Skip to content

Commit 102e2fb

Browse files
PDowneyPDowney
authored
Updates
1 parent 00c7e3d commit 102e2fb

3 files changed

Lines changed: 12 additions & 4 deletions

File tree

‎config/var/www/admin/control-panel/controllers/CsrfController.php‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,9 +35,15 @@ public function getToken()
3535
$csrfToken = $this->getSessionValue('csrf_token');
3636
if ($csrfToken === null) {
3737
// Generate a new CSRF token if one does not exist
38-
$csrfToken = bin2hex(random_bytes(32));
38+
try {
39+
$csrfToken = bin2hex(random_bytes(32));
40+
} catch (\Exception $e) {
41+
// Explicitly handle random_bytes() failure to avoid using an invalid token
42+
$this->logSecurityEvent('CSRF token generation failed', $e->getMessage());
43+
$this->response->serverError('Unable to generate CSRF token');
44+
return;
45+
}
3946
$this->setSessionValue('csrf_token', $csrfToken);
40-
$this->logSecurityEvent('CSRF token generated', 'New session token created');
4147
}
4248
$this->response->success([
4349
'csrf_token' => $csrfToken,

‎scripts/update/php-config-update.sh‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,9 @@ source /usr/local/bin/enginescript/scripts/functions/shared/enginescript-common.
1919
# Start Main Script
2020

2121
# Calculate PHP FPM tune depending on RAM
22-
# No fallbacks needed as this script will be run on a system with a modern kernel and the /proc/meminfo file should be present and properly formatted.
2322
calculate_php() {
23+
# No fallbacks needed as this script will be run on a system with a modern kernel.
24+
# MemAvailable field will be present in /proc/meminfo on modern kernels and is the most accurate representation of available memory for applications.
2425
AVAILABLE_MEMORY=$(awk '/MemAvailable/ {printf "%d", $2/1024}' /proc/meminfo)
2526
AVERAGE_PHP_MEMORY_REQ=80
2627
CPU_COUNT="$(nproc --all)" # Get the number of CPU threads

‎scripts/update/wp-cli-update.sh‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,9 @@ source /usr/local/bin/enginescript/scripts/functions/shared/enginescript-common.
2121
#----------------------------------------------------------------------------
2222

2323
# Update WP-CLI
24+
# The intent is to fail when either command fails
2425
if ! wp cli update --stable --allow-root --yes 2>> /tmp/enginescript_install_errors.log \
25-
&& ! wp package update --allow-root --yes 2>> /tmp/enginescript_install_errors.log; then
26+
|| ! wp package update --allow-root --yes 2>> /tmp/enginescript_install_errors.log; then
2627
echo "WP-CLI update failed. See /tmp/enginescript_install_errors.log for details." >&2
2728
exit 1
2829
fi

0 commit comments

Comments
 (0)