<?php
/** *********************************************
* LiteSpeed Web Server Cache Manager
*
* @author Michael Alegre
* @copyright 2018-2026 LiteSpeed Technologies, Inc.
* *******************************************
*/
namespace Lsc\Wp;
use Lsc\Wp\Context\Context;
use Lsc\Wp\Panel\ControlPanel;
use Lsc\Wp\ThirdParty\Polyfill\Utf8;
/**
* map to data file
*/
class WPInstallStorage
{
/**
* @var string
*/
const CMD_ADD_CUST_WPINSTALLS = 'addCustWPInstalls';
/**
* @since 1.13.3
* @var string
*/
const CMD_ADD_NEW_WPINSTALL = 'addNewWPInstall';
/**
* @deprecated 1.13.3 Use CMD_DISCOVER_NEW2 instead.
* @var string
*/
const CMD_DISCOVER_NEW = 'discoverNew';
/**
* @since 1.14
* @var string
*/
const CMD_DISCOVER_NEW_AND_ENABLE = 'discoverNewAndEnable';
/**
* @since 1.13.3
* @var string
*/
const CMD_DISCOVER_NEW2 = 'discoverNew2';
/**
* @var string
*/
const CMD_FLAG = 'flag';
/**
* @var string
*/
const CMD_MASS_FLAG = 'mass_flag';
/**
* @var string
*/
const CMD_MASS_UNFLAG = 'mass_unflag';
/**
* @deprecated 1.13.3 Use CMD_SCAN2 instead for now.
* @var string
*/
const CMD_SCAN = 'scan';
/**
* @since 1.13.3
* @var string
*/
const CMD_SCAN2 = 'scan2';
/**
* @var string
*/
const CMD_UNFLAG = 'unflag';
/**
* @var string
*/
const DATA_VERSION = '1.5';
/**
* @var int
*/
const ERR_NOT_EXIST = 1;
/**
* @var int
*/
const ERR_CORRUPTED = 2;
/**
* @var int
*/
const ERR_VERSION_HIGH = 3;
/**
* @var int
*/
const ERR_VERSION_LOW = 4;
/**
* @var string
*/
protected $dataFile;
/**
* @var string
*/
protected $customDataFile;
/**
* @var null|WPInstall[] Key is the path to a WordPress installation.
*/
protected $wpInstalls = null;
/**
* @var null|WPInstall[] Key is the path to a WordPress installation.
*/
protected $custWpInstalls = null;
/**
* @var int
*/
protected $error;
/**
* @var WPInstall[]
*/
protected $workingQueue = [];
/**
*
* @param string $dataFile
* @param string $custDataFile
*
* @throws LSCMException Thrown indirectly by $this->init() call.
*/
public function __construct( $dataFile, $custDataFile = '' )
{
$this->dataFile = $dataFile;
$this->customDataFile = $custDataFile;
$this->error = $this->init();
}
/**
*
* @return int
*
* @throws LSCMException Thrown indirectly by Logger::debug() call.
*/
protected function init()
{
$dataExists = false;
try {
if ( file_exists($this->dataFile) ) {
$dataExists = true;
$this->wpInstalls = $this->getDataFileData($this->dataFile);
}
if (
$this->customDataFile != ''
&&
file_exists($this->customDataFile)
) {
$dataExists = true;
$this->custWpInstalls =
$this->getDataFileData($this->customDataFile);
}
}
catch ( LSCMException $e ) {
Logger::debug($e->getMessage());
return $e->getCode();
}
if ( !$dataExists ) {
return self::ERR_NOT_EXIST;
}
return 0;
}
/**
*
* @since 1.15
*
* @param string $dataFile
*
* @return false|string
*/
protected static function getDataFileContents( $dataFile )
{
return file_get_contents($dataFile);
}
/**
*
* @param string $dataFile
*
* @return WPInstall[]
*
* @throws LSCMException Thrown when data file is corrupt.
* @throws LSCMException Thrown when there is a data file version issue.
* @throws LSCMException Thrown indirectly by $this->verifyDataFileVer()
* call.
*/
protected function getDataFileData( $dataFile )
{
$content = static::getDataFileContents($dataFile);
if ( ($data = json_decode($content, true)) === null ) {
/**
* Data file may be in the legacy serialized format (pre-v1.15).
*
* I-7: every cPanel-supported runtime is PHP 7+, so the previous
* PHP_VERSION < 7.0 LSCMException branch was dead code. Calling
* unserialize() with `'allowed_classes' => false` blocks object
* instantiation, which is the only gadget path of concern here.
*/
$data = unserialize($content, ['allowed_classes' => false]);
}
if ( $data === false || !is_array($data) || !isset($data['__VER__']) ) {
throw new LSCMException(
"$dataFile - Data is corrupt.",
self::ERR_CORRUPTED
);
}
if ( ($err = $this->verifyDataFileVer($dataFile, $data['__VER__'])) ) {
throw new LSCMException(
"$dataFile - Data file version issue.",
$err
);
}
unset($data['__VER__']);
$wpInstalls = [];
foreach ( $data as $utf8Path => $idata ) {
$path = Utf8::decode($utf8Path);
$i = new WPInstall($path);
$siteUrl = isset($idata[WPInstall::FLD_SITEURL]) ? $idata[WPInstall::FLD_SITEURL] : null;
$idata[WPInstall::FLD_SITEURL] =
($siteUrl !== null) ? urldecode($siteUrl) : null;
$serverName = isset($idata[WPInstall::FLD_SERVERNAME]) ? $idata[WPInstall::FLD_SERVERNAME] : null;
$idata[WPInstall::FLD_SERVERNAME] =
($serverName !== null) ? urldecode($serverName) : null;
$i->initData($idata);
$wpInstalls[$path] = $i;
}
return $wpInstalls;
}
/**
*
* @return int
*/
public function getError()
{
return $this->error;
}
/**
*
* @param bool $nonFatalOnly
*
* @return int
*/
public function getCount( $nonFatalOnly = false )
{
$count = 0;
if ( $this->wpInstalls != null ) {
if ( $nonFatalOnly ) {
foreach ( $this->wpInstalls as $install ) {
if ( !$install->hasFatalError() ) {
$count++;
}
}
}
else {
$count += count($this->wpInstalls);
}
}
if ( $this->custWpInstalls != null ) {
if ( $nonFatalOnly ) {
foreach ( $this->custWpInstalls as $custInstall ) {
if ( !$custInstall->hasFatalError() ) {
$count++;
}
}
}
else {
$count += count($this->custWpInstalls);
}
}
return $count;
}
/**
*
* @return null|WPInstall[]
*
* @noinspection PhpUnused
*/
public function getWPInstalls()
{
return $this->wpInstalls;
}
/**
*
* @return null|WPInstall[]
*
* @noinspection PhpUnused
*/
public function getCustWPInstalls()
{
return $this->custWpInstalls;
}
/**
*
* @return null|WPInstall[]
*/
public function getAllWPInstalls()
{
if ( $this->wpInstalls != null ) {
if ( $this->custWpInstalls != null ) {
return array_merge($this->wpInstalls, $this->custWpInstalls);
}
else {
return $this->wpInstalls;
}
}
elseif ( $this->custWpInstalls != null ) {
return $this->custWpInstalls;
}
else {
return null;
}
}
/**
* Get all known WPInstall paths.
*
* @return string[]
*/
public function getPaths()
{
$paths = [];
if ( $this->wpInstalls != null ) {
$paths = array_keys($this->wpInstalls);
}
if ( $this->custWpInstalls != null ) {
$paths = array_merge($paths, array_keys($this->custWpInstalls));
}
return $paths;
}
/**
*
* @param string $path
*
* @return WPInstall|null
*/
public function getWPInstall( $path )
{
/**
* V9.5 — match the literal path against the canonical keyset first.
* Stored keys are already canonical (WPInstall::init() canonicalises
* and addWPInstall() keys by getPath()), so a caller passing a
* canonical path (the flag-action case) resolves to its bound install
* even if an intermediate component was swapped after the path was
* enqueued. Resolving via realpath() first would follow such a swap to
* a victim tree and miss the binding, yielding an unbound WPInstall
* downstream whose null expectedOwnerUid would skip Layer 2 of
* addUserFlagFile().
*/
if ( isset($this->wpInstalls[$path]) ) {
return $this->wpInstalls[$path];
}
elseif ( isset($this->custWpInstalls[$path]) ) {
return $this->custWpInstalls[$path];
}
if ( ($realPath = realpath($path)) === false ) {
$index = $path;
}
else {
$index = $realPath;
}
if ( isset($this->wpInstalls[$index]) ) {
return $this->wpInstalls[$index];
}
elseif ( isset($this->custWpInstalls[$index]) ) {
return $this->custWpInstalls[$index];
}
return null;
}
/**
*
* @return WPInstall[]
*/
public function getWorkingQueue()
{
return $this->workingQueue;
}
/**
*
* @param WPInstall $wpInstall
*/
public function addWPInstall( WPInstall $wpInstall )
{
$this->wpInstalls[$wpInstall->getPath()] = $wpInstall;
}
/**
*
* @throws LSCMException Thrown indirectly by $this->saveDataFile() call.
* @throws LSCMException Thrown indirectly by $this->saveDataFile() call.
*/
public function syncToDisk()
{
$this->saveDataFile($this->dataFile, $this->wpInstalls);
if ( $this->customDataFile != '' ) {
$this->saveDataFile($this->customDataFile, $this->custWpInstalls);
}
}
/**
*
* @param string $dataFile
* @param WPInstall[]|null $wpInstalls
*
* @throws LSCMException Thrown indirectly by $this->log() call.
*/
protected function saveDataFile( $dataFile, $wpInstalls )
{
$data = [ '__VER__' => self::DATA_VERSION ];
if ( !empty($wpInstalls) ) {
foreach ( $wpInstalls as $path => $install ) {
if ( !$install->shouldRemove() ) {
$utf8Path = Utf8::encode($path);
$data[$utf8Path] = $install->getData();
$siteUrl = &$data[$utf8Path][WPInstall::FLD_SITEURL];
if ( $siteUrl != null ) {
$siteUrl = urlencode($siteUrl);
}
$serverName = &$data[$utf8Path][WPInstall::FLD_SERVERNAME];
if ( $serverName != null ) {
$serverName = urlencode($serverName);
}
}
}
ksort($data);
}
file_put_contents($dataFile, json_encode($data), LOCK_EX);
chmod($dataFile, 0600);
$this->log("Data file saved $dataFile", Logger::L_DEBUG);
}
/**
*
* @param string $dataFile
* @param string $dataFileVer
*
* @return int
*
* @throws LSCMException Thrown indirectly by Logger::info() call.
* @throws LSCMException Thrown indirectly by $this->updateDataFile() call.
*/
protected function verifyDataFileVer( $dataFile, $dataFileVer )
{
$res = Util::betterVersionCompare($dataFileVer, self::DATA_VERSION);
if ( $res == 1 ) {
Logger::info(
'Data file version is higher than expected and cannot be used.'
);
return self::ERR_VERSION_HIGH;
}
if ( $res == -1 && !$this->updateDataFile($dataFile, $dataFileVer) ) {
return self::ERR_VERSION_LOW;
}
return 0;
}
/**
*
* @param string $dataFile
* @param string $dataFileVer
*
* @return bool
*
* @throws LSCMException Thrown indirectly by Logger::info() call.
* @throws LSCMException Thrown indirectly by Util::createBackup() call.
* @throws LSCMException Thrown indirectly by Logger::error() call.
*/
public static function updateDataFile( $dataFile, $dataFileVer )
{
Logger::info(
"$dataFile - Old data file version detected. Attempting to "
. 'update...'
);
/**
* Currently no versions are upgradeable to 1.5
*/
$updatableVersions = [];
if (
!in_array($dataFileVer, $updatableVersions)
||
! Util::createBackup($dataFile)
) {
Logger::error(
"$dataFile - Data file could not be updated to version "
. self::DATA_VERSION
);
return false;
}
/**
* Upgrade funcs will be called here.
*/
return true;
}
/**
*
* @param string $action
*
* @return string[]
*
* @throws LSCMException Thrown when "get docroots" command fails.
* @throws LSCMException Thrown when $action value is unsupported.
*/
protected function prepareActionItems( $action )
{
switch ( $action ) {
case self::CMD_SCAN:
case self::CMD_SCAN2:
case self::CMD_DISCOVER_NEW:
case self::CMD_DISCOVER_NEW2:
try
{
return ControlPanel::getClassInstance()->getDocRoots();
}
catch ( LSCMException $e )
{
throw new LSCMException(
$e->getMessage()
. " Could not prepare $action action items."
);
}
case UserCommand::CMD_MASS_ENABLE:
case UserCommand::CMD_MASS_DISABLE:
case UserCommand::CMD_MASS_UPGRADE:
case UserCommand::CMD_MASS_DASH_NOTIFY:
case UserCommand::CMD_MASS_DASH_DISABLE:
case self::CMD_MASS_UNFLAG:
return $this->getPaths();
default:
throw new LSCMException('Missing parameter(s).');
}
}
/**
*
* @param string $action
* @param string $path
* @param string[] $extraArgs
*
* @throws LSCMException Thrown when an invalid LSCWP version is selected
* in action UserCommand::CMD_MASS_UPGRADE.
* @throws LSCMException Thrown when LSCWP version fails to download in
* action UserCommand::CMD_MASS_UPGRADE.
* @throws LSCMException Thrown when LSCWP source package is not available
* in action UserCommand::CMD_MASS_UPGRADE.
* @throws LSCMException Thrown indirectly by $wpInstall->hasValidPath()
* call.
* @throws LSCMException Thrown indirectly by $wpInstall->addUserFlagFile()
* call.
* @throws LSCMException Thrown indirectly by $wpInstall->hasValidPath()
* call.
* @throws LSCMException Thrown indirectly by $wpInstall->refreshStatus()
* call.
* @throws LSCMException Thrown indirectly by $wpInstall->addUserFlagFile()
* call.
* @throws LSCMException Thrown indirectly by PluginVersion::getInstance()
* call.
* @throws LSCMException Thrown indirectly by
* PluginVersion::getInstance()->getAllowedVersions() call.
* @throws LSCMException Thrown indirectly by UserCommand::issue() call.
* @throws LSCMException Thrown indirectly by $this->syncToDisk() call.
* @throws LSCMException Thrown indirectly by $this->syncToDisk() call.
*/
protected function doWPInstallAction( $action, $path, array $extraArgs )
{
if ( ($wpInstall = $this->getWPInstall($path)) == null ) {
/**
* V9.5 — for flag actions the path always originates from the
* existing keyset (getPaths() canonical keys, or the single-flag
* pre-validation in doSingleAction()). A miss here means the path
* drifted between the time the list was built and this lookup —
* indicative of a cross-tenant TOCTOU intermediate-component swap.
* Constructing an unbound WPInstall would carry null
* expectedOwnerUid, silently disabling Layer 2 of
* addUserFlagFile() and allowing the privileged write to proceed
* against an unverified (possibly swapped) path. Fail closed
* instead.
*
* V9.6 — extend the fail-closed guard to every action that can
* reach a root-context addUserFlagFile(false) on the
* dispatcher-resolved object:
* - CMD_ENABLE/CMD_DISABLE/CMD_DASH_NOTIFY/CMD_DASH_DISABLE can
* call addUserFlagFile(false) directly when refreshStatus()
* still shows a fatal error.
* - All actions fed through UserCommand::issue() can call
* addUserFlagFile(false) in root context via its error handler.
* These paths have the same unbound-object exposure as the explicit
* flag actions (§13/§14 of the fix plan). The fallback bare
* construct is kept for discovery/custom install actions whose
* paths do not originate from the existing keyset.
*
* V9.7 — the V9.6 explicit OR-list was incomplete: CMD_STATUS
* (and all other issue-able commands) share the same
* addUserFlagFile(false) exposure via UserCommand::issue()'s error
* handler, and CMD_STATUS is reachable via the single-action UI
* path (refresh_status_single). Centralise: guard every command
* accepted by UserCommand::isSupportedIssueCmd() plus the explicit
* flag commands so any future addition to the issue() command set
* is protected automatically.
*
* V9.8 — CMD_UNFLAG/CMD_MASS_UNFLAG added to the guard. These
* are not in isSupportedIssueCmd() (unflag is handled inline below,
* not via UserCommand::issue()), so they must be listed explicitly.
* An unbound WPInstall for an unflag miss would carry null
* expectedOwnerUid, silently disabling the Layer 2 owner check in
* the hardened removeFlagFile(false) path added in V9.8.
*/
if (
$action === self::CMD_FLAG
|| $action === self::CMD_MASS_FLAG
|| $action === self::CMD_UNFLAG
|| $action === self::CMD_MASS_UNFLAG
|| UserCommand::isSupportedIssueCmd($action)
) {
$this->log(
"Skipping $action: install path $path is not a known "
. 'install (possible cross-tenant TOCTOU — '
. 'intermediate component swapped after the action '
. 'list was built).',
Logger::L_INFO
);
return;
}
$wpInstall = new WPInstall($path);
$this->addWPInstall($wpInstall);
}
switch ( $action ) {
case self::CMD_FLAG:
case self::CMD_MASS_FLAG:
if ( !$wpInstall->hasValidPath() ) {
return;
}
if ( $wpInstall->addUserFlagFile(false) ) {
$wpInstall->setCmdStatusAndMsg(
UserCommand::EXIT_SUCC,
'Flag file set'
);
}
else {
$wpInstall->setCmdStatusAndMsg(
UserCommand::EXIT_FAIL,
'Could not create flag file'
);
}
$this->workingQueue[$path] = $wpInstall;
return;
case self::CMD_UNFLAG:
case self::CMD_MASS_UNFLAG:
if ( !$wpInstall->hasValidPath() ) {
return;
}
if ( $wpInstall->removeFlagFile(false) ) {
$wpInstall->setCmdStatusAndMsg(
UserCommand::EXIT_SUCC,
'Flag file unset'
);
}
else {
$wpInstall->setCmdStatusAndMsg(
UserCommand::EXIT_FAIL,
'Could not remove flag file'
);
}
$this->workingQueue[$path] = $wpInstall;
return;
case UserCommand::CMD_ENABLE:
case UserCommand::CMD_DISABLE:
case UserCommand::CMD_DASH_NOTIFY:
case UserCommand::CMD_DASH_DISABLE:
if ( $wpInstall->hasFatalError() ) {
$wpInstall->refreshStatus();
if ( $wpInstall->hasFatalError() ) {
$wpInstall->addUserFlagFile(false);
$wpInstall->setCmdStatusAndMsg(
UserCommand::EXIT_FAIL,
'Install skipped and flagged due to Error status.'
);
$this->workingQueue[$path] = $wpInstall;
return;
}
}
break;
case UserCommand::CMD_MASS_UPGRADE:
$lscwpVer = $extraArgs[1];
$isAllowedVer = in_array(
$lscwpVer,
PluginVersion::getInstance()->getAllowedVersions()
);
if ( !$isAllowedVer ) {
throw new LSCMException(
'Selected LSCWP version ('
. htmlspecialchars($lscwpVer)
. ') is invalid.'
);
}
break;
//no default
}
if ( UserCommand::issue($action, $wpInstall, $extraArgs) ) {
if (
$action == UserCommand::CMD_MASS_UPGRADE
&&
($wpInstall->getCmdStatus() & UserCommand::EXIT_FAIL)
&&
preg_match(
'/Download failed. Not Found/',
$wpInstall->getCmdMsg()
)
) {
$this->syncToDisk();
throw new LSCMException(
'Could not download version '
. htmlspecialchars($extraArgs[1])
. '.'
);
}
if (
$action == UserCommand::CMD_MASS_ENABLE
&&
($wpInstall->getCmdStatus() & UserCommand::EXIT_FAIL)
&&
preg_match(
'/Source Package not available/',
$wpInstall->getCmdMsg()
)
) {
$this->syncToDisk();
throw new LSCMException($wpInstall->getCmdMsg());
}
$this->workingQueue[$path] = $wpInstall;
}
}
/**
*
* @param string $action
* @param null|string[] $list
* @param string[]|string[][] $extraArgs
*
* @return string[]
*
* @throws LSCMException Thrown indirectly by $this->prepareActionItems()
* call.
* @throws LSCMException Thrown indirectly by $this->log() call.
* @throws LSCMException Thrown indirectly by Context::getActionTimeout()
* call.
* @throws LSCMException Thrown indirectly by $this->scan() call.
* @throws LSCMException Thrown indirectly by $this->addNewWPInstall()
* call.
* @throws LSCMException Thrown indirectly by
* $this->addCustomInstallations() call.
* @throws LSCMException Thrown indirectly by
* PluginVersion::getCurrentVersion() call.
* @throws LSCMException Thrown indirectly by PluginVersion::getInstance()
* call.
* @throws LSCMException Thrown indirectly by
* PluginVersion::getInstance()->setActiveVersion() call.
* @throws LSCMException Thrown indirectly by $this->doWPInstallAction()
* call.
* @throws LSCMException Thrown indirectly by $this->syncToDisk() call.
*/
public function doAction( $action, $list, array $extraArgs = [] )
{
if ( $list === null ) {
$list = $this->prepareActionItems($action);
}
$count = count($list);
$this->log("doAction $action for $count items", Logger::L_VERBOSE);
$endTime = ($count > 1) ? Context::getActionTimeout() : 0;
$finishedList = [];
switch ( $action ) {
case self::CMD_SCAN:
case self::CMD_DISCOVER_NEW:
foreach ( $list as $path ) {
$this->scan($path, ($action == self::CMD_SCAN));
$finishedList[] = $path;
if ( $endTime && time() >= $endTime ) {
break;
}
}
break;
case self::CMD_ADD_NEW_WPINSTALL:
foreach ( $list as $path) {
$this->addNewWPInstall($path);
$finishedList[] = $path;
if ( $endTime && time() >= $endTime ) {
break;
}
}
break;
case self::CMD_ADD_CUST_WPINSTALLS:
$this->addCustomInstallations($extraArgs[0]);
break;
default:
if (
$action == UserCommand::CMD_ENABLE
||
$action == UserCommand::CMD_MASS_ENABLE
) {
/**
* Ensure that the current version is locally downloaded.
*/
PluginVersion::getInstance()
->setActiveVersion(PluginVersion::getCurrentVersion())
;
}
foreach ( $list as $path ) {
$this->doWPInstallAction($action, $path, $extraArgs);
$finishedList[] = $path;
if ( $endTime && time() >= $endTime ) {
break;
}
}
}
$this->syncToDisk();
if ( $action == self::CMD_SCAN || $action == self::CMD_SCAN2 ) {
/**
* Explicitly clear any data file errors after scanning in case of
* multiple actions performed in the same process (cli).
*/
$this->error = 0;
}
return $finishedList;
}
/**
*
* @deprecated 1.13.3 Use $this->scan2() instead.
*
* @since 1.17.10 Added 'find -- ' end-of-options guard.
*
* @param string $docroot
* @param bool $forceRefresh
*
* @return void
*
* @throws LSCMException Thrown indirectly by Context::getScanDepth() call.
* @throws LSCMException Thrown indirectly by $this->log() call.
* @throws LSCMException Thrown indirectly by $this->log() call.
* @throws LSCMException Thrown indirectly by $this->log() call.
* @throws LSCMException Thrown indirectly by
* $this->wpInstalls[$wp_path]->refreshStatus() call.
*/
protected function scan( $docroot, $forceRefresh = false )
{
/**
* V6 (CWE-59 SSRF/symlink traversal) — use 'find -P' (the default; NOT
* '-L') so find does not descend into symlinked directories. As root,
* scanning a tenant-owned docroot with '-L' let a planted symlink (e.g.
* public_html/x -> /root) surface a wp-admin that resolves outside the
* tenant tree, steering subsequent root operations off-tree.
* The '--' prevents a docroot starting with '-' from being misread as a
* find option (escapeshellarg protects the shell, not find's own parser).
*/
$directories = shell_exec(
'find -P -- ' . escapeshellarg($docroot) . ' -maxdepth '
. (int) Context::getScanDepth()
. ' -name wp-admin -print'
);
$hasMatches = false;
if ( $directories ) {
/**
* Example:
* /home/user/public_html/wordpress/wp-admin
* /home/user/public_html/blog/wp-admin
* /home/user/public_html/wp/wp-admin
*/
$hasMatches = preg_match_all(
'|' . preg_quote($docroot, '|') . '(.*)(?=/wp-admin)|',
$directories,
$matches
);
}
if ( ! $hasMatches ) {
/**
* Nothing found.
*/
return;
}
$realDocroot = realpath($docroot);
/**
* V9/V9.2 (CWE-59/CWE-367 cross-tenant TOCTOU) — capture the
* panel-assigned docroot owner once before the loop. The docroot is
* invariant across iterations; reading it here avoids repeated lstat()
* calls and makes the binding available to both new and existing
* installs (V9.2 fix: previously only new installs were rebound,
* leaving upgraded existing installs with null Layer 2 bindings).
*/
$rootStat = @lstat($realDocroot);
/** @noinspection PhpUndefinedVariableInspection */
foreach ( $matches[1] as $path ) {
$wp_path = realpath($docroot . $path);
/**
* V6 — defence-in-depth: drop any match that does not canonically
* resolve to a location contained under the docroot, so a symlinked
* leaf component cannot redirect a root operation off-tree.
*
* Note: this realpath() is a snapshot, not a lock. A path component
* could be swapped for a symlink after this check. That residual
* race is intentionally handled at the consumer, not here:
* - per-install enable/disable/upgrade/status run privilege-
* dropped as the install owner (UserCommand::runAsUser), where
* following an owner-planted symlink crosses no trust boundary;
* - the one root-context write into the untrusted tree,
* WPInstall::addUserFlagFile(), drops to install-owner
* credentials (V8) before the unlink and fopen so an
* intermediate-directory swap redirecting the path off-tree
* fails with EACCES (CWE-59/CWE-367 closed at the consumer).
*/
if ( $wp_path === false || $realDocroot === false
|| strpos($wp_path . '/', $realDocroot . '/') !== 0 ) {
$this->log(
"Scan match not contained under docroot $docroot. Skipping.",
Logger::L_INFO
);
continue;
}
$refresh = $forceRefresh;
if ( !isset($this->wpInstalls[$wp_path]) ) {
$this->wpInstalls[$wp_path] = new WPInstall($wp_path);
$refresh = true;
$this->log(
"New installation found: $wp_path",
Logger::L_INFO
);
if (
$this->custWpInstalls != null
&&
isset($this->custWpInstalls[$wp_path])
) {
unset($this->custWpInstalls[$wp_path]);
$this->log(
"Installation removed from custom data file: $wp_path",
Logger::L_INFO
);
}
}
else {
$this->log(
"Installation already found: $wp_path",
Logger::L_DEBUG
);
}
/**
* V9/V9.2 — bind expected owner unconditionally on every scan
* match, not only newly discovered installs. Existing installs
* (loaded from the data file) must be rebound on each scan so
* that Layer 2 (expected-owner equality check in addUserFlagFile)
* fires for the root-context flag path after an upgrade or after
* the first scan that discovered the install.
*/
if ( $rootStat !== false ) {
$this->wpInstalls[$wp_path]->setExpectedOwner(
$rootStat['uid'],
$rootStat['gid']
);
}
if ( $refresh ) {
$this->wpInstalls[$wp_path]->refreshStatus();
$this->workingQueue[$wp_path] = $this->wpInstalls[$wp_path];
}
}
}
/**
*
* @since 1.13.3
* @since 1.15 Changed function visibility from 'public' to
* 'public static'.
* @since 1.17.10 Added 'find -- ' end-of-options guard.
*
* @param string $docroot
*
* @return string[]
*
* @throws LSCMException Thrown indirectly by Context::getScanDepth() call.
*/
public static function scan2( $docroot )
{
/**
* V6 (CWE-59 SSRF/symlink traversal) — use 'find -P' (the default; NOT
* '-L') so find does not descend into symlinked directories. As root,
* scanning a tenant-owned docroot with '-L' let a planted symlink (e.g.
* public_html/x -> /root) surface a wp-admin that resolves outside the
* tenant tree, steering subsequent root operations off-tree.
* The '--' prevents a docroot starting with '-' from being misread as a
* find option (escapeshellarg protects the shell, not find's own parser).
*/
$directories = shell_exec(
'find -P -- ' . escapeshellarg($docroot) . ' -maxdepth '
. (int) Context::getScanDepth()
. ' -name wp-admin -print'
);
$hasMatches = false;
if ( $directories ) {
/**
* Example:
* /home/user/public_html/wordpress/wp-admin
* /home/user/public_html/blog/wp-admin
* /home/user/public_html/wp/wp-admin
*/
$hasMatches = preg_match_all(
'|' . preg_quote($docroot, '|') . '(.*)(?=/wp-admin)|',
$directories,
$matches
);
}
if ( ! $hasMatches ) {
/**
* Nothing found.
*/
return [];
}
$wpPaths = [];
$realDocroot = realpath($docroot);
/** @noinspection PhpUndefinedVariableInspection */
foreach ( $matches[1] as $path ) {
$wpPath = realpath($docroot . $path);
/**
* V6 — defence-in-depth: only return matches that canonically
* resolve to a location contained under the docroot, so a symlinked
* leaf component cannot redirect a root operation off-tree.
*
* Note: this realpath() is a snapshot, not a lock. A path component
* could be swapped for a symlink after this check. That residual
* race is intentionally handled at the consumer, not here:
* - per-install enable/disable/upgrade/status run privilege-
* dropped as the install owner (UserCommand::runAsUser), where
* following an owner-planted symlink crosses no trust boundary;
* - the one root-context write into the untrusted tree,
* WPInstall::addUserFlagFile(), drops to install-owner
* credentials (V8) before the unlink and fopen so an
* intermediate-directory swap redirecting the path off-tree
* fails with EACCES (CWE-59/CWE-367 closed at the consumer).
*/
if ( $wpPath === false || $realDocroot === false
|| strpos($wpPath . '/', $realDocroot . '/') !== 0 ) {
continue;
}
$wpPaths[] = $wpPath;
}
return $wpPaths;
}
/**
* Add a new WPInstall object to WPInstallStorage's $wpInstalls[] given a
* path to a WordPress installation and refresh its status. If a WPInstall
* object already exists for the given path, refresh its status.
*
* @since 1.13.3
*
* @param string $wpPath
*
* @throws LSCMException Thrown indirectly by $this->log() call.
* @throws LSCMException Thrown indirectly by $this->log() call.
* @throws LSCMException Thrown indirectly by $this->log() call.
* @throws LSCMException Thrown indirectly by
* $this->wpInstalls[$wpPath]->refreshStatus() call.
*/
protected function addNewWPInstall( $wpPath )
{
/**
* V9.4 (CWE-59/CWE-367 cross-tenant TOCTOU) — drift-rejection guard.
*
* scan2() returns canonical, docroot-contained paths (produced via
* realpath() + containment check). If realpath() here no longer
* resolves to the same value, an intermediate directory component was
* swapped (symlinked) between scan2's containment validation and this
* invocation — the TOCTOU window that spans the WHM UI's multi-request
* handoff (scan request stores paths in $_SESSION; discovery request
* re-resolves them here).
*
* Fail closed: skip the add entirely so the swapped-in (victim) path
* is never registered, never bound an owner from, and never flagged.
* This prevents a compromised realpath() result from poisoning the V9
* Layer 2 owner binding captured two lines below.
*
* A legitimate scan2 path is already canonical, so realpath() is
* idempotent and the equality holds with no false positives.
*/
$realPath = realpath($wpPath);
if ( $realPath === false || $realPath !== $wpPath ) {
$this->log(
"Skipping add: install path $wpPath no longer canonicalises to "
. 'itself (possible cross-tenant TOCTOU — intermediate '
. 'component swapped between scan2 and addNewWPInstall).',
Logger::L_INFO
);
return;
}
if ( !isset($this->wpInstalls[$wpPath]) ) {
$this->wpInstalls[$wpPath] = new WPInstall($wpPath);
$this->log("New installation found: $wpPath", Logger::L_INFO);
if (
$this->custWpInstalls != null
&&
isset($this->custWpInstalls[$wpPath])
) {
unset($this->custWpInstalls[$wpPath]);
$this->log(
"Installation removed from custom data file: $wpPath",
Logger::L_INFO
);
}
}
else {
$this->log(
"Installation already found: $wpPath",
Logger::L_DEBUG
);
}
/**
* V9.3 (CWE-59/CWE-367 cross-tenant TOCTOU) — bind the install
* directory's owner observed in root context at this scan-time
* snapshot. scan2() already canonicalised $wpPath via realpath() and
* validated containment under the panel-assigned docroot before
* returning it. Persisting the lstat() uid/gid here lets the later
* root-context flag write (addUserFlagFile(false), in a separate
* process / request) compare against a known-good snapshot rather
* than a same-instant read of the very directory it is about to
* modify — closing the race that Layers 1/3 leave open.
*
* Applied unconditionally to both newly-discovered and already-known
* installs so that pre-V9.3 records hydrated with a null binding are
* rebound on the next scan, mirroring §9 (V9.2)'s treatment in
* scan(). lstat() is used (not stat()) so a symlinked leaf reports
* the link's own inode owner rather than its target's, preventing
* a same-instant final-component symlink swap from binding a
* cross-tenant uid. If lstat() fails (path vanished between scan2
* and here), binding is skipped silently; the later flag write will
* itself refuse on its own lstat($this->path) failure.
*/
$installStat = @lstat($wpPath);
if ( $installStat !== false ) {
$this->wpInstalls[$wpPath]->setExpectedOwner(
$installStat['uid'],
$installStat['gid']
);
}
$this->wpInstalls[$wpPath]->refreshStatus();
$this->workingQueue[$wpPath] = $this->wpInstalls[$wpPath];
}
/**
*
* @param string[] $wpInstallsInfo
*
* @return void
*
* @throws LSCMException Thrown indirectly by $this->log() call.
* @throws LSCMException Thrown indirectly by $this->log() call.
* @throws LSCMException Thrown indirectly by $this->log() call.
* @throws LSCMException Thrown indirectly by $this->log() call.
* @throws LSCMException Thrown indirectly by
* $this->custWpInstalls[$wpPath]->refreshStatus() call.
* @throws LSCMException Thrown indirectly by $this->log() call.
* @throws LSCMException Thrown indirectly by $this->log() call.
*/
protected function addCustomInstallations( array $wpInstallsInfo )
{
if ( $this->customDataFile == '' ) {
$this->log(
'No custom data file set, could not add custom Installation.',
Logger::L_INFO
);
return;
}
if ( $this->custWpInstalls == null ) {
$this->custWpInstalls = [];
}
for ( $i = 0; $i < count($wpInstallsInfo); $i++ ) {
$info = preg_split('/\s+/', trim($wpInstallsInfo[$i]));
$line = $i + 1;
if ( count($info) != 4 ) {
$this->log(
'Incorrect number of values for custom installation input '
. "string on line $line. Skipping.",
Logger::L_INFO
);
continue;
}
$wpPath = $info[0];
if ( !Util::isSafeAbsPath($wpPath) ) {
$this->log(
"Unsafe wpPath value on line $line. Skipping.",
Logger::L_INFO
);
continue;
}
if ( !file_exists("$wpPath/wp-admin") ) {
$this->log(
"No 'wp-admin' directory found for $wpPath on line "
. "$line. Skipping.",
Logger::L_INFO
);
continue;
}
$docroot = $info[1];
if ( !Util::isSafeAbsPath($docroot) ) {
$this->log(
"Unsafe docroot value on line $line. Skipping.",
Logger::L_INFO
);
continue;
}
$realWpPath = realpath($wpPath);
$realDocroot = realpath($docroot);
if ( $realWpPath === false || $realDocroot === false
|| strpos($realWpPath . '/', $realDocroot . '/') !== 0 ) {
$this->log(
"wpPath $wpPath not contained under docroot $docroot on "
. "line $line. Skipping.",
Logger::L_INFO
);
continue;
}
if ( !isset($this->wpInstalls[$wpPath]) ) {
$this->custWpInstalls[$wpPath] = new WPInstall($wpPath);
$this->custWpInstalls[$wpPath]->setDocRoot($docroot);
$this->custWpInstalls[$wpPath]->setServerName($info[2]);
$this->custWpInstalls[$wpPath]->setSiteUrlDirect($info[3]);
$this->custWpInstalls[$wpPath]->refreshStatus();
$this->log(
"New installation added to custom data file: $wpPath",
Logger::L_INFO
);
}
else {
$this->log(
"Installation already found during scan: $wpPath. "
. 'Skipping.',
Logger::L_INFO
);
}
}
}
/**
* Get all WPInstall command messages as a key=>value array.
*
* @return string[][]
*/
public function getAllCmdMsgs()
{
$succ = $fail = $err = [];
foreach ( $this->workingQueue as $wpInstall ) {
if ( ($msg = $wpInstall->getCmdMsg()) ) {
$cmdStatus = $wpInstall->getCmdStatus();
switch( true ) {
case $cmdStatus & UserCommand::EXIT_SUCC:
$msgType = &$succ;
break;
case $cmdStatus & UserCommand::EXIT_FAIL:
$msgType = &$fail;
break;
case $cmdStatus & UserCommand::EXIT_ERROR:
$msgType = &$err;
break;
default:
continue 2;
}
$msgType[] = "{$wpInstall->getPath()} - $msg";
}
}
return [ 'succ' => $succ, 'fail' => $fail, 'err' => $err ];
}
/**
*
* @param string $msg
* @param int $level
*
* @throws LSCMException Thrown indirectly by Logger::error() call.
* @throws LSCMException Thrown indirectly by Logger::warn() call.
* @throws LSCMException Thrown indirectly by Logger::notice() call.
* @throws LSCMException Thrown indirectly by Logger::info() call.
* @throws LSCMException Thrown indirectly by Logger::verbose() call.
* @throws LSCMException Thrown indirectly by Logger::debug() call.
*/
protected function log( $msg, $level )
{
$msg = "WPInstallStorage - $msg";
switch ( $level ) {
case Logger::L_ERROR:
Logger::error($msg);
break;
case Logger::L_WARN:
Logger::warn($msg);
break;
case Logger::L_NOTICE:
Logger::notice($msg);
break;
case Logger::L_INFO:
Logger::info($msg);
break;
case Logger::L_VERBOSE:
Logger::verbose($msg);
break;
case Logger::L_DEBUG:
Logger::debug($msg);
break;
//no default
}
}
}