Changeset 59803 for trunk/src/wp-admin/includes/update-core.php

Timestamp:

02/11/2025 11:12:03 AM (3 months ago)

Author:

johnbillion

Message:

Security: Explicitly require the hash PHP extension and add requirement checks during installation and upgrade.

This extension provides the hash() function and support for the SHA-256 algorithm, both of which are required for upcoming security related changes. This extension is almost universally enabled, however it is technically possible to disable it on PHP 7.2 and 7.3, hence the introduction of this requirement and the corresponding requirement checks prior to installing or upgrading WordPress.

Props peterwilsoncc, ayeshrajans, dd32, SergeyBiryukov, johnbillion.

Fixes #60638, #62815, #56017

See #21022

File:

• trunk/src/wp-admin/includes/update-core.php (modified) (3 diffs)

trunk/src/wp-admin/includes/update-core.php

@@ -1010 +1010 @@
  * @global array              $_new_bundled_files
  * @global wpdb               $wpdb                   WordPress database abstraction object.
- * @global string             $wp_version
- * @global string             $required_php_version
- * @global string             $required_mysql_version
  *
  * @param string $from New release unzipped path.
@@ -1076 +1073 @@
 
     /*
-     * Import $wp_version, $required_php_version, and $required_mysql_version from the new version.
+     * Import $wp_version, $required_php_version, $required_php_extensions, and $required_mysql_version from the new version.
      * DO NOT globalize any variables imported from `version-current.php` in this function.
      *
@@ -1182 +1179 @@
     }
 
-    // Add a warning when the JSON PHP extension is missing.
-    if ( ! extension_loaded( 'json' ) ) {
-        return new WP_Error(
-            'php_not_compatible_json',
-            sprintf(
-                /* translators: 1: WordPress version number, 2: The PHP extension name needed. */
-                __( 'The update cannot be installed because WordPress %1$s requires the %2$s PHP extension.' ),
-                $wp_version,
-                'JSON'
-            )
-        );
+    if ( isset( $required_php_extensions ) && is_array( $required_php_extensions ) ) {
+        $missing_extensions = new WP_Error();
+
+        foreach ( $required_php_extensions as $extension ) {
+            if ( extension_loaded( $extension ) ) {
+                continue;
+            }
+
+            $missing_extensions->add(
+                "php_not_compatible_{$extension}",
+                sprintf(
+                    /* translators: 1: WordPress version number, 2: The PHP extension name needed. */
+                    __( 'The update cannot be installed because WordPress %1$s requires the %2$s PHP extension.' ),
+                    $wp_version,
+                    $extension
+                )
+            );
+        }
+
+        // Add a warning when required PHP extensions are missing.
+        if ( $missing_extensions->has_errors() ) {
+            return $missing_extensions;
+        }
     }