initial commit: updating from https://core.trac.wordpress.org/attachment/ticket/62132/v4.patch

dsmith4-godaddy · dsmith4-godaddy · commit ad0cf4307197 · 2025-10-20T14:02:44.000-05:00
diff --git a/src/wp-admin/admin-ajax.php b/src/wp-admin/admin-ajax.php
@@ -136,6 +136,7 @@
 	'wp-privacy-erase-personal-data',
 	'health-check-site-status-result',
 	'health-check-dotorg-communication',
+	'health-check-alt-update-api-communication',
 	'health-check-is-in-debug-mode',
 	'health-check-background-updates',
 	'health-check-loopback-requests',
diff --git a/src/wp-admin/includes/class-wp-community-events.php b/src/wp-admin/includes/class-wp-community-events.php
@@ -98,7 +98,7 @@ public function get_events( $location_search = '', $timezone = '' ) {
 		// Include an unmodified $wp_version.
 		require ABSPATH . WPINC . '/version.php';
 
-		$api_url                    = 'http://api.wordpress.org/events/1.0/';
+		$api_url                    = WP_UPDATE_API_DEFAULT . '/events/1.0/';
 		$request_args               = $this->get_request_args( $location_search, $timezone );
 		$request_args['user-agent'] = 'WordPress/' . $wp_version . '; ' . home_url( '/' );
 
diff --git a/src/wp-admin/includes/class-wp-debug-data.php b/src/wp-admin/includes/class-wp-debug-data.php
@@ -155,6 +155,7 @@ private static function get_wp_core(): array {
 		$core_version           = wp_get_wp_version();
 		$core_updates           = get_core_updates();
 		$core_update_needed     = '';
+		$update_api_base        = wp_get_update_api_base();
 
 		if ( is_array( $core_updates ) ) {
 			foreach ( $core_updates as $core => $update ) {
@@ -294,6 +295,36 @@ private static function get_wp_core(): array {
 			);
 		}
 
+		$fields['update_api_base'] = array(
+			'label' => 'Update API URL',
+			'value' => $update_api_base,
+			'debug' => true
+		);
+
+		if ( WP_UPDATE_API_DEFAULT !== wp_get_update_api_base()) {
+			$wp_update_api = wp_remote_get( wp_get_update_api_base(), array( 'timeout' => 10 ) );
+
+			if ( ! is_wp_error( $wp_update_api ) ) {
+				$fields['alt_update_api_communication'] = array(
+					'label' => __( 'Communication with update API' ),
+					'value' => __( 'Update API is reachable.' ),
+					'debug' => 'true',
+				);
+			} else {
+				$fields['alt_update_api_communication'] = array(
+					'label' => __( 'Communication with update API' ),
+					'value' => sprintf(
+						/* Translators: 1: hostname of update API, 2: IP address the update API hostname resolves to. 3: The error returned by the lookup */
+						__('Unable to reach %1$s (%2$s): %3$s' ),
+						parse_url( $update_api_base, PHP_URL_HOST ),
+						gethostbyname( parse_url( $update_api_base, PHP_URL_HOST ) ),
+						$wp_update_api->get_error_message(),
+					),
+					'debug' => $wp_update_api->get_error_message(),
+				);
+			}
+		}
+
 		return array(
 			'label'  => __( 'WordPress' ),
 			'fields' => $fields,
diff --git a/src/wp-admin/includes/class-wp-site-health.php b/src/wp-admin/includes/class-wp-site-health.php
@@ -1307,7 +1307,7 @@ public function get_test_dotorg_communication() {
 		);
 
 		$wp_dotorg = wp_remote_get(
-			'https://api.wordpress.org',
+			WP_UPDATE_API_DEFAULT,
 			array(
 				'timeout' => 10,
 			)
@@ -1328,7 +1328,7 @@ public function get_test_dotorg_communication() {
 					sprintf(
 						/* translators: 1: The IP address WordPress.org resolves to. 2: The error returned by the lookup. */
 						__( 'Your site is unable to reach WordPress.org at %1$s, and returned the error: %2$s' ),
-						gethostbyname( 'api.wordpress.org' ),
+						gethostbyname( parse_url( WP_UPDATE_API_DEFAULT, PHP_URL_HOST ) ),
 						$wp_dotorg->get_error_message()
 					)
 				)
@@ -1347,6 +1347,68 @@ public function get_test_dotorg_communication() {
 		return $result;
 	}
 
+	/**
+	 * Tests if the site can communicate with a non-default update API endpoint.
+	 *
+	 * @since 6.9.0
+	 *
+	 * @return array The test results.
+	 */
+	public function get_test_alt_update_api_communication() {
+		$result = array(
+			'label'       => __( 'Can communicate with update API' ),
+			'status'      => '',
+			'badge'       => array(
+				'label' => __( 'Security' ),
+				'color' => 'blue',
+			),
+			'description' => sprintf(
+				'<p>%s</p>',
+				__( 'Communicating with the update API is used to check for new versions, and to both install and update WordPress core, themes or plugins.' )
+			),
+			'actions'     => '',
+			'test'        => 'alt_update_api_communication',
+		);
+
+		$wp_update_api = wp_remote_get(
+			wp_get_update_api_base(),
+			array(
+				'timeout' => 10,
+			)
+		);
+		if ( ! is_wp_error( $wp_update_api ) ) {
+			$result['status'] = 'good';
+		} else {
+			$result['status'] = 'critical';
+
+			$result['label'] = __( 'Could not reach update API' );
+
+			$result['description'] .= sprintf(
+				'<p>%s</p>',
+				sprintf(
+					'<span class="error"><span class="screen-reader-text">%s</span></span> %s',
+					/* translators: Hidden accessibility text. */
+					__( 'Error' ),
+					sprintf(
+						/* translators: 1: update API URL. 2: The IP address the update API endpoint resolves to. 3: The error returned by the lookup. */
+						__( 'Your site is unable to reach the specified update API endpoint (%s) at %s, and returned the error: %s' ),
+						wp_get_update_api_base(),
+						gethostbyname( parse_url( wp_get_update_api_base(), PHP_URL_HOST ) ),
+						$wp_update_api->get_error_message()
+					)
+				)
+			);
+
+			$result['actions'] = sprintf(
+				/* translators: URL of update API */
+				__('Contact the owners of %s for support.'),
+				wp_get_update_api_base()
+			);
+		}
+
+		return $result;
+	}
+
 	/**
 	 * Tests if debug information is enabled.
 	 *
@@ -2814,6 +2876,10 @@ public static function get_tests() {
 					'label' => __( 'Available disk space' ),
 					'test'  => 'available_updates_disk_space',
 				),
+				'update_api_info' => array(
+					'label' => __( 'Update API Info' ),
+					'test'  => 'update_api_info',
+				),
 				'autoloaded_options'           => array(
 					'label' => __( 'Autoloaded options' ),
 					'test'  => 'autoloaded_options',
@@ -2862,6 +2928,16 @@ public static function get_tests() {
 			);
 		}
 
+		// Only check alternate update API endpoint if one has been configured.
+		if ( WP_UPDATE_API_DEFAULT !== wp_get_update_api_base() ) {
+			$tests['async']['alt_update_api_communication'] = array(
+				'label'             => __( 'Communication with update API' ),
+				'test'              => rest_url( 'wp-site-health/v1/tests/alt-update-api-communication' ),
+				'has_rest'          => true,
+				'async_direct_test' => array( WP_Site_Health::get_instance(), 'get_test_alt_update_api_communication' ),
+			);
+		}
+
 		// Only check for caches in production environments.
 		if ( 'production' === wp_get_environment_type() ) {
 			$tests['async']['page_cache'] = array(
diff --git a/src/wp-admin/includes/credits.php b/src/wp-admin/includes/credits.php
@@ -32,7 +32,7 @@ function wp_credits( $version = '', $locale = '' ) {
 		|| str_contains( $version, '-' )
 		|| ( isset( $results['data']['version'] ) && ! str_starts_with( $version, $results['data']['version'] ) )
 	) {
-		$url     = "http://api.wordpress.org/core/credits/1.1/?version={$version}&locale={$locale}";
+		$url     = WP_UPDATE_API_DEFAULT . "/core/credits/1.1/?version={$version}&locale={$locale}";
 		$options = array( 'user-agent' => 'WordPress/' . $version . '; ' . home_url( '/' ) );
 
 		if ( wp_http_supports( array( 'ssl' ) ) ) {
diff --git a/src/wp-admin/includes/dashboard.php b/src/wp-admin/includes/dashboard.php
@@ -1814,7 +1814,7 @@ function wp_check_browser_version() {
 	$response = get_site_transient( 'browser_' . $key );
 
 	if ( false === $response ) {
-		$url     = 'http://api.wordpress.org/core/browse-happy/1.1/';
+		$url     = wp_get_update_api_base( $https = false ) . '/core/browse-happy/1.1/';
 		$options = array(
 			'body'       => array( 'useragent' => $_SERVER['HTTP_USER_AGENT'] ),
 			'user-agent' => 'WordPress/' . wp_get_wp_version() . '; ' . home_url( '/' ),
diff --git a/src/wp-admin/includes/import.php b/src/wp-admin/includes/import.php
@@ -146,7 +146,7 @@ function wp_get_popular_importers() {
 				'locale'  => $locale,
 				'version' => wp_get_wp_version(),
 			),
-			'http://api.wordpress.org/core/importers/1.1/'
+			wp_get_update_api_base( $https = false ) . '/core/importers/1.1/'
 		);
 		$options = array( 'user-agent' => 'WordPress/' . wp_get_wp_version() . '; ' . home_url( '/' ) );
 
diff --git a/src/wp-admin/includes/misc.php b/src/wp-admin/includes/misc.php
@@ -1579,7 +1579,7 @@ function wp_check_php_version() {
 	$response = get_site_transient( 'php_check_' . $key );
 
 	if ( false === $response ) {
-		$url = 'http://api.wordpress.org/core/serve-happy/1.0/';
+		$url = wp_get_update_api_base( $https = false ) . '/core/serve-happy/1.0/';
 
 		if ( wp_http_supports( array( 'ssl' ) ) ) {
 			$url = set_url_scheme( $url, 'https' );
diff --git a/src/wp-admin/includes/network.php b/src/wp-admin/includes/network.php
@@ -554,7 +554,7 @@ function network_step2( $errors = false ) {
 
 		if ( ! empty( $keys_salts ) ) {
 			$keys_salts_str = '';
-			$from_api       = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' );
+			$from_api       = wp_remote_get( wp_get_update_api_base() . '/secret-key/1.1/salt/' );
 			if ( is_wp_error( $from_api ) ) {
 				foreach ( $keys_salts as $c => $v ) {
 					$keys_salts_str .= "\ndefine( '$c', '" . wp_generate_password( 64, true, true ) . "' );";
diff --git a/src/wp-admin/includes/plugin-install.php b/src/wp-admin/includes/plugin-install.php
@@ -146,7 +146,7 @@ function plugins_api( $action, $args = array() ) {
 
 	if ( false === $res ) {
 
-		$url = 'http://api.wordpress.org/plugins/info/1.2/';
+		$url = wp_get_update_api_base( $https = false ) . '/plugins/info/1.2/';
 		$url = add_query_arg(
 			array(
 				'action'  => $action,
diff --git a/src/wp-admin/includes/theme.php b/src/wp-admin/includes/theme.php
@@ -542,7 +542,7 @@ function themes_api( $action, $args = array() ) {
 	$res = apply_filters( 'themes_api', false, $action, $args );
 
 	if ( ! $res ) {
-		$url = 'http://api.wordpress.org/themes/info/1.2/';
+		$url = wp_get_update_api_base( $https = false ) . '/themes/info/1.2/';
 		$url = add_query_arg(
 			array(
 				'action'  => $action,
diff --git a/src/wp-admin/includes/translation-install.php b/src/wp-admin/includes/translation-install.php
@@ -50,7 +50,7 @@ function translations_api( $type, $args = null ) {
 	$res = apply_filters( 'translations_api', false, $type, $args );
 
 	if ( false === $res ) {
-		$url      = 'http://api.wordpress.org/translations/' . $type . '/1.0/';
+		$url      = wp_get_update_api_base( $https = false ) . '/translations/' . $type . '/1.0/';
 		$http_url = $url;
 		$ssl      = wp_http_supports( array( 'ssl' ) );
 		if ( $ssl ) {
diff --git a/src/wp-admin/includes/update.php b/src/wp-admin/includes/update.php
@@ -129,7 +129,7 @@ function find_core_auto_update() {
  * @return array|false An array of checksums on success, false on failure.
  */
 function get_core_checksums( $version, $locale ) {
-	$http_url = 'http://api.wordpress.org/core/checksums/1.0/?' . http_build_query( compact( 'version', 'locale' ), '', '&' );
+	$http_url = wp_get_update_api_base( $https = false ) . '/core/checksums/1.0/?' . http_build_query( compact( 'version', 'locale' ), '', '&' );
 	$url      = $http_url;
 
 	$ssl = wp_http_supports( array( 'ssl' ) );
@@ -1125,3 +1125,39 @@ function wp_get_auto_update_message() {
 
 	return $message;
 }
+
+/**
+ * Returns the base URL in use for the wordpress.org API. Defaults to http://api.wordpress.org .
+ * 
+ * This URL can be overridden by specifying an environment variable `WP_UPDATE_API_BASE` or
+ * by using the {@see wp_update_api_base} filter. Providing an empty URL is not allowed and
+ * will result in the default being used.
+ * 
+ * @since 6.8.0
+ * 
+ * @param bool $https Whether requests should use https instead of http, defaults to true.
+ * @return string The base URL in use for the wordpress.org update API.
+ */
+function wp_get_update_api_base( $https = true ) {
+	$api_base = WP_UPDATE_API_DEFAULT;
+
+	if ( false !== getenv('WP_UPDATE_API_BASE') ) {
+		$api_base = getenv('WP_UPDATE_API_BASE');
+	}
+
+	/**
+	 * Filters the base URL used for wordpress.org API requests.
+	 *
+	 * @since 6.8.0
+	 *
+	 * @param string $content Default text.
+	 */
+	$api_base = apply_filters( 'wp_update_api_base', $api_base );
+
+	// required for back-compat as many old api references in core use http:// explicitly
+	if ( (! $https) && (substr($api_base, 0, 7) == 'http://') && ($api_base === WP_UPDATE_API_DEFAULT)) {
+		$api_base = str_replace( $api_base, 'http://', 'https://' );
+	}
+
+	return $api_base;
+}
diff --git a/src/wp-admin/setup-config.php b/src/wp-admin/setup-config.php
@@ -358,7 +358,7 @@ function setup_config_display_header( $body_classes = array() ) {
 			$no_api = isset( $_POST['noapi'] );
 
 			if ( ! $no_api ) {
-				$secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' );
+				$secret_keys = wp_remote_get( wp_get_update_api_base() . '/secret-key/1.1/salt/' );
 			}
 
 			if ( $no_api || is_wp_error( $secret_keys ) ) {
diff --git a/src/wp-includes/class-wp-http.php b/src/wp-includes/class-wp-http.php
@@ -875,7 +875,8 @@ public static function chunkTransferDecode( $body ) { // phpcs:ignore WordPress.
 	 * Determines whether an HTTP API request to the given URL should be blocked.
 	 *
 	 * Those who are behind a proxy and want to prevent access to certain hosts may do so. This will
-	 * prevent plugins from working and core functionality, if you don't include `api.wordpress.org`.
+	 * prevent plugins from working and core functionality, if you don't include `api.wordpress.org`
+	 * (or your alternate API host, if configured).
 	 *
 	 * You block external URL requests by defining `WP_HTTP_BLOCK_EXTERNAL` as true in your `wp-config.php`
 	 * file and this will only allow localhost and your site to make requests. The constant
diff --git a/src/wp-includes/default-constants.php b/src/wp-includes/default-constants.php
@@ -142,6 +142,9 @@ function wp_initial_constants() {
 	// Constants for features added to WP that should short-circuit their plugin implementations.
 	define( 'WP_FEATURE_BETTER_PASSWORDS', true );
 
+	// Defines the default URL base for many update-related functions
+	define( 'WP_UPDATE_API_DEFAULT', 'http://api.wordpress.org' );
+
 	/**#@+
 	 * Constants for expressing human-readable intervals
 	 * in their respective number of seconds.
diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-pattern-directory-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-pattern-directory-controller.php
@@ -114,7 +114,7 @@ public function get_items( $request ) {
 		$raw_patterns = get_site_transient( $transient_key );
 
 		if ( ! $raw_patterns ) {
-			$api_url = 'http://api.wordpress.org/patterns/1.0/?' . build_query( $query_args );
+			$api_url = wp_get_update_api_base( $https = false ) . '/patterns/1.0/?' . build_query( $query_args );
 			if ( wp_http_supports( array( 'ssl' ) ) ) {
 				$api_url = set_url_scheme( $api_url, 'https' );
 			}
diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-site-health-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-site-health-controller.php
@@ -124,6 +124,25 @@ public function register_routes() {
 			)
 		);
 
+		register_rest_route(
+			$this->namespace,
+			sprintf(
+				'/%s/%s',
+				$this->rest_base,
+				'alt-update-api-communication'
+			),
+			array(
+				array(
+					'methods'             => 'GET',
+					'callback'            => array( $this, 'test_alt_update_api_communication' ),
+					'permission_callback' => function() {
+						return $this->validate_request_permission( 'alt_update_api_communication' );
+					},
+				),
+				'schema' => array( $this, 'get_public_item_schema' ),
+			)
+		);
+
 		register_rest_route(
 			$this->namespace,
 			sprintf(
@@ -225,6 +244,18 @@ public function test_dotorg_communication() {
 		return $this->site_health->get_test_dotorg_communication();
 	}
 
+	/**
+	 * Checks that the site can reach an alternate update API.
+	 *
+	 * @since 6.9.0
+	 *
+	 * @return array
+	 */
+	public function test_alt_update_api_communication() {
+		$this->load_admin_textdomain();
+		return $this->site_health->get_test_alt_update_api_communication();
+	}
+
 	/**
 	 * Checks that loopbacks can be performed.
 	 *
diff --git a/src/wp-includes/update.php b/src/wp-includes/update.php
