Ticket #46130: 46130.2.diff

src/wp-admin/css/list-tables.css

@@ -1310 +1310 @@
         text-decoration: underline;
 }
 
+.plugins tr.paused th.check-column {
+        border-left: 4px solid #d54e21;
+}
+
+.plugins tr.paused th,
+.plugins tr.paused td {
+        background-color: #fef7f1;
+}
+
+.plugins tr.paused .plugin-title,
+.plugins .paused .dashicons-warning {
+        color: #dc3232;
+}
+
+.plugins .paused .error-display p,
+.plugins .paused .error-display code {
+        font-size: 90%;
+        font-style: italic;
+        color: rgb( 0, 0, 0, 0.7 );
+}
+
+.plugins .resume-link {
+        color: #dc3232;
+}
+
 .plugin-card .update-now:before {
         color: #f56e28;
         content: "\f463";

src/wp-admin/includes/admin-filters.php

@@ -117 +117 @@
 add_action( 'load-themes.php', 'wp_theme_update_rows', 20 ); // After wp_update_themes() is called.
 
 add_action( 'admin_notices', 'update_nag', 3 );
+add_action( 'admin_notices', 'paused_plugins_notice', 5 );
+add_action( 'admin_notices', 'paused_themes_notice', 5 );
 add_action( 'admin_notices', 'maintenance_nag', 10 );
 
 add_filter( 'update_footer', 'core_update_footer' );

src/wp-admin/includes/class-wp-plugins-list-table.php

@@ -40 +40 @@
                 );
 
                 $status = 'all';
-                if ( isset( $_REQUEST['plugin_status'] ) && in_array( $_REQUEST['plugin_status'], array( 'active', 'inactive', 'recently_activated', 'upgrade', 'mustuse', 'dropins', 'search' ) ) ) {
+                if ( isset( $_REQUEST['plugin_status'] ) && in_array( $_REQUEST['plugin_status'], array( 'active', 'inactive', 'recently_activated', 'upgrade', 'mustuse', 'dropins', 'search', 'paused' ) ) ) {
                         $status = $_REQUEST['plugin_status'];
                 }
 
@@ -99 +99 @@
                         'upgrade'            => array(),
                         'mustuse'            => array(),
                         'dropins'            => array(),
+                        'paused'             => array(),
                 );
 
                 $screen = $this->screen;
@@ -209 +210 @@
                                 if ( $show_network_active ) {
                                         // On the non-network screen, show network-active plugins if allowed
                                         $plugins['active'][ $plugin_file ] = $plugin_data;
+                                        if ( is_plugin_paused( $plugin_file ) ) {
+                                                $plugins['paused'][ $plugin_file ] = $plugin_data;
+                                        }
                                 } else {
                                         // On the non-network screen, filter out network-active plugins
                                         unset( $plugins['all'][ $plugin_file ] );
@@ -218 +222 @@
                                 // On the non-network screen, populate the active list with plugins that are individually activated
                                 // On the network-admin screen, populate the active list with plugins that are network activated
                                 $plugins['active'][ $plugin_file ] = $plugin_data;
+                                if ( is_plugin_paused( $plugin_file ) ) {
+                                        $plugins['paused'][ $plugin_file ] = $plugin_data;
+                                }
                         } else {
                                 if ( isset( $recently_activated[ $plugin_file ] ) ) {
                                         // Populate the recently activated list with plugins that have been recently activated
@@ -445 +452 @@
                                         /* translators: %s: plugin count */
                                         $text = _n( 'Drop-ins <span class="count">(%s)</span>', 'Drop-ins <span class="count">(%s)</span>', $count );
                                         break;
+                                case 'paused':
+                                        /* translators: %s: plugin count */
+                                        $text = _n( 'Paused <span class="count">(%s)</span>', 'Paused <span class="count">(%s)</span>', $count );
+                                        break;
                                 case 'upgrade':
                                         /* translators: %s: plugin count */
                                         $text = _n( 'Update Available <span class="count">(%s)</span>', 'Update Available <span class="count">(%s)</span>', $count );
@@ -633 +644 @@
                                                 /* translators: %s: plugin name */
                                                 $actions['deactivate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=deactivate&amp;plugin=' . urlencode( $plugin_file ) . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'deactivate-plugin_' . $plugin_file ) . '" aria-label="' . esc_attr( sprintf( _x( 'Network Deactivate %s', 'plugin' ), $plugin_data['Name'] ) ) . '">' . __( 'Network Deactivate' ) . '</a>';
                                         }
+                                        if ( current_user_can( 'manage_network_plugins' ) && count_paused_plugin_sites_for_network( $plugin_file ) ) {
+                                                /* translators: %s: plugin name */
+                                                $actions['resume'] = '<a class="resume-link" href="' . wp_nonce_url( 'plugins.php?action=resume&amp;plugin=' . urlencode( $plugin_file ) . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'resume-plugin_' . $plugin_file ) . '" aria-label="' . esc_attr( sprintf( _x( 'Network Resume %s', 'plugin' ), $plugin_data['Name'] ) ) . '">' . __( 'Network Resume' ) . '</a>';
+                                        }
                                 } else {
                                         if ( current_user_can( 'manage_network_plugins' ) ) {
                                                 /* translators: %s: plugin name */
                                                 $actions['activate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=activate&amp;plugin=' . urlencode( $plugin_file ) . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'activate-plugin_' . $plugin_file ) . '" class="edit" aria-label="' . esc_attr( sprintf( _x( 'Network Activate %s', 'plugin' ), $plugin_data['Name'] ) ) . '">' . __( 'Network Activate' ) . '</a>';
                                         }
+                                        if ( current_user_can( 'manage_network_plugins' ) && count_paused_plugin_sites_for_network( $plugin_file ) ) {
+                                                /* translators: %s: plugin name */
+                                                $actions['resume'] = '<a class="resume-link" href="' . wp_nonce_url( 'plugins.php?action=resume&amp;plugin=' . urlencode( $plugin_file ) . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'resume-plugin_' . $plugin_file ) . '" aria-label="' . esc_attr( sprintf( _x( 'Network Resume %s', 'plugin' ), $plugin_data['Name'] ) ) . '">' . __( 'Network Resume' ) . '</a>';
+                                        }
                                         if ( current_user_can( 'delete_plugins' ) && ! is_plugin_active( $plugin_file ) ) {
                                                 /* translators: %s: plugin name */
                                                 $actions['delete'] = '<a href="' . wp_nonce_url( 'plugins.php?action=delete-selected&amp;checked[]=' . urlencode( $plugin_file ) . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'bulk-plugins' ) . '" class="delete" aria-label="' . esc_attr( sprintf( _x( 'Delete %s', 'plugin' ), $plugin_data['Name'] ) ) . '">' . __( 'Delete' ) . '</a>';
@@ -648 +667 @@
                                         $actions = array(
                                                 'network_active' => __( 'Network Active' ),
                                         );
+                                        if ( ! $restrict_network_only && current_user_can( 'resume_plugin', $plugin_file ) && is_plugin_paused( $plugin_file ) ) {
+                                                /* translators: %s: plugin name */
+                                                $actions['resume'] = '<a class="resume-link" href="' . wp_nonce_url( 'plugins.php?action=resume&amp;plugin=' . urlencode( $plugin_file ) . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'resume-plugin_' . $plugin_file ) . '" aria-label="' . esc_attr( sprintf( _x( 'Resume %s', 'plugin' ), $plugin_data['Name'] ) ) . '">' . __( 'Resume' ) . '</a>';
+                                        }
                                 } elseif ( $restrict_network_only ) {
                                         $actions = array(
                                                 'network_only' => __( 'Network Only' ),
@@ -657 +680 @@
                                                 /* translators: %s: plugin name */
                                                 $actions['deactivate'] = '<a href="' . wp_nonce_url( 'plugins.php?action=deactivate&amp;plugin=' . urlencode( $plugin_file ) . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'deactivate-plugin_' . $plugin_file ) . '" aria-label="' . esc_attr( sprintf( _x( 'Deactivate %s', 'plugin' ), $plugin_data['Name'] ) ) . '">' . __( 'Deactivate' ) . '</a>';
                                         }
+                                        if ( current_user_can( 'resume_plugin', $plugin_file ) && is_plugin_paused( $plugin_file ) ) {
+                                                /* translators: %s: plugin name */
+                                                $actions['resume'] = '<a class="resume-link" href="' . wp_nonce_url( 'plugins.php?action=resume&amp;plugin=' . urlencode( $plugin_file ) . '&amp;plugin_status=' . $context . '&amp;paged=' . $page . '&amp;s=' . $s, 'resume-plugin_' . $plugin_file ) . '" aria-label="' . esc_attr( sprintf( _x( 'Resume %s', 'plugin' ), $plugin_data['Name'] ) ) . '">' . __( 'Resume' ) . '</a>';
+                                        }
                                 } else {
                                         if ( current_user_can( 'activate_plugin', $plugin_file ) ) {
                                                 /* translators: %s: plugin name */
@@ -764 +791 @@
                         $class .= ' update';
                 }
 
+                $paused = is_plugin_paused( $plugin_file );
+
+                if ( $paused ) {
+                        $class .= ' paused';
+                }
+
                 $plugin_slug = isset( $plugin_data['slug'] ) ? $plugin_data['slug'] : sanitize_title( $plugin_name );
                 printf(
                         '<tr class="%s" data-slug="%s" data-plugin="%s">',
@@ -845 +878 @@
                                          * @param array    $plugin_data An array of plugin data.
                                          * @param string   $status      Status of the plugin. Defaults are 'All', 'Active',
                                          *                              'Inactive', 'Recently Activated', 'Upgrade', 'Must-Use',
-                                         *                              'Drop-ins', 'Search'.
+                                         *                              'Drop-ins', 'Search', 'Paused'.
                                          */
                                         $plugin_meta = apply_filters( 'plugin_row_meta', $plugin_meta, $plugin_file, $plugin_data, $status );
                                         echo implode( ' | ', $plugin_meta );
 
                                         echo '</div>';
 
+                                        if ( $paused ) {
+                                                $notice_text = __( 'This plugin failed to load properly and is paused during recovery mode.' );
+
+                                                printf( '<p><span class="dashicons dashicons-warning"></span> <strong>%s</strong></p>', $notice_text );
+
+                                                $error = wp_get_plugin_error( $plugin_file );
+
+                                                if ( false !== $error ) {
+                                                        printf( '<div class="error-display"><p>%s</p></div>', wp_get_plugin_error_description( $error ) );
+                                                }
+                                        }
+
                                         echo '</td>';
                                         break;
                                 default:
@@ -885 +930 @@
                  * @param array  $plugin_data An array of plugin data.
                  * @param string $status      Status of the plugin. Defaults are 'All', 'Active',
                  *                            'Inactive', 'Recently Activated', 'Upgrade', 'Must-Use',
-                 *                            'Drop-ins', 'Search'.
+                 *                            'Drop-ins', 'Search', 'Paused'.
                  */
                 do_action( 'after_plugin_row', $plugin_file, $plugin_data, $status );
 
@@ -901 +946 @@
                  * @param array  $plugin_data An array of plugin data.
                  * @param string $status      Status of the plugin. Defaults are 'All', 'Active',
                  *                            'Inactive', 'Recently Activated', 'Upgrade', 'Must-Use',
-                 *                            'Drop-ins', 'Search'.
+                 *                            'Drop-ins', 'Search', 'Paused'.
                  */
                 do_action( "after_plugin_row_{$plugin_file}", $plugin_file, $plugin_data, $status );
         }

src/wp-admin/includes/plugin.php

@@ -468 +468 @@
  */
 function _get_dropins() {
         $dropins = array(
-                'advanced-cache.php' => array( __( 'Advanced caching plugin.' ), 'WP_CACHE' ), // WP_CACHE
-                'db.php'             => array( __( 'Custom database class.' ), true ), // auto on load
-                'db-error.php'       => array( __( 'Custom database error message.' ), true ), // auto on error
-                'install.php'        => array( __( 'Custom installation script.' ), true ), // auto on installation
-                'maintenance.php'    => array( __( 'Custom maintenance message.' ), true ), // auto on maintenance
-                'object-cache.php'   => array( __( 'External object cache.' ), true ), // auto on load
+                'advanced-cache.php'           => array( __( 'Advanced caching plugin.' ), 'WP_CACHE' ), // WP_CACHE
+                'db.php'                       => array( __( 'Custom database class.' ), true ), // auto on load
+                'db-error.php'                 => array( __( 'Custom database error message.' ), true ), // auto on error
+                'install.php'                  => array( __( 'Custom installation script.' ), true ), // auto on installation
+                'maintenance.php'              => array( __( 'Custom maintenance message.' ), true ), // auto on maintenance
+                'object-cache.php'             => array( __( 'External object cache.' ), true ), // auto on load
+                'php-error.php'                => array( __( 'Custom PHP error message.' ), true ), // auto on error
+                'fatal-error-handler.php'      => array( __( 'Custom PHP fatal error handler.' ), true ), // auto on error
+                'recovery-mode-controller.php' => array( __( 'Custom recovery mode controller.' ), true ), // auto on error
         );
 
         if ( is_multisite() ) {
@@ -2101 +2104 @@
 
         WP_Privacy_Policy_Content::add( $plugin_name, $policy_text );
 }
+
+/**
+ * Determines whether a plugin is technically active but was paused while
+ * loading.
+ *
+ * For more information on this and similar theme functions, check out
+ * the {@link https://developer.wordpress.org/themes/basics/conditional-tags/
+ * Conditional Tags} article in the Theme Developer Handbook.
+ *
+ * @since 5.2.0
+ *
+ * @param string $plugin Path to the plugin file relative to the plugins directory.
+ * @return bool True, if in the list of paused plugins. False, not in the list.
+ */
+function is_plugin_paused( $plugin ) {
+        if ( ! isset( $GLOBALS['_paused_plugins'] ) ) {
+                return false;
+        }
+
+        if ( ! is_plugin_active( $plugin ) && ! is_plugin_active_for_network( $plugin ) ) {
+                return false;
+        }
+
+        list( $plugin ) = explode( '/', $plugin );
+
+        return array_key_exists( $plugin, $GLOBALS['_paused_plugins'] );
+}
+
+/**
+ * Gets the error that was recorded for a paused plugin.
+ *
+ * @since 5.2.0
+ *
+ * @param string $plugin Path to the plugin file relative to the plugins
+ *                       directory.
+ * @return array|false Array of error information as it was returned by
+ *                     `error_get_last()`, or false if none was recorded.
+ */
+function wp_get_plugin_error( $plugin ) {
+        if ( ! isset( $GLOBALS['_paused_plugins'] ) ) {
+                return false;
+        }
+
+        list( $plugin ) = explode( '/', $plugin );
+
+        if ( ! array_key_exists( $plugin, $GLOBALS['_paused_plugins'] ) ) {
+                return false;
+        }
+
+        return $GLOBALS['_paused_plugins'][ $plugin ];
+}
+
+/**
+ * Get a human readable description of the plugin error.
+ *
+ * @since 5.2.0
+ *
+ * @param array $error Error from {@see wp_get_plugin_error()}
+ *
+ * @return string Formatted error description.
+ */
+function wp_get_plugin_error_description( $error ) {
+        $constants   = get_defined_constants( true );
+        $constants   = isset( $constants['Core'] ) ? $constants['Core'] : $constants['internal'];
+        $core_errors = array();
+
+        foreach ( $constants as $constant => $value ) {
+                if ( 0 === strpos( $constant, 'E_' ) ) {
+                        $core_errors[ $value ] = $constant;
+                }
+        }
+
+        if ( isset( $core_errors[ $error['type'] ] ) ) {
+                $error['type'] = $core_errors[ $error['type'] ];
+        }
+
+        /* translators: 1: error type, 2: error line number, 3: error file name, 4: error message */
+        $error_message = __( 'The plugin caused an error of type %1$s in line %2$s of the file %3$s. Error message: %4$s' );
+
+        return sprintf(
+                $error_message,
+                "<code>{$error['type']}</code>",
+                "<code>{$error['line']}</code>",
+                "<code>{$error['file']}</code>",
+                "<code>{$error['message']}</code>"
+        );
+}
+
+/**
+ * Gets the number of sites on which a specific plugin is paused.
+ *
+ * @since 5.2.0
+ *
+ * @param string $plugin Path to the plugin file relative to the plugins directory.
+ * @return int Site count.
+ */
+function count_paused_plugin_sites_for_network( $plugin ) {
+        if ( ! is_multisite() ) {
+                return is_plugin_paused( $plugin ) ? 1 : 0;
+        }
+
+        list( $plugin ) = explode( '/', $plugin );
+
+        $query_args = array(
+                'count'      => true,
+                'number'     => 0,
+                'network_id' => get_current_network_id(),
+                'meta_query' => array(
+                        wp_paused_extensions()->get_site_meta_query_clause( 'plugin', $plugin ),
+                ),
+        );
+
+        return get_sites( $query_args );
+}
+
+/**
+ * Tries to resume a single plugin.
+ *
+ * If a redirect was provided, we first ensure the plugin does not throw fatal
+ * errors anymore.
+ *
+ * The way it works is by setting the redirection to the error before trying to
+ * include the plugin file. If the plugin fails, then the redirection will not
+ * be overwritten with the success message and the plugin will not be resumed.
+ *
+ * @since 5.2.0
+ *
+ * @param string $plugin       Single plugin to resume.
+ * @param string $redirect     Optional. URL to redirect to. Default empty string.
+ * @param bool   $network_wide Optional. Whether to resume the plugin for the entire
+ *                             network. Default false.
+ * @return bool|WP_Error True on success, false if `$plugin` was not paused,
+ *                       `WP_Error` on failure.
+ */
+function resume_plugin( $plugin, $redirect = '', $network_wide = false ) {
+        /*
+         * We'll override this later if the plugin could be included without
+         * creating a fatal error.
+         */
+        if ( ! empty( $redirect ) ) {
+                wp_redirect(
+                        add_query_arg(
+                                '_error_nonce',
+                                wp_create_nonce( 'plugin-resume-error_' . $plugin ),
+                                $redirect
+                        )
+                );
+
+                // Load the plugin to test whether it throws a fatal error.
+                ob_start();
+                plugin_sandbox_scrape( $plugin );
+                ob_clean();
+        }
+
+        $result = wp_forget_extension_error( 'plugin', $plugin, $network_wide );
+
+        if ( ! $result ) {
+                return new WP_Error(
+                        'could_not_resume_plugin',
+                        __( 'Could not resume the plugin.' )
+                );
+        }
+
+        return true;
+}
+
+/**
+ * Renders an admin notice in case some plugins have been paused due to errors.
+ *
+ * @since 5.2.0
+ */
+function paused_plugins_notice() {
+        if ( 'plugins.php' === $GLOBALS['pagenow'] ) {
+                return;
+        }
+
+        if ( ! current_user_can( 'deactivate_plugins' ) ) {
+                return;
+        }
+
+        if ( ! isset( $GLOBALS['_paused_plugins'] ) || empty( $GLOBALS['_paused_plugins'] ) ) {
+                return;
+        }
+
+        printf(
+                '<div class="notice notice-error"><p><strong>%s</strong><br>%s</p><p>%s</p></div>',
+                __( 'One or more plugins failed to load properly.' ),
+                __( 'You can find more details and make changes on the Plugins screen.' ),
+                sprintf(
+                        '<a href="%s">%s</a>',
+                        admin_url( 'plugins.php?plugin_status=paused' ),
+                        'Go to the Plugins screen'
+                )
+        );
+}

src/wp-admin/includes/theme.php

@@ -768 +768 @@
         </script>
         <?php
 }
+
+/**
+ * Determines whether a theme is technically active but was paused while
+ * loading.
+ *
+ * For more information on this and similar theme functions, check out
+ * the {@link https://developer.wordpress.org/themes/basics/conditional-tags/
+ * Conditional Tags} article in the Theme Developer Handbook.
+ *
+ * @since 5.2.0
+ *
+ * @param string $theme Path to the theme directory relative to the themes directory.
+ * @return bool True, if in the list of paused themes. False, not in the list.
+ */
+function is_theme_paused( $theme ) {
+        if ( ! isset( $GLOBALS['_paused_themes'] ) ) {
+                return false;
+        }
+
+        if ( get_stylesheet() !== $theme && get_template() !== $theme ) {
+                return false;
+        }
+
+        return array_key_exists( $theme, $GLOBALS['_paused_themes'] );
+}
+
+/**
+ * Gets the error that was recorded for a paused theme.
+ *
+ * @since 5.2.0
+ *
+ * @param string $theme Path to the theme directory relative to the themes
+ *                      directory.
+ * @return array|false Array of error information as it was returned by
+ *                     `error_get_last()`, or false if none was recorded.
+ */
+function wp_get_theme_error( $theme ) {
+        if ( ! isset( $GLOBALS['_paused_themes'] ) ) {
+                return false;
+        }
+
+        if ( ! array_key_exists( $theme, $GLOBALS['_paused_themes'] ) ) {
+                return false;
+        }
+
+        return $GLOBALS['_paused_themes'][ $theme ];
+}
+
+/**
+ * Gets the number of sites on which a specific theme is paused.
+ *
+ * @since 5.2.0
+ *
+ * @param string $theme Path to the theme directory relative to the themes directory.
+ * @return int Site count.
+ */
+function count_paused_theme_sites_for_network( $theme ) {
+        if ( ! is_multisite() ) {
+                return is_theme_paused( $theme ) ? 1 : 0;
+        }
+
+        $query_args = array(
+                'count'      => true,
+                'number'     => 0,
+                'network_id' => get_current_network_id(),
+                'meta_query' => array(
+                        wp_paused_extensions()->get_site_meta_query_clause( 'theme', $theme ),
+                ),
+        );
+
+        return get_sites( $query_args );
+}
+
+/**
+ * Tries to resume a single theme.
+ *
+ * @since 5.2.0
+ *
+ * @param string $theme Single theme to resume.
+ * @return bool|WP_Error True on success, false if `$theme` was not paused,
+ *                       `WP_Error` on failure.
+ */
+function resume_theme( $theme ) {
+        $result = wp_forget_extension_error( 'theme', $theme );
+
+        if ( ! $result ) {
+                return new WP_Error(
+                        'could_not_resume_theme',
+                        __( 'Could not resume the theme.' )
+                );
+        }
+
+        return true;
+}
+
+/**
+ * Renders an admin notice in case some themes have been paused due to errors.
+ *
+ * @since 5.2.0
+ */
+function paused_themes_notice() {
+        if ( 'themes.php' === $GLOBALS['pagenow'] ) {
+                return;
+        }
+
+        if ( ! current_user_can( 'switch_themes' ) ) {
+                return;
+        }
+
+        if ( ! isset( $GLOBALS['_paused_themes'] ) || empty( $GLOBALS['_paused_themes'] ) ) {
+                return;
+        }
+
+        printf(
+                '<div class="notice notice-error"><p><strong>%s</strong><br>%s</p><p>%s</p></div>',
+                __( 'One or more themes failed to load properly.' ),
+                __( 'You can find more details and make changes on the Themes screen.' ),
+                sprintf(
+                        '<a href="%s">%s</a>',
+                        admin_url( 'themes.php' ),
+                        'Go to the Themes screen'
+                )
+        );
+}

src/wp-admin/plugins.php

@@ -389 +389 @@
                         }
                         break;
 
+                case 'resume':
+                        if ( ! current_user_can( 'resume_plugin', $plugin ) ) {
+                                wp_die( __( 'Sorry, you are not allowed to resume this plugin.' ) );
+                        }
+
+                        if ( is_multisite() && ! is_network_admin() && is_network_only_plugin( $plugin ) ) {
+                                wp_redirect( self_admin_url( "plugins.php?plugin_status=$status&paged=$page&s=$s" ) );
+                                exit;
+                        }
+
+                        check_admin_referer( 'resume-plugin_' . $plugin );
+
+                        $result = resume_plugin( $plugin, self_admin_url( 'plugins.php?error=resuming' ), is_network_admin() );
+
+                        if ( is_wp_error( $result ) ) {
+                                wp_die( $result );
+                        }
+
+                        wp_redirect( self_admin_url( "plugins.php?resume=true&plugin_status=$status&paged=$page&s=$s" ) );
+                        exit;
+
                 default:
                         if ( isset( $_POST['checked'] ) ) {
                                 check_admin_referer( 'bulk-plugins' );
@@ -488 +509 @@
                         $_GET['charsout']
                 );
                 $errmsg .= ' ' . __( 'If you notice “headers already sent” messages, problems with syndication feeds or other issues, try deactivating or removing this plugin.' );
+        } elseif ( 'resuming' === $_GET['error'] ) {
+                $errmsg = __( 'Plugin could not be resumed because it triggered a <strong>fatal error</strong>.' );
         } else {
                 $errmsg = __( 'Plugin could not be activated because it triggered a <strong>fatal error</strong>.' );
         }
@@ -541 +564 @@
         <div id="message" class="updated notice is-dismissible"><p><?php _e( 'Selected plugins <strong>deactivated</strong>.' ); ?></p></div>
 <?php elseif ( 'update-selected' == $action ) : ?>
         <div id="message" class="updated notice is-dismissible"><p><?php _e( 'All selected plugins are up to date.' ); ?></p></div>
+<?php elseif ( isset( $_GET['resume'] ) ) : ?>
+        <div id="message" class="updated notice is-dismissible"><p><?php _e( 'Plugin <strong>resumed</strong>.' ); ?></p></div>
 <?php endif; ?>
 
 <div class="wrap">

src/wp-admin/themes.php

@@ -33 +33 @@
                 switch_theme( $theme->get_stylesheet() );
                 wp_redirect( admin_url( 'themes.php?activated=true' ) );
                 exit;
+        } elseif ( 'resume' === $_GET['action'] ) {
+                check_admin_referer( 'resume-theme_' . $_GET['stylesheet'] );
+                $theme = wp_get_theme( $_GET['stylesheet'] );
+
+                if ( ! current_user_can( 'resume_themes' ) ) {
+                        wp_die(
+                                '<h1>' . __( 'You need a higher level of permission.' ) . '</h1>' .
+                                '<p>' . __( 'Sorry, you are not allowed to resume this theme.' ) . '</p>',
+                                403
+                        );
+                }
+
+                $result = resume_theme( $theme->get_stylesheet() );
+
+                if ( is_wp_error( $result ) ) {
+                        wp_die( $result );
+                }
+
+                wp_redirect( admin_url( 'themes.php?resumed=true' ) );
+                exit;
         } elseif ( 'delete' == $_GET['action'] ) {
                 check_admin_referer( 'delete-theme_' . $_GET['stylesheet'] );
                 $theme = wp_get_theme( $_GET['stylesheet'] );
@@ -195 +215 @@
         ?>
         <div id="message4" class="error"><p><?php _e( 'You cannot delete a theme while it has an active child theme.' ); ?></p></div>
         <?php
+} elseif ( isset( $_GET['resumed'] ) ) {
+        ?>
+        <div id="message5" class="updated notice is-dismissible"><p><?php _e( 'Theme resumed.' ); ?></p></div>
+        <?php
 }
 
 $ct = wp_get_theme();
@@ -348 +372 @@
 <p><?php _e( 'The following themes are installed but incomplete.' ); ?></p>
 
         <?php
+        $can_resume  = current_user_can( 'resume_themes' );
         $can_delete  = current_user_can( 'delete_themes' );
         $can_install = current_user_can( 'install_themes' );
         ?>
@@ -355 +380 @@
         <tr>
                 <th><?php _ex( 'Name', 'theme name' ); ?></th>
                 <th><?php _e( 'Description' ); ?></th>
+                <?php if ( $can_resume ) { ?>
+                        <td></td>
+                <?php } ?>
                 <?php if ( $can_delete ) { ?>
                         <td></td>
                 <?php } ?>
@@ -367 +395 @@
                         <td><?php echo $broken_theme->get( 'Name' ) ? $broken_theme->display( 'Name' ) : $broken_theme->get_stylesheet(); ?></td>
                         <td><?php echo $broken_theme->errors()->get_error_message(); ?></td>
                         <?php
+                        if ( $can_resume ) {
+                                if ( 'theme_paused' === $broken_theme->errors()->get_error_code() ) {
+                                        $stylesheet = $broken_theme->get_stylesheet();
+                                        $resume_url = add_query_arg(
+                                                array(
+                                                        'action'     => 'resume',
+                                                        'stylesheet' => urlencode( $stylesheet ),
+                                                ),
+                                                admin_url( 'themes.php' )
+                                        );
+                                        $resume_url = wp_nonce_url( $resume_url, 'resume-theme_' . $stylesheet );
+                                        ?>
+                                        <td><a href="<?php echo esc_url( $resume_url ); ?>" class="button resume-theme"><?php _e( 'Resume' ); ?></a></td>
+                                        <?php
+                                } else {
+                                        ?>
+                                        <td></td>
+                                        <?php
+                                }
+                        }
+
                         if ( $can_delete ) {
                                 $stylesheet = $broken_theme->get_stylesheet();
                                 $delete_url = add_query_arg(

src/wp-includes/capabilities.php

@@ -464 +464 @@
                                 }
                         }
                         break;
+                case 'resume_plugin':
+                        $caps[] = 'resume_plugins';
+                        break;
                 case 'delete_user':
                 case 'delete_users':
                         // If multisite only super admins can delete users.
@@ -950 +953 @@
 
         return $allcaps;
 }
+
+/**
+ * Filters the user capabilities to grant the 'resume_plugins' and 'resume_themes' capabilities as necessary.
+ *
+ * @since 5.2.0
+ *
+ * @param bool[] $allcaps An array of all the user's capabilities.
+ * @return bool[] Filtered array of the user's capabilities.
+ */
+function wp_maybe_grant_resume_extensions_caps( $allcaps ) {
+        // Even in a multisite, regular administrators should be able to resume plugins.
+        if ( ! empty( $allcaps['activate_plugins'] ) ) {
+                $allcaps['resume_plugins'] = true;
+        }
+
+        // Even in a multisite, regular administrators should be able to resume themes.
+        if ( ! empty( $allcaps['switch_themes'] ) ) {
+                $allcaps['resume_themes'] = true;
+        }
+
+        return $allcaps;
+}

new file src/wp-includes/class-wp-fatal-error-handler.php

@@ +1 @@
+<?php
+/**
+ * Error Protection API: WP_Fatal_Error_Handler class
+ *
+ * @package WordPress
+ * @since   5.2.0
+ */
+
+/**
+ * Core class used as the default shutdown handler for fatal errors.
+ *
+ * A drop-in 'fatal-error-handler.php' can be used to override the instance of this class and use a custom
+ * implementation for the fatal error handler that WordPress registers. The custom class should extend this class and
+ * can override its methods individually as necessary. The file must return the instance of the class that should be
+ * registered.
+ *
+ * @since 5.2.0
+ */
+class WP_Fatal_Error_Handler {
+
+        /**
+         * Runs the shutdown handler.
+         *
+         * This method is registered via `register_shutdown_function()`.
+         *
+         * @since 5.2.0
+         */
+        public function handle() {
+                // Bail if WordPress executed successfully.
+                if ( defined( 'WP_EXECUTION_SUCCEEDED' ) && WP_EXECUTION_SUCCEEDED ) {
+                        return;
+                }
+
+                try {
+                        // Bail if no error found.
+                        $error = $this->detect_error();
+                        if ( ! $error ) {
+                                return;
+                        }
+
+                        if ( wp_is_recovery_mode() ) {
+                                // If the error was stored and thus the extension paused,
+                                // redirect the request to catch multiple errors in one go.
+                                if ( $this->store_error( $error ) ) {
+                                        $this->redirect_protected();
+                                }
+                        } else {
+                                wp_recovery_mode()->handle_error( $error );
+                        }
+
+                        // Display the PHP error template.
+                        $this->display_error_template();
+                } catch ( Exception $e ) {
+                        // Catch exceptions and remain silent.
+                }
+        }
+
+        /**
+         * Detects the error causing the crash if it should be handled.
+         *
+         * @since 5.2.0
+         *
+         * @return array|null Error that was triggered, or null if no error received or if the error should not be handled.
+         */
+        protected function detect_error() {
+                $error = error_get_last();
+
+                // No error, just skip the error handling code.
+                if ( null === $error ) {
+                        return null;
+                }
+
+                // Bail if this error should not be handled.
+                if ( ! wp_should_handle_error( $error ) ) {
+                        return null;
+                }
+
+                return $error;
+        }
+
+        /**
+         * Stores the given error so that the extension causing it is paused.
+         *
+         * @since 5.2.0
+         *
+         * @param array $error Error that was triggered.
+         *
+         * @return bool True if the error was stored successfully, false otherwise.
+         */
+        protected function store_error( $error ) {
+                return wp_record_extension_error( $error );
+        }
+
+        /**
+         * Redirects the current request to allow recovering multiple errors in one go.
+         *
+         * The redirection will only happen when on a protected endpoint.
+         *
+         * It must be ensured that this method is only called when an error actually occurred and will not occur on the
+         * next request again. Otherwise it will create a redirect loop.
+         *
+         * @since 5.2.0
+         */
+        protected function redirect_protected() {
+                // Pluggable is usually loaded after plugins, so we manually include it here for redirection functionality.
+                if ( ! function_exists( 'wp_redirect' ) ) {
+                        include ABSPATH . WPINC . '/pluggable.php';
+                }
+
+                $scheme = is_ssl() ? 'https://' : 'http://';
+
+                $url = "{$scheme}{$_SERVER['HTTP_HOST']}{$_SERVER['REQUEST_URI']}";
+                wp_redirect( $url );
+                exit;
+        }
+
+        /**
+         * Displays the PHP error template and sends the HTTP status code, typically 500.
+         *
+         * A drop-in 'php-error.php' can be used as a custom template. This drop-in should control the HTTP status code and
+         * print the HTML markup indicating that a PHP error occurred. Note that this drop-in may potentially be executed
+         * very early in the WordPress bootstrap process, so any core functions used that are not part of
+         * `wp-includes/load.php` should be checked for before being called.
+         *
+         * If no such drop-in is available, this will call {@see WP_Fatal_Error_Handler::display_default_error_template()}.
+         *
+         * @since 5.2.0
+         */
+        protected function display_error_template() {
+                if ( defined( 'WP_CONTENT_DIR' ) ) {
+                        // Load custom PHP error template, if present.
+                        $php_error_pluggable = WP_CONTENT_DIR . '/php-error.php';
+                        if ( is_readable( $php_error_pluggable ) ) {
+                                require_once $php_error_pluggable;
+
+                                return;
+                        }
+                }
+
+                // Otherwise, display the default error template.
+                $this->display_default_error_template();
+        }
+
+        /**
+         * Displays the default PHP error template.
+         *
+         * This method is called conditionally if no 'php-error.php' drop-in is available.
+         *
+         * It calls {@see wp_die()} with a message indicating that the site is experiencing technical difficulties and a
+         * login link to the admin backend. The {@see 'wp_php_error_message'} and {@see 'wp_php_error_args'} filters can
+         * be used to modify these parameters.
+         *
+         * @since 5.2.0
+         */
+        protected function display_default_error_template() {
+                if ( ! function_exists( '__' ) ) {
+                        wp_load_translations_early();
+                }
+
+                if ( ! function_exists( 'wp_die' ) ) {
+                        require_once ABSPATH . WPINC . '/functions.php';
+                }
+
+                $message = __( 'The site is experiencing technical difficulties.' );
+
+                $args = array(
+                        'response' => 500,
+                        'exit'     => false,
+                );
+
+                /**
+                 * Filters the message that the default PHP error template displays.
+                 *
+                 * @since 5.2.0
+                 *
+                 * @param string $message HTML error message to display.
+                 */
+                $message = apply_filters( 'wp_php_error_message', $message );
+
+                /**
+                 * Filters the arguments passed to {@see wp_die()} for the default PHP error template.
+                 *
+                 * @since 5.2.0
+                 *
+                 * @param array $args Associative array of arguments passed to `wp_die()`. By default these contain a
+                 *                    'response' key, and optionally 'link_url' and 'link_text' keys.
+                 */
+                $args = apply_filters( 'wp_php_error_args', $args );
+
+                wp_die( $message, '', $args );
+        }
+}

new file src/wp-includes/class-wp-paused-extensions-storage.php

@@ +1 @@
+<?php
+/**
+ * Error Protection API: WP_Paused_Extensions_Storage class
+ *
+ * @package WordPress
+ * @since 5.2.0
+ */
+
+/**
+ * Core class used for storing paused extensions.
+ *
+ * @since 5.2.0
+ */
+class WP_Paused_Extensions_Storage {
+
+        /**
+         * Option name for storing paused extensions.
+         *
+         * @since 5.2.0
+         * @var string
+         */
+        protected $option_name;
+
+        /**
+         * Constructor.
+         *
+         * @since 5.2.0
+         */
+        public function __construct() {
+                $this->option_name = wp_recovery_mode()->get_recovery_mode_session_id() . '_paused_extensions';
+        }
+
+        /**
+         * Records an extension error.
+         *
+         * Only one error is stored per extension, with subsequent errors for the same extension overriding the
+         * previously stored error.
+         *
+         * @since 5.2.0
+         *
+         * @param string $type      Extension type. Either 'plugin' or 'theme'.
+         * @param string $extension Plugin or theme directory name.
+         * @param array  $error     {
+         *     Error that was triggered.
+         *
+         *     @type string $type    The error type.
+         *     @type string $file    The name of the file in which the error occurred.
+         *     @type string $line    The line number in which the error occurred.
+         *     @type string $message The error message.
+         * }
+         * @return bool True on success, false on failure.
+         */
+        public function record( $type, $extension, $error ) {
+                if ( ! $this->is_api_loaded() ) {
+                        return false;
+                }
+
+                if ( is_multisite() && is_site_meta_supported() ) {
+                        $meta_key = $this->get_site_meta_key( $type, $extension );
+
+                        // Do not update if the error is already stored.
+                        if ( get_site_meta( get_current_blog_id(), $meta_key, true ) === $error ) {
+                                return true;
+                        }
+
+                        return (bool) update_site_meta( get_current_blog_id(), $meta_key, $error );
+                }
+
+                $paused_extensions = $this->get_all();
+
+                // Do not update if the error is already stored.
+                if ( isset( $paused_extensions[ $type ][ $extension ] ) && $paused_extensions[ $type ][ $extension ] === $error ) {
+                        return true;
+                }
+
+                $paused_extensions[ $type ][ $extension ] = $error;
+
+                return update_option( $this->option_name, $paused_extensions );
+        }
+
+        /**
+         * Forgets a previously recorded extension error.
+         *
+         * @since 5.2.0
+         *
+         * @param string $type Extension type. Either 'plugin' or 'theme'.
+         * @param string $extension Plugin or theme directory name.
+         * @return bool True on success, false on failure.
+         */
+        public function forget( $type, $extension ) {
+                if ( ! $this->is_api_loaded() ) {
+                        return false;
+                }
+
+                if ( is_multisite() && is_site_meta_supported() ) {
+                        $meta_key = $this->get_site_meta_key( $type, $extension );
+
+                        // Do not delete if no error is stored.
+                        if ( get_site_meta( get_current_blog_id(), $meta_key ) === array() ) {
+                                return true;
+                        }
+
+                        return delete_site_meta( get_current_blog_id(), $meta_key );
+                }
+
+                $paused_extensions = $this->get_all();
+
+                // Do not delete if no error is stored.
+                if ( ! isset( $paused_extensions[ $type ][ $extension ] ) ) {
+                        return true;
+                }
+
+                unset( $paused_extensions[ $type ][ $extension ] );
+
+                if ( empty( $paused_extensions[ $type ] ) ) {
+                        unset( $paused_extensions[ $type ] );
+                }
+
+                // Clean up the entire option if we're removing the only error.
+                if ( ! $paused_extensions ) {
+                        return delete_option( $this->option_name );
+                }
+
+                return update_option( $this->option_name, $paused_extensions );
+        }
+
+        /**
+         * Gets the error for an extension, if paused.
+         *
+         * @since 5.2.0
+         *
+         * @param string $type Extension type. Either 'plugin' or 'theme'.
+         * @param string $extension Plugin or theme directory name.
+         * @return array|null Error that is stored, or null if the extension is not paused.
+         */
+        public function get( $type, $extension ) {
+                if ( ! $this->is_api_loaded() ) {
+                        return null;
+                }
+
+                if ( is_multisite() && is_site_meta_supported() ) {
+                        $error = get_site_meta( get_current_blog_id(), $this->get_site_meta_key( $type, $extension ), true );
+                        if ( ! $error ) {
+                                return null;
+                        }
+
+                        return $error;
+                }
+
+                $paused_extensions = $this->get_all( $type );
+
+                if ( ! isset( $paused_extensions[ $extension ] ) ) {
+                        return null;
+                }
+
+                return $paused_extensions[ $extension ];
+        }
+
+        /**
+         * Gets the paused extensions with their errors.
+         *
+         * @since 5.2.0
+         *
+         * @param string $type Optionally, limit to extensions of the given type.
+         *
+         * @return array Associative array of $type => array( $extension => $error ).
+         *               If the extension type is provided, just the error entries are returned.
+         */
+        public function get_all( $type = '' ) {
+                if ( ! $this->is_api_loaded() ) {
+                        return array();
+                }
+
+                if ( is_multisite() && is_site_meta_supported() ) {
+                        $site_metadata = get_site_meta( get_current_blog_id() );
+
+                        $paused_extensions = array();
+                        foreach ( $site_metadata as $meta_key => $meta_values ) {
+                                if ( 0 !== strpos( $meta_key, $this->option_name . '_' ) ) {
+                                        continue;
+                                }
+
+                                $error = maybe_unserialize( array_shift( $meta_values ) );
+
+                                $without_prefix = substr( $meta_key, strlen( $this->option_name . '_' ) );
+                                $parts          = explode( '_', $without_prefix, 2 );
+
+                                if ( ! isset( $parts[1] ) ) {
+                                        continue;
+                                }
+
+                                $paused_extensions[ $parts[0] ][ $parts[1] ] = $error;
+                        }
+                } else {
+                        $paused_extensions = (array) get_option( $this->option_name, array() );
+                }
+
+                if ( $type ) {
+                        return isset( $paused_extensions[ $type ] ) ? $paused_extensions[ $type ] : array();
+                }
+
+                return $paused_extensions;
+        }
+
+        /**
+         * Gets the site meta query clause for querying sites with paused extensions.
+         *
+         * @since 5.2.0
+         *
+         * @param string $type      Extension type. Either 'plugin' or 'theme'.
+         * @param string $extension Plugin or theme directory name.
+         * @return array A single clause to add to a meta query.
+         */
+        public function get_site_meta_query_clause( $type, $extension ) {
+                return array(
+                        'key'         => $this->get_site_meta_key( $type, $extension ),
+                        'compare_key' => '=',
+                );
+        }
+
+        /**
+         * Checks whether the underlying API to store paused extensions is loaded.
+         *
+         * @since 5.2.0
+         *
+         * @return bool True if the API is loaded, false otherwise.
+         */
+        protected function is_api_loaded() {
+                if ( is_multisite() ) {
+                        return function_exists( 'is_site_meta_supported' ) && function_exists( 'get_site_meta' );
+                }
+
+                return function_exists( 'get_option' );
+        }
+
+        /**
+         * Get the site meta key for storing extension errors on Multisite.
+         *
+         * @since 5.2.0
+         *
+         * @param string $type
+         * @param string $extension
+         *
+         * @return string
+         */
+        private function get_site_meta_key( $type, $extension ) {
+                return $this->option_name . '_' . $type . '_' . $extension;
+        }
+}

new file src/wp-includes/class-wp-recovery-mode-controller.php

@@ +1 @@
+<?php
+
+/**
+ * Interface WP_Recovery_Mode_Controller
+ */
+interface WP_Recovery_Mode_Controller {
+
+        /**
+         * Run the processor.
+         *
+         * This can be used for adding hooks, parsing the global request data,
+         * exiting the request due to errors, etc..
+         *
+         * @since 5.2.0
+         *
+         * @return void
+         */
+        public function run();
+
+        /**
+         * Handle a fatal error occurring when recovery mode is not yet active.
+         *
+         * @param array $error Error details {@see error_get_last()}
+         *
+         * @return void
+         */
+        public function handle_error( array $error );
+
+        /**
+         * Is recovery mode active.
+         *
+         * @since 5.2.0
+         *
+         * @return bool
+         */
+        public function is_recovery_mode_active();
+
+        /**
+         * Get the recovery mode session ID.
+         *
+         * @since 5.2.0
+         *
+         * @return string|false
+         */
+        public function get_recovery_mode_session_id();
+}

new file src/wp-includes/class-wp-recovery-mode-cookie-service.php

@@ +1 @@
+<?php
+
+final class WP_Recovery_Mode_Cookie_Service {
+
+        /** @var string */
+        private $name;
+
+        /** @var string */
+        private $domain;
+
+        /** @var string */
+        private $path;
+
+        /** @var string */
+        private $site_path;
+
+        /**
+         * WP_Recovery_Mode_Cookie_Service constructor.
+         *
+         * @param array $opts
+         */
+        public function __construct( array $opts = array() ) {
+                $opts = wp_parse_args( $opts, array(
+                        'name'      => RECOVERY_MODE_COOKIE,
+                        'domain'    => COOKIE_DOMAIN,
+                        'path'      => COOKIEPATH,
+                        'site_path' => SITECOOKIEPATH,
+                ) );
+
+                $this->name      = $opts['name'];
+                $this->domain    = $opts['domain'];
+                $this->path      = $opts['path'];
+                $this->site_path = $opts['site_path'];
+        }
+
+        /**
+         * Is the recovery mode cookie set.
+         *
+         * @since 5.2.0
+         *
+         * @return bool
+         */
+        public function is_cookie_set() {
+                return ! empty( $_COOKIE[ $this->name ] );
+        }
+
+        /**
+         * Set the recovery mode cookie.
+         *
+         * This must be immediately followed by exiting the request.
+         *
+         * @since 5.2.0
+         */
+        public function set_cookie() {
+
+                $value = $this->generate_cookie();
+
+                setcookie( $this->name, $value, 0, $this->path, $this->domain, is_ssl(), true );
+
+                if ( $this->path !== $this->site_path ) {
+                        setcookie( $this->name, $value, 0, $this->site_path, $this->domain, is_ssl(), true );
+                }
+        }
+
+        /**
+         * Clear the recovery mode cookie.
+         *
+         * @sicne 5.2.0
+         */
+        public function clear_cookie() {
+                setcookie( $this->name, ' ', time() - YEAR_IN_SECONDS, $this->path, $this->domain );
+                setcookie( $this->name, ' ', time() - YEAR_IN_SECONDS, $this->site_path, $this->domain );
+        }
+
+        /**
+         * Validate the recovery mode cookie.
+         *
+         * @since 5.2.0
+         *
+         * @param string $cookie Optionally specify the cookie string.
+         *                       If omitted, it will be retrieved from the super global.
+         *
+         * @return true|WP_Error
+         */
+        public function validate_cookie( $cookie = '' ) {
+
+                if ( ! $cookie ) {
+                        if ( empty( $_COOKIE[ $this->name ] ) ) {
+                                return new WP_Error( 'no_cookie', __( 'No cookie present.' ) );
+                        }
+
+                        $cookie = $_COOKIE[ $this->name ];
+                }
+
+                $parts = $this->parse_cookie( $cookie );
+
+                if ( is_wp_error( $parts ) ) {
+                        return $parts;
+                }
+
+                list( , $created_at, $random, $signature ) = $parts;
+
+                if ( ! ctype_digit( $created_at ) ) {
+                        return new WP_Error( 'invalid_created_at', __( 'Invalid cookie format.' ) );
+                }
+
+                /**
+                 * Filter the length of time a Recovery Mode cookie is valid for.
+                 *
+                 * @since 5.2.0
+                 *
+                 * @param int $length Length in seconds.
+                 */
+                $length = apply_filters( 'recovery_mode_cookie_length', WEEK_IN_SECONDS );
+
+                if ( time() > $created_at + $length ) {
+                        return new WP_Error( 'expired', __( 'Cookie expired.' ) );
+                }
+
+                $to_sign = sprintf( 'recovery_mode|%s|%s', $created_at, $random );
+                $hashed  = $this->recovery_mode_hash( $to_sign );
+
+                if ( ! hash_equals( $signature, $hashed ) ) {
+                        return new WP_Error( 'signature_mismatch', __( 'Invalid cookie.' ) );
+                }
+
+                return true;
+        }
+
+        /**
+         * Get the session identifier from the cookie.
+         *
+         * The cookie should be validated before calling this API.
+         *
+         * @since 5.2.0
+         *
+         * @param string $cookie Optionally specify the cookie string.
+         *                       If omitted, it will be retrieved from the super global.
+         *
+         * @return string|WP_Error
+         */
+        public function get_session_id_from_cookie( $cookie = '' ) {
+                if ( ! $cookie ) {
+                        if ( empty( $_COOKIE[ $this->name ] ) ) {
+                                return new WP_Error( 'no_cookie' );
+                        }
+
+                        $cookie = $_COOKIE[ $this->name ];
+                }
+
+                $parts = $this->parse_cookie( $cookie );
+                if ( is_wp_error( $parts ) ) {
+                        return $parts;
+                }
+
+                list( , , $random ) = $parts;
+
+                return sha1( $random );
+        }
+
+        /**
+         * Parse the cookie into its four parts.
+         *
+         * @param string $cookie
+         *
+         * @return string[]|WP_Error
+         */
+        private function parse_cookie( $cookie ) {
+                $cookie = base64_decode( $cookie );
+                $parts  = explode( '|', $cookie );
+
+                if ( 4 !== count( $parts ) ) {
+                        return new WP_Error( 'invalid_format', __( 'Invalid cookie format.' ) );
+                }
+
+                return $parts;
+        }
+
+        /**
+         * Generate the recovery mode cookie value.
+         *
+         * The cookie is a base64 encoded string with the following format:
+         *
+         * recovery_mode|iat|rand|signature
+         *
+         * Where "recovery_mode" is a constant string,
+         * iat is the time the cookie was generated at,
+         * rand is a randomly generated password that is also used as a session identifier
+         * and signature is an hmac of the preceding 3 parts.
+         *
+         * @since 5.2.0
+         *
+         * @return string
+         */
+        private function generate_cookie() {
+
+                if ( ! function_exists( 'wp_generate_password' ) ) {
+                        require_once ABSPATH . WPINC . '/pluggable.php';
+                }
+
+                $to_sign = sprintf( 'recovery_mode|%s|%s', time(), wp_generate_password( 20, false ) );
+                $signed  = $this->recovery_mode_hash( $to_sign );
+
+                return base64_encode( sprintf( '%s|%s', $to_sign, $signed ) );
+        }
+
+        /**
+         * A form of `wp_hash()` specific to Recovery Mode.
+         *
+         * We cannot use `wp_hash()` because it is defined in `pluggable.php` which is not loaded until after plugins are loaded,
+         * which is too late to verify the recovery mode cookie.
+         *
+         * This tries to use the `AUTH` salts first, but if they aren't valid specific salts will be generated and stored.
+         *
+         * @param string $data
+         *
+         * @return string|false
+         */
+        private function recovery_mode_hash( $data ) {
+
+                if ( ! defined( 'AUTH_KEY' ) || 'put your unique phrase here' === AUTH_KEY ) {
+                        $auth_key = get_site_option( 'recovery_mode_auth_key' );
+
+                        if ( ! $auth_key ) {
+                                if ( ! function_exists( 'wp_generate_password' ) ) {
+                                        require_once ABSPATH . WPINC . '/pluggable.php';
+                                }
+
+                                $auth_key = wp_generate_password( 64, true, true );
+                                update_site_option( 'recovery_mode_auth_key', $auth_key );
+                        }
+                } else {
+                        $auth_key = AUTH_KEY;
+                }
+
+                if ( ! defined( 'AUTH_SALT' ) || 'put your unique phrase here' === AUTH_SALT || $auth_key === AUTH_SALT ) {
+                        $auth_salt = get_site_option( 'recovery_mode_auth_salt' );
+
+                        if ( ! $auth_salt ) {
+                                if ( ! function_exists( 'wp_generate_password' ) ) {
+                                        require_once ABSPATH . WPINC . '/pluggable.php';
+                                }
+
+                                $auth_salt = wp_generate_password( 64, true, true );
+                                update_site_option( 'recovery_mode_auth_salt', $auth_salt );
+                        }
+                } else {
+                        $auth_salt = AUTH_SALT;
+                }
+
+                $secret = $auth_key . $auth_salt;
+
+                return hash_hmac( 'sha1', $data, $secret );
+        }
+}

new file src/wp-includes/class-wp-recovery-mode-email-controller.php

@@ +1 @@
+<?php
+
+final class WP_Recovery_Mode_Email_Controller implements WP_Recovery_Mode_Controller {
+
+        const LOGIN_ACTION_ENTER = 'enter_recovery_mode';
+        const LOGIN_ACTION_ENTERED = 'entered_recovery_mode';
+
+        /** @var WP_Recovery_Mode_Cookie_Service */
+        private $cookies;
+
+        /** @var WP_Recovery_Mode_Key_Service */
+        private $keys;
+
+        /** @var bool */
+        private $is_active;
+
+        /** @var string|false */
+        private $session_id = false;
+
+        /**
+         * WP_Recovery_Mode_Email_Processor constructor.
+         *
+         * @param WP_Recovery_Mode_Cookie_Service $cookies
+         * @param WP_Recovery_Mode_Key_Service    $keys
+         */
+        public function __construct( WP_Recovery_Mode_Cookie_Service $cookies, WP_Recovery_Mode_Key_Service $keys ) {
+                $this->cookies = $cookies;
+                $this->keys    = $keys;
+        }
+
+        /**
+         * @inheritdoc
+         */
+        public function is_recovery_mode_active() {
+                return $this->is_active;
+        }
+
+        /**
+         * @inheritdoc
+         */
+        public function get_recovery_mode_session_id() {
+                return $this->session_id;
+        }
+
+        /**
+         * @inheritdoc
+         */
+        public function run() {
+                add_action( 'clear_auth_cookie', array( $this, 'on_clear_auth_cookie' ) );
+
+                if ( $this->cookies->is_cookie_set() ) {
+                        $this->handle_cookie();
+
+                        return;
+                }
+
+                if ( isset( $GLOBALS['pagenow'] ) && 'wp-login.php' === $GLOBALS['pagenow'] ) {
+                        $this->handle_begin_link();
+                }
+        }
+
+        /**
+         * When a fatal error occurs, send the recovery mode email.
+         *
+         * @since 5.2.0
+         *
+         * @param array $error Error details from {@see error_get_last()}
+         */
+        public function handle_error( array $error ) {
+                if ( is_protected_endpoint() ) {
+                        $this->maybe_send_recovery_mode_email( $error );
+                }
+        }
+
+        /**
+         * Clear the recovery mode cookie when the auth cookies are cleared.
+         *
+         * @since 5.2.0
+         */
+        public function on_clear_auth_cookie() {
+                /** This filter is documented in wp-includes/pluggable.php */
+                if ( ! apply_filters( 'send_auth_cookies', true ) ) {
+                        return;
+                }
+
+                $this->cookies->clear_cookie();
+        }
+
+        /**
+         * Handle checking for the recovery mode cookie and validating it.
+         *
+         * @since 5.2.0
+         */
+        private function handle_cookie() {
+                $validated = $this->cookies->validate_cookie();
+
+                if ( is_wp_error( $validated ) ) {
+                        $this->cookies->clear_cookie();
+
+                        wp_die( $validated, '' );
+                }
+
+                $this->is_active  = true;
+                $this->session_id = $this->cookies->get_session_id_from_cookie();
+        }
+
+        /**
+         * Enter recovery mode when the user hits wp-login.php with a valid recovery mode link.
+         *
+         * @since 5.2.0
+         */
+        private function handle_begin_link() {
+                if ( ! isset( $_GET['action'], $_GET['rm_key'] ) || self::LOGIN_ACTION_ENTER !== $_GET['action'] ) {
+                        return;
+                }
+
+                $validated = $this->keys->validate_recovery_mode_key( $_GET['rm_key'], $this->get_link_valid_for_interval() );
+
+                if ( is_wp_error( $validated ) ) {
+                        wp_die( $validated, '' );
+                }
+
+                $this->cookies->set_cookie();
+
+                // This should be loaded by set_recovery_mode_cookie() but load it again to be safe.
+                if ( ! function_exists( 'wp_redirect' ) ) {
+                        require_once ABSPATH . WPINC . '/pluggable.php';
+                }
+
+                $url = add_query_arg( 'action', self::LOGIN_ACTION_ENTERED, wp_login_url() );
+                wp_redirect( $url );
+                die;
+        }
+
+        /**
+         * Get a URL to begin recovery mode.
+         *
+         * @since 5.2.0
+         *
+         * @param string $key Recovery Mode key created by {@see generate_and_store_recovery_mode_key()}
+         *
+         * @return string
+         */
+        private function get_recovery_mode_begin_url( $key ) {
+
+                $url = add_query_arg(
+                        array(
+                                'action' => self::LOGIN_ACTION_ENTER,
+                                'rm_key' => $key,
+                        ),
+                        wp_login_url()
+                );
+
+                /**
+                 * Filter the URL to begin recovery mode.
+                 *
+                 * @since 5.2.0
+                 *
+                 * @param string $url
+                 * @param string $key
+                 */
+                return apply_filters( 'recovery_mode_begin_url', $url, $key );
+        }
+
+        /**
+         * Get the interval the recovery mode email key is valid for.
+         *
+         * @since 5.2.0
+         *
+         * @return int Interval in seconds.
+         */
+        private function get_link_valid_for_interval() {
+
+                $rate_limit = $valid_for = $this->get_email_rate_limit();
+
+                /**
+                 * Filter the amount of time the recovery mode email link is valid for.
+                 *
+                 * The interval time must be at least as long as the email rate limit.
+                 *
+                 * @since 5.2.0
+                 *
+                 * @param int $valid_for The number of seconds the link is valid for.
+                 */
+                $valid_for = apply_filters( 'recovery_mode_email_link_valid_for_interval', $valid_for );
+
+                return max( $valid_for, $rate_limit );
+        }
+
+        /**
+         * The rate limit between sending new recovery mode email links.
+         *
+         * @since 5.2.0
+         *
+         * @return int Rate limit in seconds.
+         */
+        private function get_email_rate_limit() {
+                /**
+                 * Filter the rate limit between sending new recovery mode email links.
+                 *
+                 * @since 5.2.0
+                 *
+                 * @param int $rate_limit Time to wait in seconds. Defaults to 4 hours.
+                 */
+                return apply_filters( 'recovery_mode_email_rate_limit', 4 * HOUR_IN_SECONDS );
+        }
+
+        /**
+         * Send the recovery mode email if the rate limit has not been sent.
+         *
+         * @since 5.2.0
+         *
+         * @param array $error Error details from {@see error_get_last()}
+         *
+         * @return true|WP_Error True if email sent, WP_Error otherwise.
+         */
+        private function maybe_send_recovery_mode_email( $error ) {
+
+                $rate_limit = $this->get_email_rate_limit();
+
+                $last_sent = get_site_option( 'recovery_mode_email_last_sent' );
+
+                if ( ! $last_sent || time() > $last_sent + $rate_limit ) {
+                        $sent = $this->send_recovery_mode_email( $error );
+                        update_site_option( 'recovery_mode_email_last_sent', time() );
+
+                        if ( $sent ) {
+                                return true;
+                        }
+
+                        return new WP_Error( 'email_failed', __( 'The email could not be sent. Possible reason: your host may have disabled the mail() function.' ) );
+                }
+
+                $err_message = sprintf(
+                /* translators: 1. Last sent as a human time diff 2. Wait time as a human time diff. */
+                        __( 'A recovery link was already sent %1$s ago. Please wait another %2$s before requesting a new email.' ),
+                        human_time_diff( $last_sent ),
+                        human_time_diff( $last_sent + $rate_limit )
+                );
+
+                return new WP_Error( 'email_sent_already', $err_message );
+        }
+
+        /**
+         * Send the Recovery Mode email to the site admin email address.
+         *
+         * @since 5.2.0
+         *
+         * @param array $error Error details from {@see error_get_last()}
+         *
+         * @return bool Whether the email was sent successfully.
+         */
+        private function send_recovery_mode_email( $error ) {
+
+                $key      = $this->keys->generate_and_store_recovery_mode_key();
+                $url      = $this->get_recovery_mode_begin_url( $key );
+                $blogname = wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES );
+
+                $switched_locale = false;
+
+                // The switch_to_locale() function is loaded before it can actually be used.
+                if ( function_exists( 'switch_to_locale' ) && isset( $GLOBALS['wp_locale_switcher'] ) ) {
+                        $switched_locale = switch_to_locale( get_locale() );
+                }
+
+                $extension = wp_get_extension_for_error( $error );
+
+                if ( $extension ) {
+                        $cause   = $this->get_cause( $extension );
+                        $details = $this->get_error_details( $error );
+
+                        if ( $details ) {
+                                $header  = __( 'Error Details' );
+                                $details = "\n\n" . $header . "\n" . str_pad( '', strlen( $header ), '=' ) . "\n" . $details;
+                        }
+                } else {
+                        $cause = $details = '';
+                }
+
+                $message = __(
+                        'Howdy,
+
+Your site recently crashed on ###LOCATION### and may not be working as expected.
+###CAUSE###
+Click the link below to initiate recovery mode and fix the problem.
+
+This link expires in ###EXPIRES###.
+
+###LINK### ###DETAILS###
+'
+                );
+                $message = str_replace(
+                        array(
+                                '###LINK###',
+                                '###LOCATION###',
+                                '###EXPIRES###',
+                                '###CAUSE###',
+                                '###DETAILS###',
+                        ),
+                        array(
+                                $url,
+                                'TBD',
+                                human_time_diff( time() + $this->get_link_valid_for_interval() ),
+                                $cause ? "\n{$cause}\n" : "\n",
+                                $details,
+                        ),
+                        $message
+                );
+
+                $email = array(
+                        'to'      => $this->get_recovery_mode_email_address(),
+                        'subject' => __( '[%s] Your Site Experienced an Issue' ),
+                        'message' => $message,
+                        'headers' => '',
+                );
+
+                /**
+                 * Filter the contents of the Recovery Mode email.
+                 *
+                 * @since 5.2.0
+                 *
+                 * @param array  $email Used to build wp_mail().
+                 * @param string $key   Recovery mode key.
+                 */
+                $email = apply_filters( 'recovery_mode_email', $email, $key );
+
+                $sent = wp_mail(
+                        $email['to'],
+                        wp_specialchars_decode( sprintf( $email['subject'], $blogname ) ),
+                        $email['message'],
+                        $email['headers']
+                );
+
+                if ( $switched_locale ) {
+                        restore_previous_locale();
+                }
+
+                return $sent;
+        }
+
+        /**
+         * Get the email address to send the recovery mode link to.
+         *
+         * @since 5.2.0
+         *
+         * @return string
+         */
+        private function get_recovery_mode_email_address() {
+                if ( defined( 'RECOVERY_MODE_EMAIL' ) && is_email( RECOVERY_MODE_EMAIL ) ) {
+                        return RECOVERY_MODE_EMAIL;
+                }
+
+                return get_option( 'admin_email' );
+        }
+
+        /**
+         * Get a human readable description of the error.
+         *
+         * @since 5.2.0
+         *
+         * @param array $error Error details from {@see error_get_last()}
+         *
+         * @return string
+         */
+        private function get_error_details( $error ) {
+                $constants   = get_defined_constants( true );
+                $constants   = isset( $constants['Core'] ) ? $constants['Core'] : $constants['internal'];
+                $core_errors = array();
+
+                foreach ( $constants as $constant => $value ) {
+                        if ( 0 === strpos( $constant, 'E_' ) ) {
+                                $core_errors[ $value ] = $constant;
+                        }
+                }
+
+                if ( isset( $core_errors[ $error['type'] ] ) ) {
+                        $error['type'] = $core_errors[ $error['type'] ];
+                }
+
+                /* translators: 1: error type, 2: error line number, 3: error file name, 4: error message */
+                $error_message = __( "An error of type %1\$s in line %2\$s of the file %3\$s. \nError message: %4\$s" );
+
+                return sprintf(
+                        $error_message,
+                        $error['type'],
+                        $error['line'],
+                        $error['file'],
+                        $error['message']
+                );
+        }
+
+        /**
+         * Get the description indicating the possible cause for the error.
+         *
+         * @since 5.2.0
+         *
+         * @param array $extension The extension that caused the error.
+         *
+         * @return string
+         */
+        private function get_cause( $extension ) {
+
+                if ( 'plugin' === $extension['type'] ) {
+                        if ( ! function_exists( 'get_plugins' ) ) {
+                                require_once ABSPATH . 'wp-admin/includes/plugin.php';
+                        }
+
+                        $names = array();
+
+                        foreach ( get_plugins() as $file => $plugin ) {
+                                if ( 0 === strpos( $file, "{$extension['slug']}/" ) ) {
+                                        $names[] = $plugin['Name'];
+                                }
+                        }
+
+                        if ( ! $names ) {
+                                $names[] = $extension['slug'];
+                        }
+
+                        // Multiple plugins can technically be in the same directory.
+                        $cause = wp_sprintf( _n( 'This may be caused by the %l plugin.', 'This may be caused by the %l plugins.', count( $names ) ), $names );
+                } else {
+                        $theme = wp_get_theme( $extension['slug'] );
+                        $name  = $theme->exists() ? $theme->display( 'Name' ) : $extension['slug'];
+
+                        $cause = sprintf( __( 'This may be caused by the %s theme.' ), $name );
+                }
+
+                return $cause;
+        }
+}

new file src/wp-includes/class-wp-recovery-mode-key-service.php

@@ +1 @@
+<?php
+
+final class WP_Recovery_Mode_Key_Service {
+
+        /**
+         * Create a recovery mode key.
+         *
+         * @since 5.2.0
+         *
+         * @global PasswordHash $wp_hasher
+         *
+         * @return string Recovery mode key.
+         */
+        public function generate_and_store_recovery_mode_key() {
+
+                global $wp_hasher;
+
+                if ( ! function_exists( 'wp_generate_password' ) ) {
+                        require_once ABSPATH . WPINC . '/pluggable.php';
+                }
+
+                $key = wp_generate_password( 20, false );
+
+                /**
+                 * Fires when a recovery mode key is generated for a user.
+                 *
+                 * @since 5.2.0
+                 *
+                 * @param string $key The recovery mode key.
+                 */
+                do_action( 'generate_recovery_mode_key', $key );
+
+                if ( empty( $wp_hasher ) ) {
+                        require_once ABSPATH . WPINC . '/class-phpass.php';
+                        $wp_hasher = new PasswordHash( 8, true );
+                }
+
+                $hashed = $wp_hasher->HashPassword( $key );
+
+                update_site_option( 'recovery_key', array(
+                        'hashed_key' => $hashed,
+                        'created_at' => time(),
+                ) );
+
+                return $key;
+        }
+
+        /**
+         * Verify if the recovery mode key is correct.
+         *
+         * @since 5.2.0
+         *
+         * @param string $key The unhashed key.
+         * @param int    $ttl Time in seconds for the key to be valid for.
+         *
+         * @return true|WP_Error
+         */
+        public function validate_recovery_mode_key( $key, $ttl ) {
+
+                $record = get_site_option( 'recovery_key' );
+
+                if ( ! $record ) {
+                        return new WP_Error( 'no_recovery_key_set', __( 'Recovery Mode not initialized.' ) );
+                }
+
+                if ( ! is_array( $record ) || ! isset( $record['hashed_key'], $record['created_at'] ) ) {
+                        return new WP_Error( 'invalid_recovery_key_format', __( 'Invalid recovery key format.' ) );
+                }
+
+                if ( ! function_exists( 'wp_check_password' ) ) {
+                        require_once ABSPATH . WPINC . '/pluggable.php';
+                }
+
+                if ( ! wp_check_password( $key, $record['hashed_key'] ) ) {
+                        return new WP_Error( 'hash_mismatch', __( 'Invalid recovery key.' ) );
+                }
+
+                if ( time() > $record['created_at'] + $ttl ) {
+                        return new WP_Error( 'key_expired', __( 'Recovery key expired.' ) );
+                }
+
+                return true;
+        }
+}

src/wp-includes/class-wp-theme.php

@@ -371 +371 @@
                         $this->parent = new WP_Theme( $this->template, isset( $theme_root_template ) ? $theme_root_template : $this->theme_root, $this );
                 }
 
+                if ( wp_paused_extensions()->get( 'theme', $this->stylesheet ) && ( ! is_wp_error( $this->errors ) || ! isset( $this->errors->errors['theme_paused'] ) ) ) {
+                        $this->errors = new WP_Error( 'theme_paused', __( 'This theme failed to load properly and was paused within the admin backend.' ) );
+                }
+
                 // We're good. If we didn't retrieve from cache, set it.
                 if ( ! is_array( $cache ) ) {
                         $cache = array(

src/wp-includes/default-constants.php

@@ -302 +302 @@
         if ( ! defined( 'COOKIE_DOMAIN' ) ) {
                 define( 'COOKIE_DOMAIN', false );
         }
+
+        if ( ! defined( 'RECOVERY_MODE_COOKIE' ) ) {
+                /**
+                 * @since 5.2.0
+                 */
+                define( 'RECOVERY_MODE_COOKIE', 'wordpress_rec_' . COOKIEHASH );
+        }
 }
 
 /**

src/wp-includes/default-filters.php

@@ -578 +578 @@
 
 // Capabilities
 add_filter( 'user_has_cap', 'wp_maybe_grant_install_languages_cap', 1 );
+add_filter( 'user_has_cap', 'wp_maybe_grant_resume_extensions_caps', 1 );
 
 unset( $filter, $action );

new file src/wp-includes/error-protection.php

@@ +1 @@
+<?php
+/**
+ * Error Protection API: Functions
+ *
+ * @package WordPress
+ * @since   5.2.0
+ */
+
+/**
+ * Get the instance for storing paused extensions.
+ *
+ * @return WP_Paused_Extensions_Storage
+ */
+function wp_paused_extensions() {
+        static $wp_paused_extensions_storage = null;
+
+        if ( null === $wp_paused_extensions_storage ) {
+                $wp_paused_extensions_storage = new WP_Paused_Extensions_Storage();
+        }
+
+        return $wp_paused_extensions_storage;
+}
+
+/**
+ * Records the extension error as a database option.
+ *
+ * @since 5.2.0
+ *
+ * @param array $error Error that was triggered.
+ *
+ * @return bool Whether the error was correctly recorded.
+ */
+function wp_record_extension_error( $error ) {
+
+        $extension = wp_get_extension_for_error( $error );
+
+        if ( ! $extension ) {
+                return false;
+        }
+
+        return wp_paused_extensions()->record( $extension['type'], $extension['slug'], $error );
+}
+
+/**
+ * Get the extension that the error occurred in.
+ *
+ * @since 5.2.0
+ *
+ * @global array $wp_theme_directories
+ *
+ * @param array  $error Error that was triggered.
+ *
+ * @return array|false array( 'slug' => (string), 'type' => 'plugin' | 'theme' )
+ *                     Slug is the plugin or theme directory as opposed to the full file.
+ *                     Or false on error.
+ */
+function wp_get_extension_for_error( $error ) {
+        global $wp_theme_directories;
+
+        if ( ! isset( $error['file'] ) ) {
+                return false;
+        }
+
+        if ( ! defined( 'WP_PLUGIN_DIR' ) ) {
+                return false;
+        }
+
+        $error_file    = wp_normalize_path( $error['file'] );
+        $wp_plugin_dir = wp_normalize_path( WP_PLUGIN_DIR );
+
+        if ( 0 === strpos( $error_file, $wp_plugin_dir ) ) {
+                $path  = str_replace( $wp_plugin_dir . '/', '', $error_file );
+                $parts = explode( '/', $path );
+
+                return array( 'type' => 'plugin', 'slug' => $parts[0] );
+        }
+
+        if ( empty( $wp_theme_directories ) ) {
+                return false;
+        }
+
+        foreach ( $wp_theme_directories as $theme_directory ) {
+                $theme_directory = wp_normalize_path( $theme_directory );
+
+                if ( 0 === strpos( $error_file, $theme_directory ) ) {
+                        $path  = str_replace( $theme_directory . '/', '', $error_file );
+                        $parts = explode( '/', $path );
+
+                        return array( 'type' => 'theme', 'slug' => $parts[0] );
+                }
+        }
+
+        return false;
+}
+
+/**
+ * Forgets a previously recorded extension error again.
+ *
+ * @since 5.2.0
+ *
+ * @param string $type         Type of the extension.
+ * @param string $extension    Relative path of the extension.
+ * @param bool   $network_wide Optional. Whether to resume the plugin for the entire
+ *                             network. Default false.
+ *
+ * @return bool Whether the extension error was successfully forgotten.
+ */
+function wp_forget_extension_error( $type, $extension, $network_wide = false ) {
+
+        list( $extension ) = explode( '/', $extension );
+
+        if ( empty( $extension ) ) {
+                return false;
+        }
+
+        $storage = wp_paused_extensions();
+
+        // Handle manually since the regular APIs do not expose this functionality.
+        if ( $network_wide && is_site_meta_supported() ) {
+                $site_meta_query_clause = $storage->get_site_meta_query_clause( $type, $extension );
+                return delete_metadata( 'blog', 0, $site_meta_query_clause['key'], '', true );
+        }
+
+        return $storage->forget( $type, $extension );
+}
+
+/**
+ * Determines whether we are dealing with an error that WordPress should handle
+ * in order to protect the admin backend against WSODs.
+ *
+ * @param array $error Error information retrieved from error_get_last().
+ *
+ * @return bool Whether WordPress should handle this error.
+ */
+function wp_should_handle_error( $error ) {
+        if ( ! isset( $error['type'] ) ) {
+                return false;
+        }
+
+        $error_types_to_handle = array(
+                E_ERROR,
+                E_PARSE,
+                E_USER_ERROR,
+                E_COMPILE_ERROR,
+                E_RECOVERABLE_ERROR,
+        );
+
+        return in_array( $error['type'], $error_types_to_handle, true );
+}
+
+/**
+ * Registers the shutdown handler for fatal errors.
+ *
+ * The handler will only be registered if {@see wp_is_fatal_error_handler_enabled()} returns true.
+ *
+ * @since 5.2.0
+ */
+function wp_register_fatal_error_handler() {
+        if ( ! wp_is_fatal_error_handler_enabled() ) {
+                return;
+        }
+
+        $handler = null;
+        if ( defined( 'WP_CONTENT_DIR' ) && is_readable( WP_CONTENT_DIR . '/fatal-error-handler.php' ) ) {
+                $handler = include WP_CONTENT_DIR . '/fatal-error-handler.php';
+        }
+
+        if ( ! is_object( $handler ) || ! is_callable( array( $handler, 'handle' ) ) ) {
+                $handler = new WP_Fatal_Error_Handler();
+        }
+
+        register_shutdown_function( array( $handler, 'handle' ) );
+}
+
+/**
+ * Checks whether the fatal error handler is enabled.
+ *
+ * A constant `WP_DISABLE_FATAL_ERROR_HANDLER` can be set in `wp-config.php` to disable it, or alternatively the
+ * {@see 'wp_fatal_error_handler_enabled'} filter can be used to modify the return value.
+ *
+ * @since 5.2.0
+ *
+ * @return bool True if the fatal error handler is enabled, false otherwise.
+ */
+function wp_is_fatal_error_handler_enabled() {
+        $enabled = ! defined( 'WP_DISABLE_FATAL_ERROR_HANDLER' ) || ! WP_DISABLE_FATAL_ERROR_HANDLER;
+
+        /**
+         * Filters whether the fatal error handler is enabled.
+         *
+         * @since 5.2.0
+         *
+         * @param bool $enabled True if the fatal error handler is enabled, false otherwise.
+         */
+        return apply_filters( 'wp_fatal_error_handler_enabled', $enabled );
+}
+
+/**
+ * Access the WordPress Recovery Mode controller.
+ *
+ * @since 5.2.0
+ *
+ * @return WP_Recovery_Mode_Controller
+ */
+function wp_recovery_mode() {
+        static $wp_recovery_mode;
+
+        if ( ! $wp_recovery_mode ) {
+                $default = new WP_Recovery_Mode_Email_Controller(
+                        new WP_Recovery_Mode_Cookie_Service(),
+                        new WP_Recovery_Mode_Key_Service()
+                );
+
+                if ( defined( 'WP_CONTENT_DIR' ) && is_readable( WP_CONTENT_DIR . '/recovery-mode-controller.php' ) ) {
+                        $wp_recovery_mode = include WP_CONTENT_DIR . '/recovery-mode-controller.php';
+                }
+
+                if ( ! $wp_recovery_mode instanceof WP_Recovery_Mode_Controller ) {
+                        $wp_recovery_mode = $default;
+                }
+
+                /**
+                 * Filter the recovery mode controller.
+                 *
+                 * This filter can only be used by mu-plugins.
+                 *
+                 * @since 5.2.0
+                 *
+                 * @param WP_Recovery_Mode_Controller $wp_recovery_mode
+                 */
+                $wp_recovery_mode = apply_filters( 'wp_recovery_mode_controller', $wp_recovery_mode );
+
+                if ( ! $wp_recovery_mode instanceof WP_Recovery_Mode_Controller ) {
+                        $wp_recovery_mode = $default;
+                }
+        }
+
+        return $wp_recovery_mode;
+}

src/wp-includes/load.php

@@ -697 +697 @@
                 }
         }
 
+        /*
+         * Remove plugins from the list of active plugins when we're on an endpoint
+         * that should be protected against WSODs and the plugin is paused.
+         */
+        if ( wp_is_recovery_mode() ) {
+                $plugins = wp_skip_paused_plugins( $plugins );
+        }
+
+        return $plugins;
+}
+
+/**
+ * Filters a given list of plugins, removing any paused plugins from it.
+ *
+ * @since 5.2.0
+ *
+ * @param array $plugins List of absolute plugin main file paths.
+ * @return array Filtered value of $plugins, without any paused plugins.
+ */
+function wp_skip_paused_plugins( array $plugins ) {
+        $paused_plugins = wp_paused_extensions()->get_all( 'plugin' );
+
+        if ( empty( $paused_plugins ) ) {
+                return $plugins;
+        }
+
+        foreach ( $plugins as $index => $plugin ) {
+                list( $plugin ) = explode( '/', plugin_basename( $plugin ) );
+
+                if ( array_key_exists( $plugin, $paused_plugins ) ) {
+                        unset( $plugins[ $index ] );
+
+                        // Store list of paused plugins for displaying an admin notice.
+                        $GLOBALS['_paused_plugins'][ $plugin ] = $paused_plugins[ $plugin ];
+                }
+        }
+
         return $plugins;
 }
 
@@ -725 +762 @@
 
         $themes[] = TEMPLATEPATH;
 
+        /*
+         * Remove themes from the list of active themes when we're on an endpoint
+         * that should be protected against WSODs and the theme is paused.
+         */
+        if ( wp_is_recovery_mode() ) {
+                $themes = wp_skip_paused_themes( $themes );
+
+                // If no active and valid themes exist, skip loading themes.
+                if ( empty( $themes ) ) {
+                        add_filter( 'wp_using_themes', '__return_false' );
+                }
+        }
+
+        return $themes;
+}
+
+/**
+ * Filters a given list of themes, removing any paused themes from it.
+ *
+ * @since 5.2.0
+ *
+ * @param array $themes List of absolute theme directory paths.
+ * @return array Filtered value of $themes, without any paused themes.
+ */
+function wp_skip_paused_themes( array $themes ) {
+        $paused_themes = wp_paused_extensions()->get_all( 'theme' );
+
+        if ( empty( $paused_themes ) ) {
+                return $themes;
+        }
+
+        foreach ( $themes as $index => $theme ) {
+                $theme = basename( $theme );
+
+                if ( array_key_exists( $theme, $paused_themes ) ) {
+                        unset( $themes[ $index ] );
+
+                        // Store list of paused themes for displaying an admin notice.
+                        $GLOBALS['_paused_themes'][ $theme ] = $paused_themes[ $theme ];
+                }
+        }
+
         return $themes;
 }
 
+/**
+ * Is WordPress in Recovery Mode.
+ *
+ * In this mode, plugins or themes that cause WSODs will be paused.
+ *
+ * @since 5.2.0
+ *
+ * @return bool
+ */
+function wp_is_recovery_mode() {
+        return wp_recovery_mode()->is_recovery_mode_active();
+}
+
+/**
+ * Determines whether we are currently on an endpoint that should be protected against WSODs.
+ *
+ * @since 5.2.0
+ *
+ * @return bool True if the current endpoint should be protected.
+ */
+function is_protected_endpoint() {
+        // Protect login pages.
+        if ( isset( $GLOBALS['pagenow'] ) && 'wp-login.php' === $GLOBALS['pagenow'] ) {
+                return true;
+        }
+
+        // Protect the admin backend.
+        if ( is_admin() && ! wp_doing_ajax() ) {
+                return true;
+        }
+
+        // Protect AJAX actions that could help resolve a fatal error should be available.
+        if ( is_protected_ajax_action() ) {
+                return true;
+        }
+
+        /**
+         * Filters whether the current request is against a protected endpoint.
+         *
+         * This filter is only fired when an endpoint is requested which is not already protected by
+         * WordPress core. As such, it exclusively allows providing further protected endpoints in
+         * addition to the admin backend, login pages and protected AJAX actions.
+         *
+         * @since 5.2.0
+         *
+         * @param bool $is_protected_endpoint Whether the currently requested endpoint is protected. Default false.
+         */
+        return (bool) apply_filters( 'is_protected_endpoint', false );
+}
+
+/**
+ * Determines whether we are currently handling an AJAX action that should be protected against WSODs.
+ *
+ * @since 5.2.0
+ *
+ * @return bool True if the current AJAX action should be protected.
+ */
+function is_protected_ajax_action() {
+        if ( ! wp_doing_ajax() ) {
+                return false;
+        }
+
+        if ( ! isset( $_REQUEST['action'] ) ) {
+                return false;
+        }
+
+        $actions_to_protect = array(
+                'edit-theme-plugin-file', // Saving changes in the core code editor.
+                'heartbeat',              // Keep the heart beating.
+                'install-plugin',         // Installing a new plugin.
+                'install-theme',          // Installing a new theme.
+                'search-plugins',         // Searching in the list of plugins.
+                'search-install-plugins', // Searching for a plugin in the plugin install screen.
+                'update-plugin',          // Update an existing plugin.
+                'update-theme',           // Update an existing theme.
+        );
+
+        /**
+         * Filters the array of protected AJAX actions.
+         *
+         * This filter is only fired when doing AJAX and the AJAX request has an 'action' property.
+         *
+         * @since 5.2.0
+         *
+         * @param array $actions_to_protect Array of strings with AJAX actions to protect.
+         */
+        $actions_to_protect = (array) apply_filters( 'wp_protected_ajax_actions', $actions_to_protect );
+
+        if ( ! in_array( $_REQUEST['action'], $actions_to_protect, true ) ) {
+                return false;
+        }
+
+        return true;
+}
+
 /**
  * Set internal encoding.
  *

src/wp-login.php

@@ -439 +439 @@
 }
 
 // Validate action so as to default to the login screen.
-if ( ! in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'confirmaction' ), true ) && false === has_filter( 'login_form_' . $action ) ) {
+if ( ! in_array( $action, array( 'postpass', 'logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login', 'confirmaction', WP_Recovery_Mode_Email_Controller::LOGIN_ACTION_ENTERED ), true ) && false === has_filter( 'login_form_' . $action ) ) {
         $action = 'login';
 }
 
@@ -1029 +1029 @@
                                 $errors->add( 'registered', __( 'Registration complete. Please check your email.' ), 'message' );
                         } elseif ( strpos( $redirect_to, 'about.php?updated' ) ) {
                                 $errors->add( 'updated', __( '<strong>You have successfully updated WordPress!</strong> Please log back in to see what&#8217;s new.' ), 'message' );
+                        } elseif ( WP_Recovery_Mode_Email_Controller::LOGIN_ACTION_ENTERED === $action ) {
+                                $errors->add( 'enter_recovery_mode', __( 'Recovery Mode Initialized. Please login to continue.' ), 'message' );
                         }
                 }
 

src/wp-settings.php

@@ -17 +17 @@
 
 // Include files required for initialization.
 require( ABSPATH . WPINC . '/load.php' );
+require( ABSPATH . WPINC . '/class-wp-paused-extensions-storage.php' );
+require( ABSPATH . WPINC . '/class-wp-fatal-error-handler.php' );
+require( ABSPATH . WPINC . '/error-protection.php' );
 require( ABSPATH . WPINC . '/default-constants.php' );
 require_once( ABSPATH . WPINC . '/plugin.php' );
 
+// Make sure we register the shutdown handler for fatal errors as soon as possible.
+wp_register_fatal_error_handler();
+
 /*
  * These can't be directly globalized in version.php. When updating,
  * we're including version.php from another installation and don't want
@@ -261 +267 @@
 require( ABSPATH . WPINC . '/blocks/search.php' );
 require( ABSPATH . WPINC . '/blocks/shortcode.php' );
 require( ABSPATH . WPINC . '/blocks/tag-cloud.php' );
+require( ABSPATH . WPINC . '/class-wp-recovery-mode-cookie-service.php' );
+require( ABSPATH . WPINC . '/class-wp-recovery-mode-key-service.php' );
+require( ABSPATH . WPINC . '/class-wp-recovery-mode-controller.php' );
+require( ABSPATH . WPINC . '/class-wp-recovery-mode-email-controller.php' );
 
 $GLOBALS['wp_embed'] = new WP_Embed();
 
@@ -340 +350 @@
 // Register the default theme directory root
 register_theme_directory( get_theme_root() );
 
+// Handle users requesting a recovery mode link and initiating recovery mode.
+wp_recovery_mode()->run();
+
 // Load active plugins.
 foreach ( wp_get_active_and_valid_plugins() as $plugin ) {
         wp_register_plugin_realpath( $plugin );
@@ -528 +541 @@
  * @since 3.0.0
  */
 do_action( 'wp_loaded' );
+
+/*
+ * Store the fact that we could successfully execute the entire WordPress
+ * lifecycle. This is used to skip the premature shutdown handler, as it cannot
+ * be unregistered.
+ */
+if ( ! defined( 'WP_EXECUTION_SUCCEEDED' ) ) {
+        define( 'WP_EXECUTION_SUCCEEDED', true );
+}

new file tests/phpunit/tests/recovery-mode.php

@@ +1 @@
+<?php
+
+class Tests_Recovery_Mode extends WP_UnitTestCase {
+
+        private static $subscriber;
+        private static $administrator;
+
+        public static function setUpBeforeClass() {
+                self::$subscriber    = self::factory()->user->create( array( 'role' => 'subscriber' ) );
+                self::$administrator = self::factory()->user->create( array( 'role' => 'administrator' ) );
+
+                return parent::setUpBeforeClass();
+        }
+
+        public static function tearDownAfterClass() {
+                wp_delete_user( self::$subscriber );
+                wp_delete_user( self::$administrator );
+
+                return parent::tearDownAfterClass();
+        }
+
+        public function test_generate_and_store_returns_recovery_key() {
+                $service = new WP_Recovery_Mode_Key_Service();
+                $key     = $service->generate_and_store_recovery_mode_key();
+
+                $this->assertNotWPError( $key );
+        }
+
+        public function test_verify_recovery_mode_key_returns_wp_error_if_no_key_set() {
+                $service = new WP_Recovery_Mode_Key_Service();
+                $error   = $service->validate_recovery_mode_key( 'abcd', HOUR_IN_SECONDS );
+
+                $this->assertWPError( $error );
+                $this->assertEquals( 'no_recovery_key_set', $error->get_error_code() );
+        }
+
+        public function test_verify_recovery_mode_key_returns_wp_error_if_stored_format_is_invalid() {
+                update_site_option( 'recovery_key', 'gibberish' );
+
+                $service = new WP_Recovery_Mode_Key_Service();
+                $error   = $service->validate_recovery_mode_key( 'abcd', HOUR_IN_SECONDS );
+
+                $this->assertWPError( $error );
+                $this->assertEquals( 'invalid_recovery_key_format', $error->get_error_code() );
+        }
+
+        public function test_verify_recovery_mode_key_returns_wp_error_if_empty_key() {
+                $service = new WP_Recovery_Mode_Key_Service();
+                $service->generate_and_store_recovery_mode_key();
+                $error = $service->validate_recovery_mode_key( '', HOUR_IN_SECONDS );
+
+                $this->assertWPError( $error );
+                $this->assertEquals( 'hash_mismatch', $error->get_error_code() );
+        }
+
+        public function test_verify_recovery_mode_key_returns_wp_error_if_hash_mismatch() {
+                $service = new WP_Recovery_Mode_Key_Service();
+                $service->generate_and_store_recovery_mode_key();
+                $error = $service->validate_recovery_mode_key( 'abcd', HOUR_IN_SECONDS );
+
+                $this->assertWPError( $error );
+                $this->assertEquals( 'hash_mismatch', $error->get_error_code() );
+        }
+
+        public function test_verify_recovery_mode_key_returns_wp_error_if_expired() {
+                $service = new WP_Recovery_Mode_Key_Service();
+                $key     = $service->generate_and_store_recovery_mode_key();
+
+                $record               = get_site_option( 'recovery_key' );
+                $record['created_at'] = time() - HOUR_IN_SECONDS - 30;
+                update_site_option( 'recovery_key', $record );
+
+                $error = $service->validate_recovery_mode_key( $key, HOUR_IN_SECONDS );
+
+                $this->assertWPError( $error );
+                $this->assertEquals( 'key_expired', $error->get_error_code() );
+        }
+
+        public function test_verify_recovery_mode_key_returns_true_for_valid_key() {
+                $service = new WP_Recovery_Mode_Key_Service();
+                $key     = $service->generate_and_store_recovery_mode_key();
+                $this->assertTrue( $service->validate_recovery_mode_key( $key, HOUR_IN_SECONDS ) );
+        }
+
+        public function test_validate_recovery_mode_cookie_returns_wp_error_if_invalid_format() {
+
+                $service = new WP_Recovery_Mode_Cookie_Service();
+
+                $error = $service->validate_cookie( 'gibbersih' );
+                $this->assertWPError( $error );
+                $this->assertEquals( 'invalid_format', $error->get_error_code() );
+
+                $error = $service->validate_cookie( base64_encode( 'test|data|format' ) );
+                $this->assertWPError( $error );
+                $this->assertEquals( 'invalid_format', $error->get_error_code() );
+
+                $error = $service->validate_cookie( base64_encode( 'test|data|format|to|long' ) );
+                $this->assertWPError( $error );
+                $this->assertEquals( 'invalid_format', $error->get_error_code() );
+        }
+
+        public function test_validate_recovery_mode_cookie_returns_wp_error_if_expired() {
+                $service    = new WP_Recovery_Mode_Cookie_Service();
+                $reflection = new ReflectionMethod( $service, 'recovery_mode_hash' );
+                $reflection->setAccessible( true );
+
+                $to_sign = sprintf( 'recovery_mode|%s|%s', time() - WEEK_IN_SECONDS - 30, wp_generate_password( 20, false ) );
+                $signed  = $reflection->invoke( $service, $to_sign );
+                $cookie  = base64_encode( sprintf( '%s|%s', $to_sign, $signed ) );
+
+                $error = $service->validate_cookie( $cookie );
+                $this->assertWPError( $error );
+                $this->assertEquals( 'expired', $error->get_error_code() );
+        }
+
+        public function test_validate_recovery_mode_cookie_returns_wp_error_if_signature_mismatch() {
+                $service    = new WP_Recovery_Mode_Cookie_Service();
+                $reflection = new ReflectionMethod( $service, 'generate_cookie' );
+                $reflection->setAccessible( true );
+
+                $cookie = $reflection->invoke( $service );
+                $cookie .= 'gibbersih';
+
+                $error = $service->validate_cookie( $cookie );
+                $this->assertWPError( $error );
+                $this->assertEquals( 'signature_mismatch', $error->get_error_code() );
+        }
+
+        public function test_validate_recovery_mode_cookie_returns_wp_error_if_created_at_is_invalid_format() {
+                $service    = new WP_Recovery_Mode_Cookie_Service();
+                $reflection = new ReflectionMethod( $service, 'recovery_mode_hash' );
+                $reflection->setAccessible( true );
+
+                $to_sign = sprintf( 'recovery_mode|%s|%s', 'month', wp_generate_password( 20, false ) );
+                $signed  = $reflection->invoke( $service, $to_sign );
+                $cookie  = base64_encode( sprintf( '%s|%s', $to_sign, $signed ) );
+
+                $error = $service->validate_cookie( $cookie );
+                $this->assertWPError( $error );
+                $this->assertEquals( 'invalid_created_at', $error->get_error_code() );
+        }
+
+        public function test_generate_and_validate_recovery_mode_cookie_returns_true_for_valid_cookie() {
+
+                $service    = new WP_Recovery_Mode_Cookie_Service();
+                $reflection = new ReflectionMethod( $service, 'generate_cookie' );
+                $reflection->setAccessible( true );
+
+                $this->assertTrue( $service->validate_cookie( $reflection->invoke( $service ) ) );
+        }
+}

tests/phpunit/tests/user/capabilities.php

@@ -257 +257 @@
                         'export_others_personal_data' => array( 'administrator' ),
                         'erase_others_personal_data'  => array( 'administrator' ),
                         'manage_privacy_options'      => array( 'administrator' ),
+                        'resume_plugins'              => array( 'administrator' ),
+                        'resume_themes'               => array( 'administrator' ),
 
                         'edit_categories'             => array( 'administrator', 'editor' ),
                         'delete_categories'           => array( 'administrator', 'editor' ),
@@ -296 +298 @@
                         'customize'                   => array( 'administrator' ),
                         'delete_site'                 => array( 'administrator' ),
                         'add_users'                   => array( 'administrator' ),
+                        'resume_plugins'              => array( 'administrator' ),
+                        'resume_themes'               => array( 'administrator' ),
 
                         'edit_categories'             => array( 'administrator', 'editor' ),
                         'delete_categories'           => array( 'administrator', 'editor' ),
@@ -454 +458 @@
                         // Singular object meta capabilities (where an object ID is passed) are not tested:
                         $expected['activate_plugin'],
                         $expected['deactivate_plugin'],
+                        $expected['resume_plugin'],
                         $expected['remove_user'],
                         $expected['promote_user'],
                         $expected['edit_user'],