Changeset 6022 for sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/zip/class-serve.php

Timestamp:

10/13/2017 08:56:56 AM (6 years ago)

Author:

dd32

Message:

Plugin Directory: Generate md5 hashes for plugins.

This is a POC and may change or be removed in the future, it's here for testing purposes.

A api.wordpress.org endpoint may be available in the future to access it.
This is only enabled for the 'exploit-scanner' plugin at present, purely for testing, as it publishes the md5 hashes of its own files already

Compare ​https://wordpress.org/plugins/exploit-scanner/ to ​https://downloads.wordpress.org/plugins/exploit-scanner.1.5.2.checksums.json

See #3192

File:

• sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/zip/class-serve.php (modified) (4 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/zip/class-serve.php

@@ -37 +37 @@
         $zip = basename( parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH ) );
 
-        $slug = false;
+        if ( ! preg_match( "!^(?P<slug>[a-z0-9-_]+)(\.(?P<version>.+?))?\.(?P<request_type>zip|checksums\.json)$!i", $zip, $m ) ) {
+            throw new Exception( __METHOD__ . ": Invalid URL." );
+        }
+
+        $slug = strtolower( $m['slug'] );
+
         $version = 'trunk';
-
-        if ( ! preg_match( "!^(?P<slug>[a-z0-9-_]+)(.(?P<version>.+))?.zip$!i", $zip, $m ) ) {
-            throw new Exception( __METHOD__ . ": Invalid URL." );
-        }
-
-        $slug = strtolower( $m['slug'] );
-        if ( isset( $m['version'] ) ) {
+        if ( isset( $m['version'] ) && '' !== $m['version'] ) {
             $version = $m['version'];
         }
-
         if ( 'latest-stable' == $version ) {
             $version = $this->get_stable_tag( $slug );
+        }
+
+        if ( 'zip' == strtolower( $m['request_type'] ) ) {
+            $checksum_request = false;
+        } else {
+            $checksum_request = true;
+
+            // Checksum requests for 'trunk' are not possible.
+            if ( 'trunk' == $version ) {
+                throw new Exception( __METHOD__ . ": Checksum requests must include a version." );
+            }
+
         }
 
@@ -56 +66 @@
             'stats' => true,
         );
-        if ( isset( $_GET['stats'] ) ) {
+
+        if ( $checksum_request ) {
+            $args['stats'] = false;
+
+        } elseif ( isset( $_GET['stats'] ) ) {
             $args['stats'] = (bool) $_GET['stats'];
+
         } elseif ( isset( $_GET['nostats'] ) ) {
             $args['stats'] = !empty( $_GET['nostats'] );
         }
 
-        return compact( 'zip', 'slug', 'version', 'args' );
+        return compact( 'zip', 'slug', 'version', 'args', 'checksum_request' );
     }
 
@@ -118 +133 @@
 
     /**
-     * Returns the files to use for the request.
+     * Returns the file to be served for the request.
      *
      * @param array $request The request object for the request.
-     * @return array An array containing the files to use for the request, 'zip' and 'md5'.
+     * @return array The file to serve.
      */
     protected function get_file( $request ) {
-        if ( empty( $request['version'] ) || 'trunk' == $request['version'] ) {
+        // Checksum requests must include a version
+        if ( $request['checksum_request'] ) {
+            return "{$request['slug']}/{$request['slug']}.{$request['version']}.checksums.json";
+
+        } elseif ( empty( $request['version'] ) || 'trunk' == $request['version'] ) {
             return "{$request['slug']}/{$request['slug']}.zip";
+
         } else {
             return "{$request['slug']}/{$request['slug']}.{$request['version']}.zip";
         }
+
     }
 
@@ -137 +158 @@
      */
     protected function serve_zip( $request ) {
-        $zip = $this->get_file( $request );
+        $file = $this->get_file( $request );
 
         if ( defined( 'PLUGIN_ZIP_X_ACCEL_REDIRECT_LOCATION' ) ) {
-            $zip_url = PLUGIN_ZIP_X_ACCEL_REDIRECT_LOCATION . $zip;
-
-            header( 'Content-Type: application/zip' );
-            header( 'Content-Disposition: attachment; filename=' . basename( $zip ) );
-            header( "X-Accel-Redirect: $zip_url" );
+            $file_url = PLUGIN_ZIP_X_ACCEL_REDIRECT_LOCATION . $file;
+
+            if ( $request['checksum_request'] ) {
+                header( 'Content-Type: application/json' );
+            } else {
+                header( 'Content-Type: application/zip' );
+                header( 'Content-Disposition: attachment; filename=' . basename( $file ) );
+            }
+            header( "X-Accel-Redirect: $file_url" );
         } else {
             header( 'Content-Type: text/plain' );
-            echo "This is a request for $zip, this server isn't currently configured to serve zip files.\n";
+            echo "This is a request for $file, this server isn't currently configured to serve files.\n";
         }