Add possibility to set a higher recommended php version for the "Update PHP notice"

[j-falk]

The "Update PHP core notice" was introduced by #41191 (ticket), refined by #45686 (ticket) and the trigger to show the notice is managed by a check to a centralized WordPress api call which responds with if the current site has a insecure/outdated version of PHP.

This means that it is easy to centrally raise the minimum versions for a site to be considered unsecure or outdated.

However one addition to this that would be great is if it would be possible for a host to set a different and higher minimum than what is set centrally.

This was proposed previously at ​https://make.wordpress.org/core/2019/01/14/php-site-health-mechanisms-in-5-1/#comment-35240 and discussed briefly ​https://wordpress.slack.com/archives/C3D6T7F8Q/p1547666779187700.

Eg at the managed WP host Seravo we now have our own admin notice about upgrading a site using a PHP version below 7.0, which is implemented through a must-use plugin we install on all sites. It would be great if we, and other hosts, would have the possibility to instead do this by using the PHP update notice now in core.

The clear benefit of this would be to help hosts that are comfortable guiding their clients to update their PHP versions quicker than what WordPress centrally does.

[j-falk]

One suggestion of how this could be implemented is to make it similar as to how the "Update PHP URL" now can be set both as an environment variable and through a filter.

[flixos90]

46065.diff​ introduces a wp_is_php_version_acceptable filter which passes a boolean and the PHP version to check. Returning false from here will result in the PHP admin warning to show up.

The filter is only run if the wordpress.org API considers the PHP version acceptable. This ensures that other plugins or hosting providers can only make this check stricter, but not loosen it.

Examples:

• PHP version 5.6 is checked, wordpress.org considers it acceptable because it is >= 5.6. Filter is run, but not used (or still returns true). Admin notice does not show up.
• PHP version 5.6 is checked, wordpress.org considers it acceptable because it is >= 5.6. Filter is run, hosting provider uses the filter and returns false as they internally use 7.2 as minimum accepted version. Admin notice shows up.
• PHP version 5.3 is checked, wordpress.org considers it outdated because it is < 5.6. Filter is not run (causing malicious plugin that wants to eliminate PHP notices to not be successful in doing so). Admin notice shows up.

@j-falk @mikeschroder Can you quickly give feedback on whether this would address your need? If we want this to get into WordPress 5.1.1, it needs to be merged sooner than later, preferably this weekend. Since it is quite simple, I think it's realistic.

[afragen]

Patch looks good to me.

[j-falk]

For me as well.

I tested it with the with 46065.diff applied on an environment using php 7.0 and adding the following add_filter and function eg in functions.php:

<?php
add_filter('wp_is_php_version_acceptable', 'custom_acceptable_php_version_func', 10, 2);

function custom_acceptable_php_version_func ( $is_php_version_acceptable , $version ) {

        if (version_compare($version, '7.3.0', '<')) {
                $is_php_version_acceptable = false;
        }

        return $is_php_version_acceptable;
}

The update php update box shows then on the dashboard as expected.

[flixos90]

In 44788:

General: Introduce wp_is_php_version_acceptable filter to make the check for triggering PHP version warnings stricter.

The filter is only run if the wordpress.org API considers the PHP version acceptable. This ensures that other plugins or hosting providers can only make this check stricter, but not loosen it.

Props j-falk, mikeschroder.
Fixes #46065.

[flixos90]

In 44789:

General: Introduce wp_is_php_version_acceptable filter to make the check for triggering PHP version warnings stricter.

The filter is only run if the wordpress.org API considers the PHP version acceptable. This ensures that other plugins or hosting providers can only make this check stricter, but not loosen it.

Merges [44788] to the 5.1 branch.

Props j-falk, mikeschroder.
Fixes #46065.