/, * inside the WordPress installation. * * Wherever it ends up, the deny files are written, and if the folder sits * anywhere a URL can reach, a probe file is requested over HTTP before every * dump. A probe that comes back, or a check that cannot finish, means no dump * is written: the check fails closed. * * Before 1.1.1 the default could be a folder beside the web root, * /freshet-backups/. That is $legacy: dumps still waiting there * are moved into this folder by adopt(), so the next send picks them up. */ final class Buffer { public const EXTENSION = '.sql.gz'; private const UNREACHABLE = [401, 403, 404, 410]; private const DENY_FILES = [ '.htaccess' => "# Freshet Backup: nothing in this folder is served.\n\n\tRequire all denied\n\n\n\tOrder allow,deny\n\tDeny from all\n\n", 'web.config' => "\n\n\t\n\t\t\n\t\t\t\n\t\t\n\t\n\n", 'index.php' => "name, '/') . '-\d{8}-\d{6}' . preg_quote(self::EXTENSION, '/') . '$/'; } public function newPath(int $time): string { return $this->dir . '/' . $this->name . '-' . gmdate('Ymd-His', $time) . self::EXTENSION; } /** * Make the folder ready for a dump, or say why it is not. * * @return string|null null when a dump may be written; otherwise the reason, for the screen */ public function prepare(?Transport $loopback): ?string { if (!is_dir($this->dir) && !wp_mkdir_p($this->dir)) { return sprintf( /* translators: %s: folder path */ __('No backup was written: the backup folder %s could not be created. Create it yourself and make it writable by the web server, or set FRESHET_BACKUP_DIR in wp-config.php to a folder that is.', 'freshet-backup'), $this->dir ); } if (!wp_is_writable($this->dir)) { return sprintf( /* translators: %s: folder path */ __('No backup was written: the backup folder %s is not writable by the web server. Fix its permissions, or set FRESHET_BACKUP_DIR in wp-config.php to a folder that is.', 'freshet-backup'), $this->dir ); } foreach (self::DENY_FILES as $file => $contents) { if (!is_file($this->dir . '/' . $file) && file_put_contents($this->dir . '/' . $file, $contents) === false) { return sprintf( /* translators: 1: file name, 2: folder path */ __('No backup was written: the file %1$s that keeps %2$s from being downloaded could not be saved there. Fix the folder\'s permissions and try again.', 'freshet-backup'), $file, $this->dir ); } } return $this->url === null ? null : $this->probe($loopback); } /** @return list finished dumps in this folder, oldest first */ public function files(): array { $files = []; foreach ((array) scandir($this->dir) as $entry) { if (is_string($entry) && preg_match($this->filePattern(), $entry)) { $files[] = $this->dir . '/' . $entry; } } sort($files, SORT_STRING); return $files; } /** @return list the files removed, so at most $keep remain */ public function prune(int $keep): array { $files = $this->files(); $gone = array_slice($files, 0, max(0, count($files) - $keep)); foreach ($gone as $file) { wp_delete_file($file); } return $gone; } /** Leftovers from a run that died mid-write. Only called under the run lock. */ public function clearPartials(): void { foreach ((array) glob($this->dir . '/*' . self::EXTENSION . '.part') as $file) { if (is_string($file)) { wp_delete_file($file); } } } /** * The wp-config--.php copies version 1.1.0 kept here before it * changed wp-config.php. They hold the database password, so they go; a * file that does not match that exact name is never touched. Looks in this * folder and the one used before 1.1.1. * * @return list the files removed */ public function clearConfigCopies(): array { $gone = []; foreach (array_filter([is_dir($this->dir) ? $this->dir : null, $this->legacyDir()]) as $dir) { foreach ((array) scandir($dir) as $entry) { if (is_string($entry) && preg_match('/^wp-config-\d{8}-\d{6}\.php$/', $entry)) { wp_delete_file($dir . '/' . $entry); $gone[] = $dir . '/' . $entry; } } } return $gone; } /** * Move the dumps still waiting in the folder used before 1.1.1 into this * one, where the next send finds them. Once nothing of the plugin's is * left there but its deny files, that folder is removed too. Only called * under the run lock, after prepare(). * * @return list dumps that could not be moved and are still there */ public function adopt(): array { $legacy = $this->legacyDir(); if ($legacy === null) { return []; } $left = []; foreach ((array) scandir($legacy) as $entry) { // phpcs:ignore WordPress.WP.AlternativeFunctions.rename_rename -- moves the plugin's own dump between two local folders inside a run, which often runs from WP-Cron where WP_Filesystem may want FTP credentials no one is there to give; its direct method is this same call. if (is_string($entry) && preg_match($this->filePattern(), $entry) && !rename($legacy . '/' . $entry, $this->dir . '/' . $entry)) { $left[] = $legacy . '/' . $entry; } } foreach ((array) glob($legacy . '/*' . self::EXTENSION . '.part') as $file) { if (is_string($file)) { wp_delete_file($file); } } if ($left === []) { self::retire($legacy); } return $left; } /** The folder used before 1.1.1, when it is still there and may be asked about. */ private function legacyDir(): ?string { return $this->legacy !== null && self::allowed($this->legacy) && is_dir($this->legacy) ? $this->legacy : null; } /** Remove an old folder that holds nothing but its own deny files, and its parent once that is empty. */ private static function retire(string $dir): void { $entries = array_diff((array) scandir($dir), ['.', '..']); if (array_diff($entries, array_keys(self::DENY_FILES)) !== []) { return; } foreach ($entries as $file) { wp_delete_file($dir . '/' . $file); } // phpcs:disable WordPress.WP.AlternativeFunctions.file_system_operations_rmdir -- removes the plugin's own emptied folder, from a run that may have no one to give WP_Filesystem FTP credentials; its direct method is this same call. if (!rmdir($dir)) { return; } $parent = dirname($dir); if (basename($parent) === 'freshet-backups' && array_diff((array) scandir($parent), ['.', '..']) === []) { rmdir($parent); } // phpcs:enable WordPress.WP.AlternativeFunctions.file_system_operations_rmdir } private function probe(?Transport $loopback): ?string { if ($loopback === null) { return __('No backup was written: the backup folder is inside the website and the plugin could not check that it is private. Set FRESHET_BACKUP_DIR in wp-config.php to a folder outside the web root.', 'freshet-backup'); } $token = bin2hex(random_bytes(16)); $file = 'probe-' . bin2hex(random_bytes(6)) . self::EXTENSION; if (file_put_contents($this->dir . '/' . $file, $token) === false) { return sprintf( /* translators: %s: folder path */ __('No backup was written: a test file could not be saved in %s. Fix the folder\'s permissions and try again.', 'freshet-backup'), $this->dir ); } try { $response = $loopback->send('GET', $this->url . $file, [], '', 15); } finally { wp_delete_file($this->dir . '/' . $file); } if ($response['status'] === 200 && str_contains($response['body'], $token)) { return sprintf( /* translators: 1: folder URL, 2: folder path */ __('No backup was written: the backup folder can be downloaded from the web (a test file at %1$s came back), so a backup there would be public. Your server ignores the folder\'s .htaccess, which is common on nginx. Set FRESHET_BACKUP_DIR in wp-config.php to a folder outside the web root, or block %2$s in the server configuration.', 'freshet-backup'), $this->url, $this->dir ); } if (in_array($response['status'], self::UNREACHABLE, true) || $response['status'] === 200) { // 200 without the token is a page the server chose to show instead of the file. return null; } return sprintf( /* translators: 1: folder URL, 2: the HTTP status or error */ __('No backup was written: the check that the backup folder is private did not finish (%1$s answered %2$s). If this site cannot load its own pages, set FRESHET_BACKUP_DIR in wp-config.php to a folder outside the web root.', 'freshet-backup'), $this->url, $response['error'] ?? (string) $response['status'] ); } /** * Asking about a path open_basedir forbids writes a warning to the error * log on every request, so ask only about paths it allows. */ private static function allowed(string $path): bool { $allowed = (string) ini_get('open_basedir'); if ($allowed === '') { return true; } foreach (explode(PATH_SEPARATOR, $allowed) as $base) { $base = self::path($base); if ($base !== '' && self::within($path, $base)) { return true; } } return false; } private static function within(string $dir, string $root): bool { $root = rtrim($root, '/'); return $dir === $root || str_starts_with($dir, $root . '/'); } private static function origin(string $url): string { $parts = wp_parse_url($url); $origin = ($parts['scheme'] ?? 'http') . '://' . ($parts['host'] ?? ''); return isset($parts['port']) ? $origin . ':' . $parts['port'] : $origin; } private static function path(string $path): string { return rtrim(str_replace('\\', '/', $path), '/'); } private static function slug(string $host): string { $slug = trim((string) preg_replace('/[^a-z0-9.-]+/', '-', strtolower($host)), '.-'); return $slug === '' ? 'site' : $slug; } }