new WP_Error('download_verification_failed', $this->strings['download_verification_failed'], sprintf( __( 'The checksum of the download (%1$s) does not match the provided checksum value (%2$s).' ), $md5_file, $content_md5 ) );
+                }
+
                 return $download_file;
         }
 
@@ -373 +385 @@
                 $this->strings['up_to_date'] = __('The plugin is at the latest version.');
                 $this->strings['no_package'] = __('Update package not available.');
                 $this->strings['downloading_package'] = __('Downloading update from <span class="code">%s</span>&#8230;');
+                $this->strings['verifying_package'] = __('Verifying the update&#8230;');
                 $this->strings['unpack_package'] = __('Unpacking the update&#8230;');
                 $this->strings['deactivate_plugin'] = __('Deactivating the plugin&#8230;');
                 $this->strings['remove_old'] = __('Removing the old version of the plugin&#8230;');
@@ -384 +397 @@
         function install_strings() {
                 $this->strings['no_package'] = __('Install package not available.');
                 $this->strings['downloading_package'] = __('Downloading install package from <span class="code">%s</span>&#8230;');
+                $this->strings['verifying_package'] = __('Verifying the install package&#8230;');
                 $this->strings['unpack_package'] = __('Unpacking the package&#8230;');
                 $this->strings['installing_package'] = __('Installing the plugin&#8230;');
                 $this->strings['process_failed'] = __('Plugin install failed.');
@@ -648 +662 @@
                 $this->strings['up_to_date'] = __('The theme is at the latest version.');
                 $this->strings['no_package'] = __('Update package not available.');
                 $this->strings['downloading_package'] = __('Downloading update from <span class="code">%s</span>&#8230;');
+                $this->strings['verifying_package'] = __('Verifying the update&#8230;');
                 $this->strings['unpack_package'] = __('Unpacking the update&#8230;');
                 $this->strings['remove_old'] = __('Removing the old version of the theme&#8230;');
                 $this->strings['remove_old_failed'] = __('Could not remove the old theme.');
@@ -658 +673 @@
         function install_strings() {
                 $this->strings['no_package'] = __('Install package not available.');
                 $this->strings['downloading_package'] = __('Downloading install package from <span class="code">%s</span>&#8230;');
+                $this->strings['verifying_package'] = __('Verifying the install package&#8230;');
                 $this->strings['unpack_package'] = __('Unpacking the package&#8230;');
                 $this->strings['installing_package'] = __('Installing the theme&#8230;');
                 $this->strings['process_failed'] = __('Theme install failed.');