Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Verify md5 hash when `wp core download` #2461

merged 3 commits into from Feb 9, 2016
Changes from 1 commit
File filter...
Filter file types
Jump to…
Jump to file or symbol
Failed to load files and symbols.


Just for now

@@ -42,6 +42,16 @@ Feature: Download WordPress
Error: Release not found.

Scenario: Verify release hash when downloading new version
Given an empty directory

When I run `wp core download --version=4.4.1`
Then STDOUT should contain:
md5 hash verified: 1907d1dbdac7a009d89224a516496b8d
Success: WordPress downloaded.

Scenario: Core download to a directory specified by `--path` in custom command
Given a WP install
And a download-command.php file:
@@ -142,6 +142,18 @@ public function download( $args, $assoc_args ) {
WP_CLI::error( "Couldn't access download URL (HTTP code {$response->status_code})" );
$md5_response = Utils\http_request( 'GET', $download_url . '.md5' );
if ( 20 != substr( $md5_response->status_code, 0, 2 ) ) {

This comment has been minimized.

Copy link

szepeviktor Feb 9, 2016


Oops! '20' !==

WP_CLI::error( "Couldn't access md5 hash for release (HTTP code {$response->status_code})" );
$md5_file = md5_file( $temp );
if ( $md5_file === $md5_response->body ) {
WP_CLI::log( 'md5 hash verified: ' . $md5_file );
} else {
WP_CLI::error( "md5 hash for download ({$md5_file}) is different than the release hash ({$md5_response->body})" );
try {
self::_extract( $temp, $download_dir );
} catch ( Exception $e ) {
ProTip! Use n and p to navigate between commits in a pull request.
You can’t perform that action at this time.