Changeset 47835 for trunk/src/wp-admin/themes.php

Timestamp:

05/20/2020 06:47:24 PM (6 years ago)

Author:

whyisjake

Message:

Security: Add user interface to auto-update themes and plugins.

Building on core update mechanisms, this adds the ability to enable automatic updates for themes and plugins to the WordPress admin.

Fixes: #50052.
Props: afercia, afragen, audrasjb, azaozz, bookdude13, davidperonne, desrosj, gmays, gmays, javiercasares, karmatosed, knutsp, mapk, mukesh27, netweb, nicolaskulka, nielsdeblaauw, paaljoachim, passoniate, pbiron, pedromendonca, whodunitagency, whyisjake, wpamitkumar, and xkon.

File:

• trunk/src/wp-admin/themes.php (modified) (3 diffs)

trunk/src/wp-admin/themes.php

@@ -81 +81 @@
                         wp_redirect( admin_url( 'themes.php?deleted=true' ) );
                 }
+                exit;
+        } elseif ( 'enable-auto-update' === $_GET['action'] ) {
+                if ( ! ( current_user_can( 'update_themes' ) && wp_is_auto_update_enabled_for_type( 'theme' ) ) ) {
+                        wp_die( __( 'Sorry, you are not allowed to enable themes automatic updates.' ) );
+                }
+
+                check_admin_referer( 'updates' );
+
+                $all_items    = wp_get_themes();
+                $auto_updates = (array) get_site_option( 'auto_update_themes', array() );
+
+                $auto_updates[] = $_GET['stylesheet'];
+                $auto_updates   = array_unique( $auto_updates );
+                // Remove themes that have been deleted since the site option was last updated.
+                $auto_updates = array_intersect( $auto_updates, array_keys( $all_items ) );
+
+                update_site_option( 'auto_update_themes', $auto_updates );
+
+                wp_redirect( admin_url( 'themes.php?enabled-auto-update=true' ) );
+
+                exit;
+        } elseif ( 'disable-auto-update' === $_GET['action'] ) {
+                if ( ! ( current_user_can( 'update_themes' ) && wp_is_auto_update_enabled_for_type( 'theme' ) ) ) {
+                        wp_die( __( 'Sorry, you are not allowed to disable themes automatic updates.' ) );
+                }
+
+                check_admin_referer( 'updates' );
+
+                $all_items    = wp_get_themes();
+                $auto_updates = (array) get_site_option( 'auto_update_themes', array() );
+
+                $auto_updates = array_diff( $auto_updates, array( $_GET['stylesheet'] ) );
+                // Remove themes that have been deleted since the site option was last updated.
+                $auto_updates = array_intersect( $auto_updates, array_keys( $all_items ) );
+
+                update_site_option( 'auto_update_themes', $auto_updates );
+
+                wp_redirect( admin_url( 'themes.php?disabled-auto-update=true' ) );
+
                 exit;
         }
@@ -228 +267 @@
         ?>
         <div id="message6" class="error"><p><?php _e( 'Theme could not be resumed because it triggered a <strong>fatal error</strong>.' ); ?></p></div>
+        <?php
+} elseif ( isset( $_GET['enabled-auto-update'] ) ) {
+        ?>
+        <div id="message7" class="updated notice is-dismissible"><p><?php _e( 'Theme will be auto-updated.' ); ?></p></div>
+        <?php
+} elseif ( isset( $_GET['disabled-auto-update'] ) ) {
+        ?>
+        <div id="message8" class="updated notice is-dismissible"><p><?php _e( 'Theme will no longer be auto-updated.' ); ?></p></div>
         <?php
 }
@@ -582 +629 @@
                                 </p>
 
+                                <# if ( data.actions.autoupdate ) { #>
+                                <p class="theme-autoupdate">
+                                <# if ( data.autoupdate ) { #>
+                                        <a href="{{{ data.actions.autoupdate }}}" class="toggle-auto-update" data-slug="{{ data.id }}" data-wp-action="disable">
+                                                <span class="dashicons dashicons-update spin hidden"></span>
+                                                <span class="label"><?php _e( 'Disable auto-updates' ); ?></span>
+                                        </a>
+                                <# } else { #>
+                                        <a href="{{{ data.actions.autoupdate }}}" class="toggle-auto-update" data-slug="{{ data.id }}" data-wp-action="enable">
+                                                <span class="dashicons dashicons-update spin hidden"></span>
+                                                <span class="label"><?php _e( 'Enable auto-updates' ); ?></span>
+                                        </a>
+                                <# } #>
+                                <# if ( data.hasUpdate ) { #>
+                                        <# if ( data.autoupdate) { #>
+                                        <span class="auto-update-time"><br /><?php echo wp_get_auto_update_message(); ?></span>
+                                        <# } else { #>
+                                        <span class="auto-update-time hidden"><br /><?php echo wp_get_auto_update_message(); ?></span>
+                                        <# } #>
+                                <# } #>
+                                        <span class="auto-updates-error hidden"><p></p></span>
+                                </p>
+                                <# } #>
+
                                 <# if ( data.hasUpdate ) { #>
                                 <div class="notice notice-warning notice-alt notice-large">