Changeset 59803 for trunk/src/wp-includes/load.php

Timestamp:

02/11/2025 11:12:03 AM (19 months ago)

Author:

johnbillion

Message:

Security: Explicitly require the hash PHP extension and add requirement checks during installation and upgrade.

This extension provides the hash() function and support for the SHA-256 algorithm, both of which are required for upcoming security related changes. This extension is almost universally enabled, however it is technically possible to disable it on PHP 7.2 and 7.3, hence the introduction of this requirement and the corresponding requirement checks prior to installing or upgrading WordPress.

Props peterwilsoncc, ayeshrajans, dd32, SergeyBiryukov, johnbillion.

Fixes #60638, #62815, #56017

See #21022

File:

• trunk/src/wp-includes/load.php (modified) (2 diffs)

trunk/src/wp-includes/load.php

@@ -148 +148 @@
  * @access private
  *
- * @global string $required_php_version The required PHP version string.
- * @global string $wp_version           The WordPress version string.
+ * @global string   $required_php_version    The required PHP version string.
+ * @global string[] $required_php_extensions The names of required PHP extensions.
+ * @global string   $wp_version              The WordPress version string.
  */
 function wp_check_php_mysql_versions() {
-        global $required_php_version, $wp_version;
+        global $required_php_version, $required_php_extensions, $wp_version;
 
         $php_version = PHP_VERSION;
@@ -166 +167 @@
                         $required_php_version
                 );
+                exit( 1 );
+        }
+
+        $missing_extensions = array();
+
+        if ( isset( $required_php_extensions ) && is_array( $required_php_extensions ) ) {
+                foreach ( $required_php_extensions as $extension ) {
+                        if ( extension_loaded( $extension ) ) {
+                                continue;
+                        }
+
+                        $missing_extensions[] = sprintf(
+                                'WordPress %1$s requires the <code>%2$s</code> PHP extension.',
+                                $wp_version,
+                                $extension
+                        );
+                }
+        }
+
+        if ( count( $missing_extensions ) > 0 ) {
+                $protocol = wp_get_server_protocol();
+                header( sprintf( '%s 500 Internal Server Error', $protocol ), true, 500 );
+                header( 'Content-Type: text/html; charset=utf-8' );
+                echo implode( '<br>', $missing_extensions );
                 exit( 1 );
         }