JPKCom Simple Lang

class-plugin-updater.php

JPKCom Plugin Updater – GitHub Self-Hosted Updates

This class provides a secure, self-hosted update mechanism for WordPress plugins hosted on GitHub. It integrates with the WordPress plugin update system and provides comprehensive security features including:

  • SHA256 checksum verification of downloaded packages (fail closed)
  • URL validation and sanitization of all remote data
  • Race condition prevention for manifest fetching
  • Comprehensive error logging in WP_DEBUG mode
  • Site-transient caching with a ~24-hour TTL (one cache per multisite network)
  • Family updates: one loaded copy serves every installed JPKCom plugin, including inactive ones whose own code never runs

Security Features:

  • All URLs are validated before use; package URLs must be JPKCom release assets
  • All manifest data is sanitized before display
  • Download packages are verified against SHA256 checksum from manifest
  • Failed verifications prevent installation and log errors
  • Package URLs are never persisted in the update transient

Namespace: JPKComSimpleLangGitUpdate PHP Version: 8.3+ WordPress Version: 6.9+ (matches the plugin header)

Tags
since
1.5.0

Family updates: every JPKCom plugin carries this class, the copy with the highest UPDATER_VERSION is elected leader and serves all installed JPKCom plugins (active and inactive); package URLs are stripped before the update transient is stored; the checksum gate verifies a package another filter already supplied instead of trusting it

1.4.0

Manifest cache, failure marker and fetch lock are site transients, so a multisite network fetches the manifest once instead of once per site

1.3.0

Checksum is now mandatory (fail closed) and the verified file is handed to WP_Upgrader instead of being re-downloaded; failed manifest fetches are negatively cached

1.2.0

Added SHA256 checksum verification

1.0.0

Initial release with GitHub integration

Table of Contents

Classes

JPKComGitPluginUpdater
Class JPKComGitPluginUpdater
On this page

Search results