JezK

Edit File: WPInstall.php

<?php

/** *********************************************
 * LiteSpeed Web Server Cache Manager
 *
 * @author LiteSpeed Technologies, Inc. (https://www.litespeedtech.com)
 * @copyright (c) 2018-2026
 * *******************************************
 */

namespace Lsc\Wp;

use Lsc\Wp\Panel\ControlPanel;
use Lsc\Wp\Panel\PhpBinaryParts;
use Lsc\Wp\Context\Context;

class WPInstall
{

/**
     * @var int
     */
    const ST_PLUGIN_ACTIVE = 1;

/**
     * @var int
     */
    const ST_PLUGIN_INACTIVE = 2;

/**
     * @var int
     */
    const ST_LSC_ADVCACHE_DEFINED = 4;

/**
     * @var int
     */
    const ST_FLAGGED = 8;

/**
     * @var int
     */
    const ST_ERR_SITEURL = 16;

/**
     * @var int
     */
    const ST_ERR_DOCROOT = 32;

/**
     * @var int
     */
    const ST_ERR_EXECMD = 64;

/**
     * @var int
     */
    const ST_ERR_TIMEOUT = 128;

/**
     * @var int
     */
    const ST_ERR_EXECMD_DB = 256;

/**
     * @var int
     */
    const ST_ERR_WPCONFIG = 1024;

/**
     * @var int
     */
    const ST_ERR_REMOVE = 2048;

/**
     * @var string
     */
    const FLD_STATUS = 'status';

/**
     * @var string
     */
    const FLD_DOCROOT = 'docroot';

/**
     * @var string
     */
    const FLD_SERVERNAME = 'server_name';

/**
     * @var string
     */
    const FLD_SITEURL = 'site_url';

/**
     * @since 1.17.10  V9.1 — expected-owner uid persisted so
     *     Layer 2 (owner equality check) survives data-file serialization and
     *     fires on data-file-loaded installs in the root-context flag path.
     *
     * @var string
     */
    const FLD_EXPECTED_OWNER_UID = 'expected_owner_uid';

/**
     * @since 1.17.10  V9.1 — expected-owner gid persisted.
     *
     * @var string
     */
    const FLD_EXPECTED_OWNER_GID = 'expected_owner_gid';

/**
     * @var string
     */
    const FLAG_FILE = '.litespeed_flag';

/**
     * @var string
     */
    const FLAG_NEW_LSCWP = '.lscm_new_lscwp';

/**
     * @var string
     */
    protected $path;

/**
     * @var array
     */
    protected $data;

/**
     * @since 1.17.10
     * @var PhpBinaryParts|null
     */
    protected $phpBinaryParts = null;

/**
     * @deprecated since 1.17.10  Use $phpBinaryParts instead.
     *
     * @var null|string
     */
    protected $phpBinary = null;

/**
     * @var null|string
     */
    protected $suCmd = null;

/**
     * @var null|array  Keys are 'user_id', 'user_name', 'group_id'
     */
    protected $ownerInfo = null;

/**
     * @var bool
     */
    protected $changed = false;

/**
     * @var bool
     */
    protected $refreshed = false;

/**
     * @var null|string
     */
    protected $wpConfigFile = '';

/**
     * @var int
     */
    protected $cmdStatus = 0;

/**
     * @var string
     */
    protected $cmdMsg = '';

/**
     * @since 1.17.10  V9 expected-owner binding (cross-tenant
     *     TOCTOU defence). Captured from realpath(docroot) ownership at scan
     *     time; null when the install was not created via a scan operation.
     *
     * @var int|null
     */
    protected $expectedOwnerUid = null;

/**
     * @since 1.17.10  V9 expected-owner binding.
     *
     * @var int|null
     */
    protected $expectedOwnerGid = null;

/**
     *
     * @param string $path
     */
    public function __construct( $path )
    {
        $this->init($path);
    }

/**
     *
     * @param string $path
     */
    protected function init( $path )
    {
        if ( ($realPath = realpath($path)) === false ) {
            $this->path = $path;
        }
        else {
            $this->path = $realPath;
        }

$this->data = array(
            self::FLD_STATUS             => 0,
            self::FLD_DOCROOT            => null,
            self::FLD_SERVERNAME         => null,
            self::FLD_SITEURL            => null,
            self::FLD_EXPECTED_OWNER_UID => null,
            self::FLD_EXPECTED_OWNER_GID => null,
        );
    }

/**
     *
     * @return string
     */
    public function __toString()
    {
        if ( $this->data[self::FLD_SITEURL] ) {
            $siteUrl = Util::tryIdnToUtf8($this->data[self::FLD_SITEURL]);
        }
        else {
            $siteUrl = '';
        }

return sprintf(
            "%s (status=%d docroot=%s siteurl=%s)",
            $this->path,
            $this->data[self::FLD_STATUS],
            $this->data[self::FLD_DOCROOT],
            $siteUrl
        );
    }

/**
     *
     * @return string|null
     */
    public function getDocRoot()
    {
        return $this->getData(self::FLD_DOCROOT);
    }

/**
     *
     * @param string $docRoot
     *
     * @return bool
     */
    public function setDocRoot( $docRoot )
    {
        return $this->setData(self::FLD_DOCROOT, $docRoot);
    }

/**
     *
     * @return string|null
     */
    public function getServerName()
    {
        return $this->getData(self::FLD_SERVERNAME);
    }

/**
     *
     * @param string $serverName
     *
     * @return bool
     */
    public function setServerName( $serverName )
    {
        return $this->setData(
            self::FLD_SERVERNAME,
            Util::tryIdnToAscii((string)$serverName)
        );
    }

/**
     * Note: Temporary function name until existing deprecated setSiteUrl()
     * function is removed.
     *
     * @param string $siteUrl
     *
     * @return bool
     */
    public function setSiteUrlDirect( $siteUrl )
    {
        return $this->setData(
            self::FLD_SITEURL,
            Util::tryIdnToAscii((string)$siteUrl)
        );
    }

/**
     *
     * @param int $status
     *
     * @return bool
     */
    public function setStatus( $status )
    {
        return $this->setData(self::FLD_STATUS, $status);
    }

/**
     *
     * @return int
     */
    public function getStatus()
    {
        return $this->getData(self::FLD_STATUS);
    }

/**
     *
     * @param string $field
     *
     * @return mixed|null
     */
    public function getData( $field = '' )
    {
        if ( !$field ) {
            return $this->data;
        }

if ( isset($this->data[$field]) ) {
            return $this->data[$field];
        }

/**
         * Error out
         */
        return null;
    }

/**
     *
     * @param string $field
     * @param mixed  $value
     *
     * @return bool
     */
    protected function setData( $field, $value )
    {
        if ( $this->data[$field] !== $value ) {
            $this->changed = true;
            $this->data[$field] = $value;

return true;
        }

return false;
    }

/**
     * Calling from unserialized data.
     *
     * @since 1.17.10  V9.1 — hydrate expectedOwnerUid/Gid from
     *     FLD_EXPECTED_OWNER_UID/GID when present so Layer 2 (expected-owner
     *     equality check) fires on data-file-loaded installs in the
     *     root-context flag path.
     *
     * @param array $data
     */
    public function initData( array $data )
    {
        /**
         * V9.2 — initialize expected-owner keys that may be absent from
         * pre-V9.1 data-file records. setData() assumes every key in $field
         * exists in $this->data; without this guard, calling setExpectedOwner()
         * on a legacy-loaded install would trigger an undefined-index notice.
         */
        if ( !array_key_exists(self::FLD_EXPECTED_OWNER_UID, $data) ) {
            $data[self::FLD_EXPECTED_OWNER_UID] = null;
        }

if ( !array_key_exists(self::FLD_EXPECTED_OWNER_GID, $data) ) {
            $data[self::FLD_EXPECTED_OWNER_GID] = null;
        }

$this->data = $data;

if ( isset($data[self::FLD_EXPECTED_OWNER_UID]) ) {
            $this->expectedOwnerUid = (int) $data[self::FLD_EXPECTED_OWNER_UID];
        }

if ( isset($data[self::FLD_EXPECTED_OWNER_GID]) ) {
            $this->expectedOwnerGid = (int) $data[self::FLD_EXPECTED_OWNER_GID];
        }
    }

/**
     *
     * @return string
     */
    public function getPath()
    {
        return $this->path;
    }

/**
     * Bind the cPanel-assigned tenant uid/gid of the docroot ancestor that
     * canonically contained $this->path at scan time.  Used by
     * addUserFlagFile() (root context) to fail-closed on cross-tenant
     * intermediate-directory symlink swaps: if the install-directory owner
     * at write time does not match the panel-assigned docroot owner captured
     * here, the privilege drop is refused.
     *
     * Called by WPInstallStorage::scan() after construction.  The binding is
     * persisted via FLD_EXPECTED_OWNER_UID / FLD_EXPECTED_OWNER_GID so it
     * survives data-file serialization; initData() hydrates the in-memory
     * properties when the install is reloaded, making Layer 2 effective on
     * the data-file-loaded root-context flag path.
     *
     * Paths that were never run through scan() (bare new WPInstall() in
     * doWPInstallAction(), and the scan2/addNewWPInstall() path that loses
     * docroot context) still carry null and remain Layer-1/Layer-3 reliant.
     *
     * @since 1.17.10
     * @since 1.17.10  V9.1 — now persisted via $data fields.
     *
     * @param int $uid  lstat() uid of realpath(docroot).
     * @param int $gid  lstat() gid of realpath(docroot).
     */
    public function setExpectedOwner( $uid, $gid )
    {
        $this->expectedOwnerUid = (int) $uid;
        $this->expectedOwnerGid = (int) $gid;
        $this->setData(self::FLD_EXPECTED_OWNER_UID, (int) $uid);
        $this->setData(self::FLD_EXPECTED_OWNER_GID, (int) $gid);
    }

/**
     *
     * @return bool
     */
    public function shouldRemove()
    {
        return (bool)(($this->getStatus() & self::ST_ERR_REMOVE));
    }

/**
     *
     * @return bool
     */
    public function hasFlagFile()
    {
        return file_exists("$this->path/" . self::FLAG_FILE);
    }

/**
     *
     * @return bool
     */
    public function hasNewLscwpFlagFile()
    {
        return file_exists("$this->path/" . self::FLAG_NEW_LSCWP);
    }

/**
     *
     * @return bool
     *
     * @throws LSCMException  Thrown indirectly by Logger::uiError() call.
     * @throws LSCMException  Thrown indirectly by Logger::notice() call.
     * @throws LSCMException  Thrown indirectly by $this->addUserFlagFile()
     *     call.
     * @throws LSCMException  Thrown indirectly by Logger::uiError() call.
     * @throws LSCMException  Thrown indirectly by Logger::error() call.
     */
    public function hasValidPath()
    {
        if ( !is_dir($this->path) || !is_dir("$this->path/wp-admin") ) {
            $this->setStatusBit(self::ST_ERR_REMOVE);

$msg = "$this->path - Could not be found and has been removed from "
                . 'Cache Manager list.';
            Logger::uiError($msg);
            Logger::notice($msg);

return false;
        }

if ( $this->getWpConfigFile() == null ) {
            $this->setStatusBit(self::ST_ERR_WPCONFIG);
            $this->addUserFlagFile(false);

$msg = "$this->path - Could not find a valid wp-config.php file. "
                . 'Install has been flagged.';
            Logger::uiError($msg);
            Logger::error($msg);

return false;
        }

return true;
    }

/**
     * Set the provided status bit.
     *
     * @param int $bit
     */
    public function setStatusBit( $bit )
    {
        $this->setStatus(($this->getStatus() | $bit));
    }

/**
     * Unset the provided status bit.
     *
     * @param int $bit
     */
    public function unsetStatusBit( $bit )
    {
        $this->setStatus(($this->getStatus() & ~$bit ));
    }

/**
     *
     * @deprecated 1.9.5  Deprecated to avoid confusion with $this->cmdStatus
     *     and $this->cmdMsg related functions. Use $this->setStatus() instead.
     *
     * @param int $newStatus
     */
    public function updateCommandStatus( $newStatus )
    {
        $this->setData(self::FLD_STATUS, $newStatus);
    }

/**
     *
     * @return null|string
     */
    public function getWpConfigFile()
    {
        if ( $this->wpConfigFile === '' ) {
            $file = "$this->path/wp-config.php";

if ( !file_exists($file) ) {
                /**
                 *  check parent dir
                 */
                $parentDir = dirname($this->path);
                $file = "$parentDir/wp-config.php";

if ( !file_exists($file)
                        || file_exists("$parentDir/wp-settings.php") ) {

/**
                     * If wp-config moved up, in same dir should NOT have
                     * wp-settings
                     */
                    $file = null;
                }
            }

$this->wpConfigFile = $file;
        }

return $this->wpConfigFile;
    }

/**
     * Takes a WordPress site URL and uses it to populate serverName, siteUrl,
     * and docRoot data. If a matching docRoot cannot be found using the
     * serverName, the installation will be flagged and an ST_ERR_DOCROOT status
     * set.
     *
     * @param string $url
     *
     * @return bool
     *
     * @throws LSCMException  Thrown indirectly by
     *     ControlPanel::getClassInstance() call.
     * @throws LSCMException  Thrown indirectly by
     *     ControlPanel::getClassInstance()->mapDocRoot() call.
     * @throws LSCMException  Thrown indirectly by $this->addUserFlagFile()
     *     call.
     * @throws LSCMException  Thrown indirectly by Logger::error() call.
     */
    public function populateDataFromUrl( $url )
    {
        /** @noinspection HttpUrlsUsage */
        $parseSafeUrl =
            (preg_match('#^https?://#', $url)) ? $url : "http://$url";

$info = parse_url($parseSafeUrl);

$serverName = isset($info['host'])
            ? Util::tryIdnToAscii($info['host'])
            : null;

$this->setData(self::FLD_SERVERNAME, $serverName);

$siteUrlTrim = $serverName;

if ( isset($info['path']) ) {
            $siteUrlTrim .= $info['path'];
        }

$this->setData(self::FLD_SITEURL, $siteUrlTrim);

$docRoot = ControlPanel::getClassInstance()->mapDocRoot($serverName);
        $this->setData(self::FLD_DOCROOT, $docRoot);

if ( $docRoot === null ) {
            $this->setStatus(self::ST_ERR_DOCROOT);
            $this->addUserFlagFile(false);

$msg = "$this->path - Could not find matching document root for "
                . "WP siteurl/servername $serverName.";

$this->setCmdStatusAndMsg(UserCommand::EXIT_ERROR, $msg);
            Logger::error($msg);
            return false;
        }

return true;
    }

/**
     * Deprecated 06/18/19. Renamed to populateDataFromUrl().
     *
     * @deprecated
     *
     * @param string $siteUrl
     *
     * @return bool
     *
     * @throws LSCMException  Thrown indirectly by $this->populateDataFromUrl()
     *     call.
     */
    public function setSiteUrl( $siteUrl )
    {
        return $this->populateDataFromUrl($siteUrl);
    }

/**
     * Adds the flag file to an installation.
     *
     * The flag file lives inside an installation directory that is owned and
     * writable by an untrusted account, yet this method may run as root (when
     * $runningAsUser is false). It is therefore hardened against symlink/TOCTOU
     * attacks (CWE-59 / CWE-367):
     *
     *   When called as root ($runningAsUser === false):
     *     Both the unlink and the fopen('xb') are performed after dropping
     *     effective credentials to the install owner via dropPrivileges() (V8).
     *     Writing as the filesystem owner of the directory closes the
     *     intermediate-component TOCTOU: if a parent directory is swapped for a
     *     symlink pointing at a root-owned location after the initial realpath(),
     *     the tenant-credential write fails with EACCES because the tenant has
     *     no write permission there. O_CREAT|O_EXCL ('xb') additionally protects
     *     the final component. No lchown()/lchgrp() is required because the file
     *     is created directly as the install owner.
     *
     *     The uid/gid to drop to are read via lstat() (no final-symlink
     *     following) so a tenant who replaces $this->path with a symlink
     *     pointing at another tenant's directory gets that link's inode uid/gid,
     *     not the target's uid/gid (cross-tenant impersonation).  Additionally,
     *     if lstat reveals the install path is now a symlink, execution fails
     *     closed before any privilege manipulation.
     *
     *   When called as the install owner ($runningAsUser === true):
     *     Following an owner-planted symlink crosses no trust boundary (root is
     *     not involved), so no privilege manipulation is needed.
     *
     * @since 1.17.10 — root-context path drops to install-owner
     *     credentials (replaces path-based lchown/lchgrp, closes
     *     intermediate-component TOCTOU that O_EXCL alone cannot address);
     *     uid/gid read via lstat() to prevent cross-tenant impersonation via
     *     a final-component symlink swap.
     *
     * @param bool $runningAsUser
     *
     * @return bool  True when the flag file was created or already present;
     *     false when the write failed or was refused (including Layer 2
     *     expected-owner mismatch, which logs and returns false without
     *     aborting the batch).
     *
     * @throws LSCMException  Thrown when unlink() call on preexisting flag file
     *     fails.
     * @throws LSCMException  Thrown when posix extension is unavailable in root
     *     context (fail-closed; no acceptable fallback exists).
     * @throws LSCMException  Thrown when any component of the install path is
     *     a symlink (fail-closed; cross-tenant TOCTOU attack detected).
     * @throws LSCMException  Thrown when the install path is no longer
     *     accessible (fail-closed; possible TOCTOU attack).
     * @throws LSCMException  Thrown when the install path has been replaced by
     *     a symlink since the scan snapshot (fail-closed; TOCTOU attack
     *     detected).
     * @throws LSCMException  Thrown when the install path no longer
     *     canonicalises to the same value as the scan-time snapshot
     *     (fail-closed; TOCTOU attack detected).
     * @throws LSCMException  Thrown when the install directory is owned by root
     *     (fail-closed; privilege drop to root is not a privilege drop).
     * @throws LSCMException  Thrown indirectly by
     *     $this->restorePrivileges() call when credential restore fails
     *     (process state is undefined; thrown from the finally block).
     * @throws LSCMException  Thrown indirectly by Context::getFlagFileContent()
     *     call.
     */
    public function addUserFlagFile( $runningAsUser = true )
    {
        $flagFile = "$this->path/" . self::FLAG_FILE;

if ( !$runningAsUser ) {
            /**
             * V8 — root context: drop to install-owner credentials for both the
             * unlink and the create so that intermediate-directory symlink swaps
             * redirecting the path off-tree fail with EACCES rather than
             * succeeding silently.  O_CREAT|O_EXCL ('xb') still guards the final
             * component.  Privileges are restored in the finally block so an
             * exception cannot leave the process running as the tenant.
             *
             * V9 — three additional layers close the residual cross-tenant
             * intermediate-component swap gap:
             *   1. assertNoSymlinkComponents(): per-component lstat() walk that
             *      refuses at the first symlink found in any directory component
             *      of $this->path, closing the gap before any uid/gid read.
             *   2. realpath() re-verification: $this->path was set to the
             *      canonical value at construct time; we re-canonicalise and
             *      require equality.  An intermediate swap that changes the
             *      canonical resolution is caught here even if Layer 1 misses it.
             *   3. Expected-owner check: the uid/gid reported by lstat() at
             *      write time is compared against the panel-assigned docroot
             *      owner captured at scan time.  A swap that redirects the path
             *      to another tenant's tree produces a mismatched uid even if
             *      Layers 1 and 2 fail to fire.
             *
             * V9.8 — validation logic extracted into resolveValidatedFlagOwnerUidGid()
             *      so that the identical trust-boundary checks are shared with the
             *      root-context removeFlagFile(false) path and cannot drift.
             */
            $owner = $this->resolveValidatedFlagOwnerUidGid('flag-file write');

if ( $owner === false ) {
                return false;
            }

list($uid, $gid) = $owner;

$origEuid = posix_geteuid();
            $origEgid = posix_getegid();

try {
                $this->dropPrivileges($uid, $gid);

if ( !$this->writeFlagFileExclusive($flagFile) ) {
                    return false;
                }
            }
            finally {
                $this->restorePrivileges($origEuid, $origEgid);
            }
        }
        else {
            /**
             * Running as the install owner — no privilege boundary to enforce.
             */
            if ( !$this->writeFlagFileExclusive($flagFile) ) {
                return false;
            }
        }

$this->setStatusBit(self::ST_FLAGGED);
        return true;
    }

/**
     * Shared root-context path and owner validation for flag-file mutation.
     *
     * Performs, in order:
     *   1. POSIX availability check.
     *   2. Per-component lstat() walk (V9 Layer 1).
     *   3. Final lstat($this->path) with inaccessibility and symlink checks.
     *   4. realpath() re-verification (V9 Layer 3).
     *   5. Expected-owner comparison when bound (V9 Layer 2).
     *   6. Root-owner refusal.
     *
     * Three-way return contract (intentional — do not collapse into two):
     *   - Hard failure (symlink component, inaccessible path, canonical drift,
     *     root owner, posix unavailable) → throw LSCMException.  The caller
     *     must not catch and continue; the operation is aborted.
     *   - Expected-owner mismatch (V9 Layer 2) → return false.  The mismatch
     *     is already logged via Logger::error() here so the caller just
     *     propagates false without re-logging.  This is a per-install soft
     *     failure so a batch can continue to the next install.  Do NOT turn
     *     this into a throw without auditing every batch call site.
     *   - Success → return array($uid, $gid) for caller to pass to
     *     dropPrivileges().
     *
     * @since 1.17.10
     *
     * @param string $context  Human-readable label (e.g. 'flag-file write')
     *     used in exception and log messages.
     *
     * @return array|false  array($uid, $gid) on success; false on expected-
     *     owner mismatch (already logged).
     *
     * @throws LSCMException  When posix functions are unavailable.
     * @throws LSCMException  When any path component is a symlink.
     * @throws LSCMException  When the install path is inaccessible.
     * @throws LSCMException  When the install path is a symlink.
     * @throws LSCMException  When realpath() diverges from the stored path.
     * @throws LSCMException  When the install directory is root-owned.
     */
    private function resolveValidatedFlagOwnerUidGid( $context )
    {
        $this->checkPosixAvailability($context);
        $this->assertNoSymlinkComponents();

clearstatcache(true, $this->path);
        $lstat = lstat($this->path);

if ( $lstat === false ) {
            throw new LSCMException(
                "Refusing $context: install path is no longer accessible "
                    . '(possible TOCTOU attack).'
            );
        }

if ( is_link($this->path) ) {
            throw new LSCMException(
                "Refusing $context: install path has been replaced with a "
                    . 'symlink since the scan snapshot (TOCTOU attack detected).'
            );
        }

$recanon = realpath($this->path);

if ( $recanon === false || $recanon !== $this->path ) {
            throw new LSCMException(
                "Refusing $context: install path no longer canonicalises to "
                    . 'the stored snapshot (TOCTOU attack detected).'
            );
        }

$uid = (int)$lstat['uid'];
        $gid = (int)$lstat['gid'];

if (
                $this->expectedOwnerUid !== null
                &&
                (
                    $uid !== $this->expectedOwnerUid
                    || $gid !== $this->expectedOwnerGid
                )
        ) {
            /**
             * Soft fail-closed: log and return false so the batch can continue
             * to the next install.  The security guarantee is identical to a
             * throw (the mutation is refused), but a throw would abort the
             * entire batch rather than just this install.
             */
            Logger::error(
                "$this->path - Refusing $context: install directory owner "
                    . "(uid=$uid gid=$gid) does not match the expected owner "
                    . 'captured at scan time '
                    . "(uid={$this->expectedOwnerUid} "
                    . "gid={$this->expectedOwnerGid}); "
                    . 'possible cross-tenant TOCTOU attack.'
            );

return false;
        }

if ( $uid === 0 || $gid === 0 ) {
            throw new LSCMException(
                "Refusing $context: install directory owner resolves to root "
                    . '(uid=0 or gid=0); privilege drop would be a no-op.'
            );
        }

return array($uid, $gid);
    }

/**
     * Walk every directory component of $this->path top-down using lstat() and
     * throw if any component is a symlink.  Because the walk refuses at the
     * first symlink found, no later lstat() call in the walk can be misled by
     * an earlier swapped component (lstat() still resolves intermediate
     * components before the final stat).
     *
     * This is the closest emulation of openat(AT_SYMLINK_NOFOLLOW) available
     * in pure PHP: it catches intermediate-directory symlink swaps (e.g.
     * tenant replaces public_html with a symlink into another user's tree)
     * before any uid/gid read is performed.
     *
     * @since 1.17.10
     *
     * @throws LSCMException  When $this->path is not an absolute path.
     * @throws LSCMException  When any path component cannot be stat'd.
     * @throws LSCMException  When any path component is a symlink.
     */
    private function assertNoSymlinkComponents()
    {
        if ( $this->path === '' || $this->path[0] !== '/' ) {
            throw new LSCMException(
                'Refusing flag-file write: install path is not absolute '
                    . '(possible TOCTOU attack).'
            );
        }

$parts  = explode('/', $this->path);
        $prefix = '';

foreach ( $parts as $part ) {
            if ( $part === '' ) {
                continue;
            }

$prefix .= "/$part";

clearstatcache(true, $prefix);

if ( lstat($prefix) === false ) {
                throw new LSCMException(
                    "Refusing flag-file write: path component $prefix is no "
                        . 'longer accessible (possible TOCTOU attack).'
                );
            }

if ( is_link($prefix) ) {
                throw new LSCMException(
                    "Refusing flag-file write: path component $prefix is a "
                        . 'symlink (cross-tenant TOCTOU attack detected).'
                );
            }
        }
    }

/**
     * Fail-closed guard: throw if any posix function required for privilege
     * drop/restore is not available in this PHP build.
     *
     * @since 1.17.10
     *
     * @param string $context  Human-readable label used in the exception message.
     *
     * @throws LSCMException
     */
    private function checkPosixAvailability( $context )
    {
        $required = array(
            'posix_seteuid',
            'posix_setegid',
            'posix_geteuid',
            'posix_getegid',
            'posix_initgroups',
            'posix_getpwuid',
        );

foreach ( $required as $fn ) {
            if ( !function_exists($fn) ) {
                throw new LSCMException(
                    "posix extension (function $fn) required for "
                        . "privilege-drop $context is not available."
                );
            }
        }
    }

/**
     * Remove any preexisting flag file node (symlink or regular), then create a
     * new one with O_CREAT|O_EXCL ('xb') semantics and write the flag content.
     *
     * Called under whatever effective credentials the caller has arranged.
     * is_link() catches dangling symlinks that file_exists() reports as absent.
     *
     * @since 1.17.10
     *
     * @param string $flagFile  Absolute path to the flag file.
     *
     * @return bool  False when fopen or fwrite fails (caller should propagate).
     *
     * @throws LSCMException  When unlink() of a preexisting node fails.
     * @throws LSCMException  Thrown indirectly by Context::getFlagFileContent()
     *     call.
     */
    private function writeFlagFileExclusive( $flagFile )
    {
        if ( is_link($flagFile) || file_exists($flagFile) ) {
            if ( !unlink($flagFile) ) {
                throw new LSCMException(
                    'Failed to remove preexisting untrusted flag file.'
                );
            }
        }

$flagFileContent = Context::getFlagFileContent();

$fh = @fopen($flagFile, 'xb');

if ( $fh === false ) {
            return false;
        }

if ( fwrite($fh, $flagFileContent) === false ) {
            fclose($fh);
            @unlink($flagFile);
            return false;
        }

fclose($fh);
        return true;
    }

/**
     * Remove any flag file node (symlink or regular file) under whatever
     * effective credentials the caller has arranged.
     *
     * is_link() catches dangling symlinks that file_exists() reports as absent.
     * Mirrors the node-removal preamble of writeFlagFileExclusive() so that
     * the root-context removal path uses the same defensive node-type checks as
     * the creation path.
     *
     * @since 1.17.10
     *
     * @param string $flagFile  Absolute path to the flag file.
     *
     * @return bool  False when unlink() fails; true when the node was absent or
     *     successfully removed.
     */
    private function removeFlagFileNode( $flagFile )
    {
        if ( is_link($flagFile) || file_exists($flagFile) ) {
            if ( !unlink($flagFile) ) {
                return false;
            }
        }

return true;
    }

/**
     * Drop process credentials to ($uid, $gid) for a scoped root-context
     * operation inside an untrusted tenant directory.
     *
     * Order: posix_initgroups() → posix_setegid() → posix_seteuid().
     * initgroups() must precede seteuid() because only root can replace
     * supplementary groups; setegid() must precede seteuid() because once
     * euid is non-root the process cannot change its gid.
     * Non-root callers skip the initgroups step (only root holds dangerous
     * supplementary groups, and only root has CAP_SETGID to call initgroups).
     *
     * @since 1.17.10
     *
     * @param int $uid  Tenant effective uid.
     * @param int $gid  Tenant effective gid.
     *
     * @throws LSCMException  Thrown when uid cannot be resolved to a username
     *     for the supplementary-group reset (only in root context).
     * @throws LSCMException  Thrown when posix_initgroups() fails to replace
     *     the supplementary group set (only in root context).
     * @throws LSCMException  Thrown when posix_setegid()/posix_seteuid() fail
     *     to lower the effective gid/uid.
     */
    private function dropPrivileges( $uid, $gid )
    {
        if ( posix_geteuid() === 0 ) {
            $pw = posix_getpwuid($uid);

if ( $pw === false ) {
                throw new LSCMException(
                    "Failed to look up username for uid $uid during privilege drop."
                );
            }

if ( !posix_initgroups($pw['name'], $gid) ) {
                throw new LSCMException(
                    'Failed to replace supplementary groups during privilege drop.'
                );
            }
        }

if ( !posix_setegid($gid) || !posix_seteuid($uid) ) {
            throw new LSCMException(
                'Failed to drop effective uid/gid during privilege drop.'
            );
        }
    }

/**
     * Restore process credentials to root after a dropPrivileges() scope.
     * Must always be called inside a finally block.
     *
     * Restore order: seteuid(root) → setegid(root) → initgroups('root').
     *
     * posix_seteuid(0) can only fail if the real uid is not 0 — i.e., if this
     * method is called outside of a root process, which is a programming error.
     * Throwing here is correct: the calling process is in an undefined state
     * and must not continue operating as the tenant.
     *
     * @since 1.17.10
     *
     * @param int $origEuid  Saved euid from before dropPrivileges().
     * @param int $origEgid  Saved egid from before dropPrivileges().
     *
     * @throws LSCMException  Thrown when posix_seteuid()/posix_setegid() fail
     *     to restore effective uid/gid (indicates process is in an undefined
     *     state and must not continue).
     * @throws LSCMException  Thrown when posix_initgroups() fails to restore
     *     the supplementary group set (indicates process is in an undefined
     *     state and must not continue).
     */
    private function restorePrivileges( $origEuid, $origEgid )
    {
        if ( !posix_seteuid($origEuid) || !posix_setegid($origEgid) ) {
            throw new LSCMException(
                'Failed to restore effective uid/gid after privilege drop; '
                    . 'process state is undefined.'
            );
        }

if ( $origEuid === 0 ) {
            if ( !posix_initgroups('root', $origEgid) ) {
                throw new LSCMException(
                    'Failed to restore supplementary groups after privilege drop; '
                        . 'process state is undefined.'
                );
            }
        }
    }

/**
     * Remove the flag file from this install.
     *
     * When $runningAsUser is false (root context) the same V9 trust-boundary
     * checks as addUserFlagFile(false) are applied via
     * resolveValidatedFlagOwnerUidGid() before dropping privileges for the
     * removal: per-component lstat() walk, realpath() re-verification,
     * expected-owner comparison, and root-owner refusal.  This closes the
     * cross-tenant TOCTOU gap for the deletion path that was present before
     * V9.8.
     *
     * @since 1.17.10 — root-context path ($runningAsUser=false)
     *     applies the same V9 owner-binding and symlink-walk guards as
     *     addUserFlagFile(false), then drops to install-owner credentials for
     *     the unlink.
     *
     * @param bool $runningAsUser
     *
     * @return bool  True when the flag file was absent or successfully removed;
     *     false when the removal failed or was refused (including expected-owner
     *     mismatch, which logs and returns false without aborting the batch).
     *
     * @throws LSCMException  When posix extension is unavailable in root context.
     * @throws LSCMException  When any component of the install path is a symlink.
     * @throws LSCMException  When the install path is no longer accessible.
     * @throws LSCMException  When the install path has been replaced by a symlink.
     * @throws LSCMException  When realpath() diverges from the stored snapshot.
     * @throws LSCMException  When the install directory is owned by root.
     * @throws LSCMException  Thrown indirectly by restorePrivileges() when
     *     credential restore fails (process state is undefined; thrown from
     *     the finally block).
     */
    public function removeFlagFile( $runningAsUser = true )
    {
        $flagFile = "$this->path/" . self::FLAG_FILE;

if ( !$runningAsUser ) {
            $owner = $this->resolveValidatedFlagOwnerUidGid('flag-file removal');

if ( $owner === false ) {
                return false;
            }

list($uid, $gid) = $owner;

$origEuid = posix_geteuid();
            $origEgid = posix_getegid();

try {
                $this->dropPrivileges($uid, $gid);

if ( !$this->removeFlagFileNode($flagFile) ) {
                    return false;
                }
            }
            finally {
                $this->restorePrivileges($origEuid, $origEgid);
            }
        }
        else {
            if ( file_exists($flagFile) ) {

if ( !unlink($flagFile) ) {
                    return false;
                }
            }
        }

$this->unsetStatusBit(self::ST_FLAGGED);
        return true;
    }

/**
     * Add a flag file to indicate that a new LSCWP plugin was added to this
     * installation.
     *
     * This function should only be called by the installation owner to avoid
     * permission problems involving this file.
     *
     * @return bool
     */
    public function addNewLscwpFlagFile()
    {
        $file = "$this->path/" . self::FLAG_NEW_LSCWP;

if ( !file_exists($file) ) {

if ( !file_put_contents($file, '') ) {
                return false;
            }
        }

return true;
    }

/**
     * Remove "In Progress" flag file to indicate that a WPInstall action has
     * been completed.
     *
     * @return bool
     */
    public function removeNewLscwpFlagFile()
    {
        $file = "$this->path/" . self::FLAG_NEW_LSCWP;

if ( file_exists($file) ) {

if ( !unlink($file) ) {
                return false;
            }
        }

return true;
    }

/**
     *
     * @param bool $forced
     *
     * @return int
     *
     * @throws LSCMException  Thrown indirectly by UserCommand::issue() call.
     */
    public function refreshStatus( $forced = false )
    {
        if ( !$this->refreshed || $forced ) {
            UserCommand::issue(UserCommand::CMD_STATUS, $this);
            $this->refreshed = true;
        }

return $this->getData(self::FLD_STATUS);
    }

/**
     *
     * @param string $pluginDir
     *
     * @throws LSCMException  Thrown indirectly by Logger::debug() call.
     */
    public function removePluginFiles( $pluginDir )
    {
        if ( !is_string($pluginDir)
                || $pluginDir === ''
                || $pluginDir === '/'
                || $pluginDir[0] !== '/'
                || in_array('..', explode('/', $pluginDir), true) ) {

Logger::debug(
                "$this->path - Refusing to remove plugin files: unsafe path."
            );
            return;
        }

if ( !file_exists($pluginDir) && !is_link($pluginDir) ) {
            return;
        }

if ( is_link($pluginDir) ) {
            /**
             * Plugin directory is a symlink. Remove the symlink node only; do
             * NOT resolve it via realpath() + rm -rf, which would recursively
             * delete the target directory (potentially outside wp-content/).
             */
            if ( @unlink($pluginDir) ) {
                Logger::debug(
                    "$this->path - Removed LSCache for WordPress plugin "
                        . 'symlink from plugins directory'
                );
            }
            else {
                Logger::debug(
                    "$this->path - Failed to remove LSCache for WordPress "
                        . 'plugin symlink from plugins directory'
                );
            }

return;
        }

exec('rm -rf ' . escapeshellarg($pluginDir));

Logger::debug(
            "$this->path - Removed LSCache for WordPress plugin files from "
                . 'plugins directory'
        );
    }

/**
     *
     * @return bool
     */
    public function isFlagBitSet()
    {
        if ( ($this->getStatus() & self::ST_FLAGGED) ) {
            return true;
        }

return false;
    }

/**
     *
     * @param null|int $status
     *
     * @return bool
     */
    public function hasFatalError( $status = null )
    {
        if ( $status === null ) {
            $status = $this->getData(self::FLD_STATUS);
        }

return (($status & $errMask) > 0);
    }

/**
     *
     * @since 1.17.10
     *
     * @return PhpBinaryParts
     *
     * @throws LSCMException  Thrown indirectly by
     *     ControlPanel::getClassInstance() call.
     * @throws LSCMException  Thrown indirectly by
     *     ControlPanel::getClassInstance()->getPhpBinaryParts() call.
     */
    public function getPhpBinaryParts()
    {
        if ( $this->phpBinaryParts === null ) {
            $this->phpBinaryParts =
                ControlPanel::getClassInstance()->getPhpBinaryParts($this);
        }

return $this->phpBinaryParts;
    }

/**
     * @deprecated since 1.17.10  Call getPhpBinaryParts() instead.
     *
     * @return string
     *
     * @throws LSCMException  Thrown indirectly by getPhpBinaryParts() call.
     */
    public function getPhpBinary()
    {
        if ( $this->phpBinary === null ) {
            $parts         = $this->getPhpBinaryParts();
            $options       = $parts->getOptionsString();
            $this->phpBinary = $options === ''
                ? $parts->getBinPath()
                : $parts->getBinPath() . ' ' . $options;
        }

return $this->phpBinary;
    }

/**
     * Returns requested owner info.
     *
     * @param string $field  Key ('user_id', 'user_name', or 'group_id') in the
     *     $ownerInfo array.
     *
     * @return array|int|string|null
     */
    public function getOwnerInfo( $field = '' )
    {
        if ( $this->ownerInfo == null ) {
            $this->ownerInfo = Util::populateOwnerInfo($this->path);
        }

if ( $field == '' ) {
            return $this->ownerInfo;
        }
        elseif ( isset($this->ownerInfo[$field]) ) {
            return $this->ownerInfo[$field];
        }

return null;
    }

/**
     *
     * @return string
     */
    public function getSuCmd()
    {
        if ( $this->suCmd == null ) {
            $userName    = (string)$this->getOwnerInfo('user_name');
            $this->suCmd = 'su ' . escapeshellarg($userName) . ' -s /bin/bash';
        }

return $this->suCmd;
    }

/**
     *
     * @return int
     */
    public function getCmdStatus()
    {
        return $this->cmdStatus;
    }

/**
     *
     * @return string
     */
    public function getCmdMsg()
    {
        return $this->cmdMsg;
    }

public function setCmdStatusAndMsg( $status, $msg )
    {
        $this->cmdStatus = $status;
        $this->cmdMsg    = $msg;
    }

}