Skip to content

Add --insecure flag to config create & config shuffle-salts commands #128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
schlessera merged 5 commits into from
May 10, 2021
Merged

Add --insecure flag to config create & config shuffle-salts commands #128

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8df0299
Add --insecure flag to config create & config shuffle-salts commands
schlessera May 7, 2021
c79e3d9
Fix PHPCS issues
schlessera May 7, 2021
a3b24ee
Avoid else case
schlessera May 7, 2021
0eb136c
Fix PHPCS issues
schlessera May 7, 2021
eb6d668
Use WpOrgApi abstraction
schlessera May 10, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 29 additions & 20 deletions src/Config_Command.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,14 @@
<?php
use \WP_CLI\Utils;

use WP_CLI\ExitException;
use WP_CLI\Utils;
use WP_CLI\WpOrgApi;

/**
* Generates and reads the wp-config.php file.
*/
class Config_Command extends WP_CLI_Command {

/**
* WordPress.org API endpoint to fall back to if salts cannot be generated.
*
* @var string
*/
const WORDPRESS_ORG_API_SALT_ENDPOINT = 'https://api.wordpress.org/secret-key/1.1/salt/';

/**
* List of characters that are valid for a key name.
*
Expand Down Expand Up @@ -109,6 +105,9 @@ private static function get_initial_locale() {
* [--force]
* : Overwrites existing files, if present.
*
* [--insecure]
* : Retry API download without certificate validation if TLS handshake fails. Note: This makes the request vulnerable to a MITM attack.
*
* ## EXAMPLES
*
* # Standard wp-config.php file
Expand All @@ -128,7 +127,7 @@ private static function get_initial_locale() {
* Success: Generated 'wp-config.php' file.
*/
public function create( $_, $assoc_args ) {
if ( ! \WP_CLI\Utils\get_flag_value( $assoc_args, 'force' ) && Utils\locate_wp_config() ) {
if ( ! Utils\get_flag_value( $assoc_args, 'force' ) && Utils\locate_wp_config() ) {
WP_CLI::error( "The 'wp-config.php' file already exists." );
}

Expand Down Expand Up @@ -176,8 +175,8 @@ public function create( $_, $assoc_args ) {
$assoc_args['wp-cache-key-salt'] = self::unique_key();
} catch ( Exception $e ) {
$assoc_args['keys-and-salts'] = false;
$assoc_args['keys-and-salts-alt'] = self::read_(
self::WORDPRESS_ORG_API_SALT_ENDPOINT
$assoc_args['keys-and-salts-alt'] = self::fetch_remote_salts(
(bool) Utils\get_flag_value( $assoc_args, 'insecure', false )
);
}
}
Expand Down Expand Up @@ -217,7 +216,7 @@ public function edit() {
$contents = file_get_contents( $config_path );
$r = Utils\launch_editor_for_input( $contents, 'wp-config.php', 'php' );
if ( false === $r ) {
WP_CLI::warning( 'No changes made to wp-config.php.', 'Aborted' );
WP_CLI::warning( 'No changes made to wp-config.php, aborted.' );
} else {
file_put_contents( $config_path, $r );
}
Expand Down Expand Up @@ -680,6 +679,9 @@ public function has( $args, $assoc_args ) {
* [--force]
* : If an unknown key is requested to be shuffled, add it instead of throwing a warning.
*
* [--insecure]
* : Retry API download without certificate validation if TLS handshake fails. Note: This makes the request vulnerable to a MITM attack.
*
* ## EXAMPLES
*
* # Get new salts for your wp-config.php file
Expand Down Expand Up @@ -722,7 +724,7 @@ public function shuffle_salts( $args, $assoc_args ) {
}
}

$remote_salts = self::read_( self::WORDPRESS_ORG_API_SALT_ENDPOINT );
$remote_salts = self::fetch_remote_salts( (bool) Utils\get_flag_value( $assoc_args, 'insecure', false ) );
$remote_salts = explode( "\n", $remote_salts );
foreach ( $remote_salts as $k => $salt ) {
if ( ! empty( $salt ) ) {
Expand Down Expand Up @@ -773,14 +775,21 @@ private static function get_wp_config_diff( $list, $previous_list, $type, $exclu
return $result;
}

private static function read_( $url ) {
$headers = [ 'Accept' => 'application/json' ];
$response = Utils\http_request( 'GET', $url, null, $headers, [ 'timeout' => 30 ] );
if ( 200 === $response->status_code ) {
return $response->body;
} else {
WP_CLI::error( "Couldn't fetch response from {$url} (HTTP code {$response->status_code})." );
/**
* Read the salts from the WordPress.org API.
*
* @param bool $insecure Optional. Whether to retry without certificate validation on TLS handshake failure.
* @return string String with a set of PHP define() statements to define the salts.
* @throws ExitException If the remote request failed.
*/
private static function fetch_remote_salts( $insecure = false ) {
try {
$salts = (string) ( new WpOrgApi( [ 'insecure' => $insecure ] ) )->get_salts();
} catch ( Exception $exception ) {
WP_CLI::error( $exception );
}

return $salts;
}

/**
Expand Down