Wala shell

Advanced PHP File Manager

Server IP: 127.0.0.1 | PHP Version: 8.3.30 | Domains Hosted: 54

Name	Size	Last Modified	Actions
📁 ..	-	2026-01-07 15:08
📄 Checksum_Base_Command.php <?php use WP_CLI\Utils; /** * Base command that all checksum commands rely on. * * @package wp-cli / class Checksum_Base_Command extends WP_CLI_Command { /* * Normalizes directory separators to slashes. * * @param string $path Path to convert. * * @return string Path with all backslashes replaced by slashes. / public static function normalize_directory_separators( $path ) { return str_replace( '\\', '/', $path ); } /* * Read a remote file and return its contents. * * @param string $url URL of the remote file to read. * * @return mixed / protected static function _read( $url ) { // phpcs:ignore PSR2.Methods.MethodDeclaration.Underscore -- Could be used in classes extending this class. $headers = array( 'Accept' => 'application/json' ); /* * @var \WpOrg\Requests\Response $response / $response = Utils\http_request( 'GET', $url, null, $headers, array( 'timeout' => 30 ) ); if ( 200 === $response->status_code ) { return $response->body; } WP_CLI::error( "Couldn't fetch response from {$url} (HTTP code {$response->status_code})." ); } /* * Recursively get the list of files for a given path. * * @param string $path Root path to start the recursive traversal in. * * @return array<string> / protected function get_files( $path ) { $filtered_files = array(); try { $files = new RecursiveIteratorIterator( new RecursiveCallbackFilterIterator( new RecursiveDirectoryIterator( $path, RecursiveDirectoryIterator::SKIP_DOTS ), function ( $current ) use ( $path ) { return $this->filter_file( self::normalize_directory_separators( substr( $current->getPathname(), strlen( $path ) ) ) ); } ), RecursiveIteratorIterator::CHILD_FIRST ); /* * @var \SplFileInfo $file_info / foreach ( $files as $file_info ) { if ( $file_info->isFile() ) { $filtered_files[] = self::normalize_directory_separators( substr( $file_info->getPathname(), strlen( $path ) ) ); } } } catch ( Exception $e ) { WP_CLI::error( $e->getMessage() ); } return $filtered_files; } /* * Whether to include the file in the verification or not. * * Can be overridden in subclasses. * * @param string $filepath Path to a file. * * @return bool */ protected function filter_file( $filepath ) { return true; } }	2.34 KB	2026-01-07 15:08
📄 Checksum_Core_Command.php <?php use WP_CLI\Formatter; use WP_CLI\Utils; use WP_CLI\WpOrgApi; /** * Verifies core file integrity by comparing to published checksums. * * @package wp-cli / class Checksum_Core_Command extends Checksum_Base_Command { /* * Whether or not to verify contents of the root directory. * * @var boolean / private $include_root = false; /* * Files to exclude from the verification. * * @var array / private $exclude_files = []; /* * Array of detected errors. * * @var array / private $errors = []; /* * Verifies WordPress files against WordPress.org's checksums. * * Downloads md5 checksums for the current version from WordPress.org, and * compares those checksums against the currently installed files. * * For security, avoids loading WordPress when verifying checksums. * * If you experience issues verifying from this command, ensure you are * passing the relevant `--locale` and `--version` arguments according to * the values from the `Dashboard->Updates` menu in the admin area of the * site. * * ## OPTIONS * * [--include-root] * : Verify all files and folders in the root directory, and warn if any non-WordPress items are found. * * [--version=<version>] * : Verify checksums against a specific version of WordPress. * * [--locale=<locale>] * : Verify checksums against a specific locale of WordPress. * * [--insecure] * : Retry downloads without certificate validation if TLS handshake fails. Note: This makes the request vulnerable to a MITM attack. * * [--exclude=<files>] * : Exclude specific files from the checksum verification. Provide a comma-separated list of file paths. * * [--format=<format>] * : Render output in a specific format. When provided, messages are displayed in the chosen format. * --- * default: plain * options: * - plain * - table * - json * - csv * - yaml * - count * --- * * ## EXAMPLES * * # Verify checksums * $ wp core verify-checksums * Success: WordPress installation verifies against checksums. * * # Verify checksums for given WordPress version * $ wp core verify-checksums --version=4.0 * Success: WordPress installation verifies against checksums. * * # Verify checksums for given locale * $ wp core verify-checksums --locale=en_US * Success: WordPress installation verifies against checksums. * * # Verify checksums for given locale * $ wp core verify-checksums --locale=ja * Warning: File doesn't verify against checksum: wp-includes/version.php * Warning: File doesn't verify against checksum: readme.html * Warning: File doesn't verify against checksum: wp-config-sample.php * Error: WordPress installation doesn't verify against checksums. * * # Verify checksums and exclude files * $ wp core verify-checksums --exclude="readme.html" * Success: WordPress installation verifies against checksums. * * # Verify checksums with formatted output * $ wp core verify-checksums --format=json * [{"file":"readme.html","message":"File doesn't verify against checksum"}] * Error: WordPress installation doesn't verify against checksums. * * @when before_wp_load / public function __invoke( $args, $assoc_args ) { $wp_version = ''; $locale = ''; if ( ! empty( $assoc_args['version'] ) ) { $wp_version = $assoc_args['version']; } if ( ! empty( $assoc_args['locale'] ) ) { $locale = $assoc_args['locale']; } if ( ! empty( $assoc_args['include-root'] ) ) { $this->include_root = true; } if ( ! empty( $assoc_args['exclude'] ) ) { $exclude = Utils\get_flag_value( $assoc_args, 'exclude', '' ); $this->exclude_files = explode( ',', $exclude ); } if ( empty( $wp_version ) ) { $details = self::get_wp_details(); $wp_version = $details['wp_version']; if ( empty( $locale ) ) { $locale = $details['wp_local_package']; } } $insecure = Utils\get_flag_value( $assoc_args, 'insecure', false ); $wp_org_api = new WpOrgApi( [ 'insecure' => $insecure ] ); try { $checksums = $wp_org_api->get_core_checksums( $wp_version, empty( $locale ) ? 'en_US' : $locale ); } catch ( Exception $exception ) { WP_CLI::error( $exception ); } if ( ! is_array( $checksums ) ) { WP_CLI::error( "Couldn't get checksums from WordPress.org." ); } $has_errors = false; foreach ( $checksums as $file => $checksum ) { // Skip files which get updated if ( 'wp-content' === substr( $file, 0, 10 ) ) { continue; } if ( in_array( $file, $this->exclude_files, true ) ) { continue; } if ( ! file_exists( ABSPATH . $file ) ) { $this->errors[] = [ 'file' => $file, 'message' => "File doesn't exist", ]; $has_errors = true; continue; } $md5_file = md5_file( ABSPATH . $file ); if ( $checksum !== $md5_file ) { $this->errors[] = [ 'file' => $file, 'message' => "File doesn't verify against checksum", ]; $has_errors = true; } } $core_checksums_files = array_filter( array_keys( $checksums ), [ $this, 'filter_file' ] ); $core_files = $this->get_files( ABSPATH ); $additional_files = array_diff( $core_files, $core_checksums_files ); if ( ! empty( $additional_files ) ) { foreach ( $additional_files as $additional_file ) { if ( in_array( $additional_file, $this->exclude_files, true ) ) { continue; } $this->errors[] = [ 'file' => $additional_file, 'message' => 'File should not exist', ]; } } if ( ! empty( $this->errors ) ) { if ( ! isset( $assoc_args['format'] ) \|\| 'plain' === $assoc_args['format'] ) { foreach ( $this->errors as $error ) { WP_CLI::warning( sprintf( '%s: %s', $error['message'], $error['file'] ) ); } } else { $formatter = new Formatter( $assoc_args, array( 'file', 'message' ) ); $formatter->display_items( $this->errors ); } } if ( ! $has_errors ) { WP_CLI::success( 'WordPress installation verifies against checksums.' ); } else { WP_CLI::error( "WordPress installation doesn't verify against checksums." ); } } /* * Whether to include the file in the verification or not. * * @param string $filepath Path to a file. * * @return bool / protected function filter_file( $filepath ) { if ( true === $this->include_root ) { return ( 1 !== preg_match( '/^(\.htaccess$\|\.maintenance$\|wp-config\.php$\|wp-content\/)/', $filepath ) ); } return ( 0 === strpos( $filepath, 'wp-admin/' ) \|\| 0 === strpos( $filepath, 'wp-includes/' ) \|\| 1 === preg_match( '/^wp-(?!config\.php)([^\/])$/', $filepath ) ); } /** * Gets version information from `wp-includes/version.php`. * * @return array { * @type string $wp_version The WordPress version. * @type int $wp_db_version The WordPress DB revision. * @type string $tinymce_version The TinyMCE version. * @type string $wp_local_package The TinyMCE version. * } / private static function get_wp_details() { $versions_path = ABSPATH . 'wp-includes/version.php'; if ( ! is_readable( $versions_path ) ) { WP_CLI::error( "This does not seem to be a WordPress install.\n" . 'Pass --path=`path/to/wordpress` or run `wp core download`.' ); } $version_content = (string) file_get_contents( $versions_path, false, null, 6, 2048 ); $vars = [ 'wp_version', 'wp_db_version', 'tinymce_version', 'wp_local_package' ]; $result = []; foreach ( $vars as $var_name ) { $result[ $var_name ] = self::find_var( $var_name, $version_content ); } return $result; } /* * Searches for the value assigned to variable `$var_name` in PHP code `$code`. * * This is equivalent to matching the `\$VAR_NAME = ([^;]+)` regular expression and returning * the first match either as a `string` or as an `integer` (depending if it's surrounded by * quotes or not). * * @param string $var_name Variable name to search for. * @param string $code PHP code to search in. * * @return string\|null */ private static function find_var( $var_name, $code ) { $start = strpos( $code, '$' . $var_name . ' = ' ); if ( false === $start ) { return null; } $start = $start + strlen( $var_name ) + 3; $end = strpos( $code, ';', $start ); $value = substr( $code, $start, $end - $start ); return trim( $value, " '" ); } }	8.31 KB	2026-01-07 15:08
📄 Checksum_Plugin_Command.php <?php use WP_CLI\Fetchers; use WP_CLI\Formatter; use WP_CLI\Utils; use WP_CLI\WpOrgApi; /** * Verifies plugin file integrity by comparing to published checksums. * * @package wp-cli / class Checksum_Plugin_Command extends Checksum_Base_Command { /* * Cached plugin data for all installed plugins. * * @var array\|null / private $plugins_data; /* * Array of detected errors. * * @var array / private $errors = array(); /* * Verifies plugin files against WordPress.org's checksums. * * ## OPTIONS * * [<plugin>...] * : One or more plugins to verify. * * [--all] * : If set, all plugins will be verified. * * [--strict] * : If set, even "soft changes" like readme.txt changes will trigger * checksum errors. * * [--version=<version>] * : Verify checksums against a specific plugin version. * * [--format=<format>] * : Render output in a specific format. * --- * default: table * options: * - table * - json * - csv * - yaml * - count * --- * * [--insecure] * : Retry downloads without certificate validation if TLS handshake fails. Note: This makes the request vulnerable to a MITM attack. * * [--exclude=<name>] * : Comma separated list of plugin names that should be excluded from verifying. * * ## EXAMPLES * * # Verify the checksums of all installed plugins * $ wp plugin verify-checksums --all * Success: Verified 8 of 8 plugins. * * # Verify the checksums of a single plugin, Akismet in this case * $ wp plugin verify-checksums akismet * Success: Verified 1 of 1 plugins. / public function __invoke( $args, $assoc_args ) { $fetcher = new Fetchers\UnfilteredPlugin(); $all = Utils\get_flag_value( $assoc_args, 'all', false ); $strict = Utils\get_flag_value( $assoc_args, 'strict', false ); $insecure = Utils\get_flag_value( $assoc_args, 'insecure', false ); $plugins = $fetcher->get_many( $all ? $this->get_all_plugin_names() : $args ); /* * @var string $exclude / $exclude = Utils\get_flag_value( $assoc_args, 'exclude', '' ); $version_arg = isset( $assoc_args['version'] ) ? $assoc_args['version'] : ''; if ( empty( $plugins ) && ! $all ) { WP_CLI::error( 'You need to specify either one or more plugin slugs to check or use the --all flag to check all plugins.' ); } $exclude_list = explode( ',', $exclude ); $skips = 0; foreach ( $plugins as $plugin ) { $version = empty( $version_arg ) ? $this->get_plugin_version( $plugin->file ) : $version_arg; if ( in_array( $plugin->name, $exclude_list, true ) ) { ++$skips; continue; } if ( 'hello' === $plugin->name ) { $this->verify_hello_dolly_from_core( $assoc_args ); continue; } if ( false === $version ) { WP_CLI::warning( "Could not retrieve the version for plugin {$plugin->name}, skipping." ); ++$skips; continue; } $wp_org_api = new WpOrgApi( [ 'insecure' => $insecure ] ); try { /* * @var array\|false $checksums / $checksums = $wp_org_api->get_plugin_checksums( $plugin->name, $version ); } catch ( Exception $exception ) { WP_CLI::warning( $exception->getMessage() ); $checksums = false; } if ( false === $checksums ) { WP_CLI::warning( "Could not retrieve the checksums for version {$version} of plugin {$plugin->name}, skipping." ); ++$skips; continue; } $files = $this->get_plugin_files( $plugin->file ); foreach ( $files as $file ) { if ( ! array_key_exists( $file, $checksums ) ) { $this->add_error( $plugin->name, $file, 'File was added' ); continue; } if ( ! $strict && $this->is_soft_change_file( $file ) ) { continue; } $result = $this->check_file_checksum( dirname( $plugin->file ) . '/' . $file, $checksums[ $file ] ); if ( true !== $result ) { $this->add_error( $plugin->name, $file, is_string( $result ) ? $result : 'Checksum does not match' ); } } } if ( ! empty( $this->errors ) ) { $formatter = new Formatter( $assoc_args, array( 'plugin_name', 'file', 'message' ) ); $formatter->display_items( $this->errors ); } $total = count( $plugins ); $failures = count( array_unique( array_column( $this->errors, 'plugin_name' ) ) ); $successes = $total - $failures - $skips; Utils\report_batch_operation_results( 'plugin', 'verify', $total, $successes, $failures, $skips ); } private function verify_hello_dolly_from_core( $assoc_args ) { $file = 'hello.php'; $wp_version = get_bloginfo( 'version', 'display' ); $insecure = Utils\get_flag_value( $assoc_args, 'insecure', false ); $wp_org_api = new WpOrgApi( [ 'insecure' => $insecure ] ); $locale = 'en_US'; try { $checksums = $wp_org_api->get_core_checksums( $wp_version, $locale ); } catch ( Exception $exception ) { WP_CLI::error( $exception ); } if ( ! is_array( $checksums ) \|\| ! isset( $checksums['wp-content/plugins/hello.php'] ) ) { WP_CLI::error( "Couldn't get hello.php checksum from WordPress.org." ); } $md5_file = md5_file( $this->get_absolute_path( '/' ) . $file ); if ( $md5_file !== $checksums['wp-content/plugins/hello.php'] ) { $this->add_error( 'hello', $file, 'Checksum does not match' ); } } /* * Adds a new error to the array of detected errors. * * @param string $plugin_name Name of the plugin that had the error. * @param string $file Relative path to the file that had the error. * @param string $message Message explaining the error. / private function add_error( $plugin_name, $file, $message ) { $error['plugin_name'] = $plugin_name; $error['file'] = $file; $error['message'] = $message; $this->errors[] = $error; } /* * Gets the currently installed version for a given plugin. * * @param string $path Relative path to plugin file to get the version for. * * @return string\|false Installed version of the plugin, or false if not * found. / private function get_plugin_version( $path ) { if ( ! isset( $this->plugins_data ) ) { $this->plugins_data = get_plugins(); } if ( ! array_key_exists( $path, $this->plugins_data ) ) { return false; } return $this->plugins_data[ $path ]['Version']; } /* * Gets the names of all installed plugins. * * @return array<string> Names of all installed plugins. / private function get_all_plugin_names() { $names = array(); foreach ( get_plugins() as $file => $details ) { $names[] = Utils\get_plugin_name( $file ); } return $names; } /* * Gets the list of files that are part of the given plugin. * * @param string $path Relative path to the main plugin file. * * @return array<string> Array of files with their relative paths. / private function get_plugin_files( $path ) { $folder = dirname( $this->get_absolute_path( $path ) ); // Return single file plugins immediately, to avoid iterating over the // entire plugins folder. if ( WP_PLUGIN_DIR === $folder ) { return (array) $path; } return $this->get_files( trailingslashit( $folder ) ); } /* * Checks the integrity of a single plugin file by comparing it to the * officially provided checksum. * * @param string $path Relative path to the plugin file to check the * integrity of. * @param array $checksums Array of provided checksums to compare against. * * @return bool\|string / private function check_file_checksum( $path, $checksums ) { if ( $this->supports_sha256() && array_key_exists( 'sha256', $checksums ) ) { $sha256 = $this->get_sha256( $this->get_absolute_path( $path ) ); return in_array( $sha256, (array) $checksums['sha256'], true ); } if ( ! array_key_exists( 'md5', $checksums ) ) { return 'No matching checksum algorithm found'; } $md5 = $this->get_md5( $this->get_absolute_path( $path ) ); return in_array( $md5, (array) $checksums['md5'], true ); } /* * Checks whether the current environment supports 256-bit SHA-2. * * Should be supported for PHP 5+, but we might find edge cases depending on * host. * * @return bool / private function supports_sha256() { return true; } /* * Gets the 256-bit SHA-2 of a given file. * * @param string $filepath Absolute path to the file to calculate the SHA-2 * for. * * @return string\|false / private function get_sha256( $filepath ) { return hash_file( 'sha256', $filepath ); } /* * Gets the MD5 of a given file. * * @param string $filepath Absolute path to the file to calculate the MD5 * for. * * @return string\|false / private function get_md5( $filepath ) { return hash_file( 'md5', $filepath ); } /* * Gets the absolute path to a relative plugin file. * * @param string $path Relative path to get the absolute path for. * * @return string / private function get_absolute_path( $path ) { return WP_PLUGIN_DIR . '/' . $path; } /* * Returns a list of files that only trigger checksum errors in strict mode. * * @return array<string> Array of file names. / private function get_soft_change_files() { static $files = array( 'readme.txt', 'readme.md', ); return $files; } /* * Checks whether a given file will only trigger checksum errors in strict * mode. * * @param string $file File to check. * * @return bool Whether the file only triggers checksum errors in strict * mode. */ private function is_soft_change_file( $file ) { return in_array( strtolower( $file ), $this->get_soft_change_files(), true ); } }	9.51 KB	2026-01-07 15:08
📄 Core_Command_Namespace.php <?php use WP_CLI\Dispatcher\CommandNamespace; /** * Downloads, installs, updates, and manages a WordPress installation. */ final class Core_Command_Namespace extends CommandNamespace { }	192 B	2025-05-25 12:40
📄 Plugin_Command_Namespace.php <?php use WP_CLI\Dispatcher\CommandNamespace; /** * Manages plugins, including installs, activations, and updates. */ final class Plugin_Command_Namespace extends CommandNamespace { }	189 B	2025-05-25 12:40
📁 WP_CLI	-	2025-05-25 12:40

Terminal