Changeset 50075

Timestamp:

01/29/2021 07:58:39 PM (6 years ago)

Author:

flixos90

Message:

Security: Allow short-circuiting the wp_update_https_detection_errors() process.

This changeset introduces a pre_wp_update_https_detection_errors filter which can be used to short-circuit the default logic for detecting problems with HTTPS support for the site, by returning a WP_Error object.

Props timothyblynjacobs.
See #47577.

Location:

trunk

Files:

• src/wp-includes/https-detection.php (modified) (1 diff)
• tests/phpunit/tests/https-detection.php (modified) (1 diff)

trunk/src/wp-includes/https-detection.php

@@ -89 +89 @@
  */
 function wp_update_https_detection_errors() {
+        /**
+         * Short-circuits the process of detecting errors related to HTTPS support.
+         *
+         * Returning a `WP_Error` from the filter will effectively short-circuit the default logic of trying a remote
+         * request to the site over HTTPS, storing the errors array from the returned `WP_Error` instead.
+         *
+         * @since 5.7.0
+         *
+         * @param null|WP_Error $pre Error object to short-circuit detection,
+         *                           or null to continue with the default behavior.
+         */
+        $support_errors = apply_filters( 'pre_wp_update_https_detection_errors', null );
+        if ( is_wp_error( $support_errors ) ) {
+                update_option( 'https_detection_errors', $support_errors->errors );
+                return;
+        }
+
         $support_errors = new WP_Error();
 

trunk/tests/phpunit/tests/https-detection.php

@@ -108 +108 @@
                 // Check that the requests are made to the correct URL.
                 $this->assertEquals( 'https://example.com/', $this->last_request_url );
+        }
+
+        /**
+         * @ticket 47577
+         */
+        public function test_pre_wp_update_https_detection_errors() {
+                // Override to enforce no errors being detected.
+                add_filter(
+                        'pre_wp_update_https_detection_errors',
+                        function() {
+                                return new WP_Error();
+                        }
+                );
+                wp_update_https_detection_errors();
+                $this->assertEquals( array(), get_option( 'https_detection_errors' ) );
+
+                // Override to enforce an error being detected.
+                add_filter(
+                        'pre_wp_update_https_detection_errors',
+                        function() {
+                                return new WP_Error(
+                                        'ssl_verification_failed',
+                                        'Bad SSL certificate.'
+                                );
+                        }
+                );
+                wp_update_https_detection_errors();
+                $this->assertEquals(
+                        array( 'ssl_verification_failed' => array( 'Bad SSL certificate.' ) ),
+                        get_option( 'https_detection_errors' )
+                );
         }