Detect cloaked versions for core and plugins
Step 3 (Core) now does three independent lookups: - Installed version (the truth, from $wp_version) - Latest per WordPress (via get_core_updates — what WP_Downgrade can manipulate) - Latest per wp.org (direct call to api.wordpress.org/core/version-check/1.7/ cached 1h, can't be cloaked from the server side) If 'Latest per WordPress' < 'Latest per wp.org', the finding is bumped to bad with a CLOAKED detail message. The wp_downgrade_core_version option is also surfaced verbatim so it's obvious where the pin lives. Step 4 (Plugins) similarly: - wp_org_info() now captures the version field from the WP.org plugins info API. Cache key bumped to wph_pi2_ so existing entries get re-fetched. - For each plugin: installed version vs wp.org reported version. - If installed < wp.org AND the WP update_plugins transient doesn't flag it, the row is bad with 'CLOAKED — WP says up-to-date'. - Cloaked count surfaces in the summary. Both steps also explicitly detect a roster of known cloaker plugins (WP Downgrade, WP Rollback, Easy Updates Manager, Disable Updates Manager, Stops Core/Theme/Plugin Updates, Companion Auto Update) and warn when any are active, so the technician sees the framing before diving into individual rows. Smoke-tested with WP Downgrade installed and wp_downgrade_core_version set: both findings fire correctly, target version is surfaced.
This commit is contained in:
@@ -23,26 +23,70 @@ return new class extends WPH_Step {
|
||||
global $wp_version;
|
||||
$f = [];
|
||||
|
||||
// What WordPress itself reports (this can be filtered by WP Downgrade etc.)
|
||||
if (!function_exists('get_core_updates')) require_once ABSPATH . 'wp-admin/includes/update.php';
|
||||
$updates = function_exists('get_core_updates') ? get_core_updates(['dismissed' => true]) : [];
|
||||
$latest = (!empty($updates) && !empty($updates[0]->current)) ? $updates[0]->current : $wp_version;
|
||||
$behind = version_compare($wp_version, $latest, '<');
|
||||
$wp_reported_latest = (!empty($updates) && !empty($updates[0]->current)) ? $updates[0]->current : $wp_version;
|
||||
|
||||
// Direct query to wp.org — can't be cloaked by site-side filters.
|
||||
$wp_org_latest = $this->wp_org_core_version();
|
||||
|
||||
// Detect known plugins that hide/manipulate version reporting.
|
||||
$cloakers = $this->detect_cloakers();
|
||||
|
||||
$f[] = $this->finding('wp_current', 'info', 'Currently installed', $wp_version, '');
|
||||
|
||||
// What WP reports as the latest
|
||||
$wp_behind = version_compare($wp_version, $wp_reported_latest, '<');
|
||||
$f[] = $this->finding(
|
||||
'wp_current',
|
||||
'info',
|
||||
'Currently installed',
|
||||
$wp_version,
|
||||
''
|
||||
);
|
||||
$f[] = $this->finding(
|
||||
'wp_latest',
|
||||
$behind ? 'warn' : 'ok',
|
||||
'Latest available',
|
||||
$latest,
|
||||
$behind ? 'Update available → ' . admin_url('update-core.php') : 'Up to date.'
|
||||
'wp_reported_latest',
|
||||
$wp_behind ? 'warn' : 'ok',
|
||||
'Latest per WordPress',
|
||||
$wp_reported_latest,
|
||||
'This is what core/get_core_updates() returns — may be filtered by plugins like WP Downgrade.'
|
||||
);
|
||||
|
||||
// What wp.org actually thinks
|
||||
if ($wp_org_latest === null) {
|
||||
$f[] = $this->finding('wp_org_latest', 'info', 'Latest per wp.org', 'could not fetch', 'Direct API call failed — re-run when online.');
|
||||
} else {
|
||||
$actual_behind = version_compare($wp_version, $wp_org_latest, '<');
|
||||
$hidden_gap = version_compare($wp_reported_latest, $wp_org_latest, '<');
|
||||
$level = $hidden_gap ? 'bad' : ($actual_behind ? 'warn' : 'ok');
|
||||
$detail = '';
|
||||
if ($hidden_gap) {
|
||||
$detail = 'CLOAKED — WordPress says latest is ' . $wp_reported_latest . ' but wp.org reports ' . $wp_org_latest . '. Updates likely blocked by a plugin or constant.';
|
||||
} elseif ($actual_behind) {
|
||||
$detail = 'Real update available → ' . admin_url('update-core.php');
|
||||
} else {
|
||||
$detail = 'Up to date against the public WP.org API.';
|
||||
}
|
||||
$f[] = $this->finding('wp_org_latest', $level, 'Latest per wp.org (direct)', $wp_org_latest, $detail);
|
||||
}
|
||||
|
||||
// Flag cloaker plugins explicitly
|
||||
if ($cloakers) {
|
||||
$f[] = $this->finding(
|
||||
'cloakers',
|
||||
'warn',
|
||||
'Update-cloaker plugins active',
|
||||
implode(', ', $cloakers),
|
||||
'These plugins can hide or block core/plugin updates. Confirm with the client whether they\'re needed before disabling them.'
|
||||
);
|
||||
}
|
||||
|
||||
// WP Downgrade specifically pins a target via an option — surface its value
|
||||
$wpd_target = get_option('wp_downgrade_core_version', '');
|
||||
if ($wpd_target) {
|
||||
$f[] = $this->finding(
|
||||
'wp_downgrade_target',
|
||||
'warn',
|
||||
'WP Downgrade target',
|
||||
(string) $wpd_target,
|
||||
'WordPress core is pinned to this version by WP Downgrade. Set wp_downgrade_core_version to empty to release the pin.'
|
||||
);
|
||||
}
|
||||
|
||||
// Database upgrade required?
|
||||
if (function_exists('wp_get_db_schema')) {
|
||||
$required = (int) get_option('db_version');
|
||||
@@ -66,7 +110,8 @@ return new class extends WPH_Step {
|
||||
);
|
||||
|
||||
// Safe-mode update guidance — not an action, just a reminder.
|
||||
if ($behind) {
|
||||
$real_behind = $wp_org_latest !== null && version_compare($wp_version, $wp_org_latest, '<');
|
||||
if ($real_behind || $wp_behind) {
|
||||
$f[] = $this->finding(
|
||||
'safe_mode_hint',
|
||||
'info',
|
||||
@@ -78,4 +123,37 @@ return new class extends WPH_Step {
|
||||
|
||||
return $f;
|
||||
}
|
||||
|
||||
/** Direct call to wp.org's version-check endpoint. Cached 1h via transient. */
|
||||
private function wp_org_core_version(): ?string {
|
||||
$cached = get_transient('wph_wp_org_core_latest');
|
||||
if ($cached !== false) return $cached === '' ? null : (string) $cached;
|
||||
$resp = wp_remote_get('https://api.wordpress.org/core/version-check/1.7/', ['timeout' => 5]);
|
||||
if (is_wp_error($resp) || (int) wp_remote_retrieve_response_code($resp) !== 200) {
|
||||
set_transient('wph_wp_org_core_latest', '', 5 * MINUTE_IN_SECONDS);
|
||||
return null;
|
||||
}
|
||||
$data = json_decode((string) wp_remote_retrieve_body($resp), true);
|
||||
$latest = isset($data['offers'][0]['version']) ? (string) $data['offers'][0]['version'] : null;
|
||||
set_transient('wph_wp_org_core_latest', $latest ?: '', HOUR_IN_SECONDS);
|
||||
return $latest;
|
||||
}
|
||||
|
||||
/** Detect plugins that are known to hide or manipulate version reporting. */
|
||||
private function detect_cloakers(): array {
|
||||
if (!function_exists('is_plugin_active')) require_once ABSPATH . 'wp-admin/includes/plugin.php';
|
||||
$known = [
|
||||
'wp-downgrade/wp-downgrade.php' => 'WP Downgrade',
|
||||
'wp-rollback/wp-rollback.php' => 'WP Rollback',
|
||||
'easy-updates-manager/wpmudev_install.php' => 'Easy Updates Manager',
|
||||
'stops-core-theme-and-plugin-updates/stops-core-theme-and-plugin-updates.php' => 'Stops Core/Theme/Plugin Updates',
|
||||
'disable-updates-manager/disable-updates-manager.php' => 'Disable Updates Manager',
|
||||
'companion-auto-update/companion-auto-update.php' => 'Companion Auto Update',
|
||||
];
|
||||
$found = [];
|
||||
foreach ($known as $file => $label) {
|
||||
if (is_plugin_active($file)) $found[] = $label;
|
||||
}
|
||||
return $found;
|
||||
}
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user