Steve Hanlon
4e030ae5ee
Step 3 (Core) now does three independent lookups: - Installed version (the truth, from $wp_version) - Latest per WordPress (via get_core_updates — what WP_Downgrade can manipulate) - Latest per wp.org (direct call to api.wordpress.org/core/version-check/1.7/ cached 1h, can't be cloaked from the server side) If 'Latest per WordPress' < 'Latest per wp.org', the finding is bumped to bad with a CLOAKED detail message. The wp_downgrade_core_version option is also surfaced verbatim so it's obvious where the pin lives. Step 4 (Plugins) similarly: - wp_org_info() now captures the version field from the WP.org plugins info API. Cache key bumped to wph_pi2_ so existing entries get re-fetched. - For each plugin: installed version vs wp.org reported version. - If installed < wp.org AND the WP update_plugins transient doesn't flag it, the row is bad with 'CLOAKED — WP says up-to-date'. - Cloaked count surfaces in the summary. Both steps also explicitly detect a roster of known cloaker plugins (WP Downgrade, WP Rollback, Easy Updates Manager, Disable Updates Manager, Stops Core/Theme/Plugin Updates, Companion Auto Update) and warn when any are active, so the technician sees the framing before diving into individual rows. Smoke-tested with WP Downgrade installed and wp_downgrade_core_version set: both findings fire correctly, target version is surfaced.
186 lines
8.4 KiB
PHP
186 lines
8.4 KiB
PHP
<?php
|
|
if (!defined('ABSPATH')) exit;
|
|
|
|
return new class extends WPH_Step {
|
|
public function id(): string { return 'plugins'; }
|
|
public function title(): string { return 'Step 4 — Plugin Updates'; }
|
|
public function sub_items(): array {
|
|
return [
|
|
'Go to Dashboard → Updates and review all pending plugin updates',
|
|
'Before updating, note which plugins have updates and what versions they are moving to',
|
|
'Update plugins one at a time if the site is complex or has many interdependencies; batch update is acceptable for straightforward sites',
|
|
'After each update (or after a batch), check the front-end and any key functional areas (forms, checkout, membership, etc.)',
|
|
'Check for any plugins that have been deactivated but not deleted — flag these to the client',
|
|
];
|
|
}
|
|
public function watch_outs(): array {
|
|
return [
|
|
'WooCommerce updates — always treat these as high-risk, test checkout flow afterwards',
|
|
'Page builder updates (Elementor, Divi, Beaver Builder) — can affect layout rendering',
|
|
'Security plugin updates — confirm they reactivate and are still reporting clean',
|
|
'Plugins that haven\'t been updated by their developer in over 12 months — flag as a risk',
|
|
'Plugins showing "Update unavailable" or removed from the WordPress repository — flag immediately, these can indicate abandoned or compromised plugins',
|
|
];
|
|
}
|
|
|
|
public function autocheck(array $session_state): array {
|
|
if (!function_exists('get_plugins')) require_once ABSPATH . 'wp-admin/includes/plugin.php';
|
|
$plugins = get_plugins();
|
|
$f = [];
|
|
$abandoned = 0;
|
|
$removed = 0;
|
|
$update_avail = 0; // WP itself sees an update
|
|
$cloaked = 0; // wp.org says there's a newer version, WP doesn't
|
|
|
|
// Refresh update transient (no-op if recent) — this is what WP sees,
|
|
// which may be filtered by WP Downgrade / WP Rollback / etc.
|
|
if (function_exists('wp_update_plugins')) wp_update_plugins();
|
|
$updates = get_site_transient('update_plugins');
|
|
$update_map = isset($updates->response) && is_array($updates->response) ? $updates->response : [];
|
|
|
|
// Detect known cloakers
|
|
$cloakers = $this->detect_cloakers();
|
|
if ($cloakers) {
|
|
$f[] = $this->finding(
|
|
'cloakers', 'warn',
|
|
'Update-cloaker plugins active',
|
|
implode(', ', $cloakers),
|
|
'Plugin update reporting may be filtered. The wp.org column below is fetched directly and cannot be cloaked.'
|
|
);
|
|
}
|
|
|
|
foreach ($plugins as $file => $meta) {
|
|
$slug = dirname($file);
|
|
if ($slug === '.' || $slug === '') $slug = basename($file, '.php');
|
|
$installed = (string) ($meta['Version'] ?? '');
|
|
$info = $this->wp_org_info($slug);
|
|
$detail_parts = [];
|
|
$level = 'ok';
|
|
|
|
if ($info === 'not_in_repo') {
|
|
$level = 'warn';
|
|
$detail_parts[] = 'Not in WP.org repo (could be premium, custom, or removed)';
|
|
$removed++;
|
|
} elseif ($info === 'removed') {
|
|
$level = 'bad';
|
|
$detail_parts[] = '⚠ Removed from WP.org repo — possible abandonment or compromise';
|
|
$removed++;
|
|
} elseif (is_array($info)) {
|
|
if (!empty($info['last_updated'])) {
|
|
$age_days = floor((time() - strtotime($info['last_updated'])) / DAY_IN_SECONDS);
|
|
$detail_parts[] = 'Last release ' . $age_days . 'd ago';
|
|
if ($age_days > 365) {
|
|
$level = 'warn';
|
|
$abandoned++;
|
|
$detail_parts[] = '>12 mo';
|
|
}
|
|
}
|
|
if (!empty($info['active_installs'])) {
|
|
$detail_parts[] = number_format($info['active_installs']) . ' active installs';
|
|
}
|
|
|
|
// Compare installed vs wp.org reported version — un-cloakable truth.
|
|
if (!empty($info['version']) && $installed) {
|
|
$real_behind = version_compare($installed, (string) $info['version'], '<');
|
|
$wp_sees_update = isset($update_map[$file]);
|
|
if ($real_behind) {
|
|
$detail_parts[] = 'wp.org has ' . $info['version'];
|
|
$update_avail++;
|
|
if (!$wp_sees_update) {
|
|
$level = 'bad';
|
|
$detail_parts[] = 'CLOAKED — WP says up-to-date';
|
|
$cloaked++;
|
|
} else {
|
|
$level = 'warn';
|
|
}
|
|
} elseif ($wp_sees_update) {
|
|
// Edge case: WP transient says there's an update but we have it or newer.
|
|
$detail_parts[] = 'WP transient still flags an update';
|
|
$level = 'warn';
|
|
}
|
|
}
|
|
}
|
|
|
|
$f[] = $this->finding(
|
|
'plugin_' . sanitize_key($file),
|
|
$level,
|
|
$meta['Name'] ?? $file,
|
|
$installed,
|
|
implode(' · ', $detail_parts)
|
|
);
|
|
}
|
|
|
|
// Summary at the top
|
|
array_unshift($f, $this->finding(
|
|
'summary',
|
|
$cloaked ? 'bad' : 'info',
|
|
'Summary',
|
|
count($plugins) . ' plugins',
|
|
sprintf('%d with updates · %d cloaked · %d not updated in 12 mo · %d not in WP.org',
|
|
$update_avail, $cloaked, $abandoned, $removed)
|
|
));
|
|
|
|
return $f;
|
|
}
|
|
|
|
/** Detect plugins that can hide or manipulate version reporting. */
|
|
private function detect_cloakers(): array {
|
|
if (!function_exists('is_plugin_active')) require_once ABSPATH . 'wp-admin/includes/plugin.php';
|
|
$known = [
|
|
'wp-downgrade/wp-downgrade.php' => 'WP Downgrade',
|
|
'wp-rollback/wp-rollback.php' => 'WP Rollback',
|
|
'easy-updates-manager/wpmudev_install.php' => 'Easy Updates Manager',
|
|
'stops-core-theme-and-plugin-updates/stops-core-theme-and-plugin-updates.php' => 'Stops Core/Theme/Plugin Updates',
|
|
'disable-updates-manager/disable-updates-manager.php' => 'Disable Updates Manager',
|
|
'companion-auto-update/companion-auto-update.php' => 'Companion Auto Update',
|
|
];
|
|
$found = [];
|
|
foreach ($known as $file => $label) {
|
|
if (is_plugin_active($file)) $found[] = $label;
|
|
}
|
|
return $found;
|
|
}
|
|
|
|
/**
|
|
* Returns ['name' => ..., 'last_updated' => ..., 'active_installs' => ...]
|
|
* or 'not_in_repo' / 'removed' on failure. Cached 24h per slug via transient.
|
|
*/
|
|
private function wp_org_info(string $slug) {
|
|
// v2: cache now includes 'version' field for cloak detection — fresh prefix
|
|
// so existing cached entries get re-fetched on the next refresh.
|
|
$cache_key = 'wph_pi2_' . md5($slug);
|
|
$cached = get_transient($cache_key);
|
|
if ($cached !== false) return $cached;
|
|
|
|
$url = 'https://api.wordpress.org/plugins/info/1.0/' . rawurlencode($slug) . '.json';
|
|
$resp = wp_remote_get($url, ['timeout' => 4]);
|
|
if (is_wp_error($resp)) {
|
|
set_transient($cache_key, 'not_in_repo', HOUR_IN_SECONDS);
|
|
return 'not_in_repo';
|
|
}
|
|
$code = wp_remote_retrieve_response_code($resp);
|
|
$body = wp_remote_retrieve_body($resp);
|
|
if ($code === 404) {
|
|
set_transient($cache_key, 'not_in_repo', DAY_IN_SECONDS);
|
|
return 'not_in_repo';
|
|
}
|
|
$data = json_decode((string) $body, true);
|
|
if (!is_array($data)) {
|
|
set_transient($cache_key, 'not_in_repo', HOUR_IN_SECONDS);
|
|
return 'not_in_repo';
|
|
}
|
|
if (isset($data['error'])) {
|
|
set_transient($cache_key, 'removed', DAY_IN_SECONDS);
|
|
return 'removed';
|
|
}
|
|
$out = [
|
|
'name' => $data['name'] ?? $slug,
|
|
'version' => $data['version'] ?? null,
|
|
'last_updated' => $data['last_updated'] ?? null,
|
|
'active_installs' => $data['active_installs'] ?? null,
|
|
];
|
|
set_transient($cache_key, $out, DAY_IN_SECONDS);
|
|
return $out;
|
|
}
|
|
};
|