Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix(updater): Paket-Adresse aus Tag und Dateiname bauen, Version 1.0.2

Browse Source 
Gitea meldet browser_download_url hinter dem TLS-Proxy mit http://, der Updater lehnte die Adresse ab
und fand kein Update. Die Adresse wird jetzt aus dem geprüften Tag und dem Dateinamen gebaut; release-check.sh
prüft genauso.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Jan-Niclas Loosen
2026-11-04 14:50:43 +01:00
co-authored by Claude Sonnet 5.5
parent b2759fba73
commit c8648d5263
6 changed files with 44 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Plugin.php
+1 -1
View File
@@ -46,7 +46,7 @@ defined('ABSPATH') || exit;
*/
final class Plugin
{
public const VERSION = '1.0.1';
public const VERSION = '1.0.2';
private static string $pluginFile = '';
private static ?SettingsPage $settingsPage = null;
src/Updater/GiteaUpdater.php
+9 -12
View File
@@ -13,7 +13,7 @@ defined('ABSPATH') || exit;
* Gitea host, so WordPress asks the filter update_plugins_<host> (about every 12 hours, which is also the only
* caching needed). The release carries the ZIP as asset wp-lit-mcp-<version>.zip.
*
* shortcut: no signature – a package is trusted as far as the repository's release downloads and TLS are, so whoever
* shortcut: no signature – the package is trusted as far as the repository's release downloads and TLS are, so whoever
* can publish a release there ships code to every site that updates. Public release assets only (WordPress downloads
* without credentials). Add a signature checked before unpacking (key outside Gitea) before the plugin runs on sites
* you do not control.
@@ -90,7 +90,7 @@ final class GiteaUpdater
}
$version = $match[1];
$package = self::packageUrl((array) ($body['assets'] ?? []), $version);
$package = self::packageUrl((array) ($body['assets'] ?? []), $tag, $version);
if ($package === null) {
return self::failed(
sprintf('release %s has no asset %s-%s.zip in the repository', $tag, self::SLUG, $version)
@@ -101,21 +101,18 @@ final class GiteaUpdater
}
/**
* The ZIP asset of this version, only from the repository's release downloads: the trust boundary of the update.
* The ZIP of this version – its address is built here from the checked tag and the file name, not taken from the
* answer: Gitea behind a TLS proxy reports http:// (its ROOT_URL), and a URL from the answer would be a second
* trust boundary. The asset only has to exist.
*
* @param array<array-key, mixed> $assets
*/
private static function packageUrl(array $assets, string $version): ?string
private static function packageUrl(array $assets, string $tag, string $version): ?string
{
$zipName = self::SLUG . '-' . $version . '.zip';
foreach ($assets as $asset) {
if (! is_array($asset)) {
continue;
}
$url = (string) ($asset['browser_download_url'] ?? '');
$isZip = ($asset['name'] ?? '') === self::SLUG . '-' . $version . '.zip';
if ($isZip && str_starts_with($url, self::RELEASE_DOWNLOADS)) {
return $url;
if (is_array($asset) && ($asset['name'] ?? '') === $zipName) {
return self::RELEASE_DOWNLOADS . rawurlencode($tag) . '/' . $zipName;
}
}