[wp-trac] [WordPress Trac] #30945: WP_Upgrader: Incorrect plugin folder after updating from remote (non-WP) URL

[WordPress Trac]

#30945: WP_Upgrader: Incorrect plugin folder after updating from remote (non-WP)
URL
--------------------------+-----------------------------
 Reporter:  miyarakira    |      Owner:
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Plugins       |    Version:  4.1
 Severity:  normal        |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 I have a plugin that fetches its updates via a remote URL - it's hosted on
 my own server, not WordPress.org. The plugin hooks into the
 `site_transient_update_plugins` filter to integrate with the native plugin
 update process.

 The issue I've run into is that after performing an update, the plugin is
 in a new folder with an incorrect name.  It happens under two conditions:

 1) If the download URL is in the syntax `http://example.com/updates/my-
 plugin.zip`, then the plugin folder is renamed to `my-plugin.tmp` instead
 of `my-plugin`.

 2) If the download URL is in the syntax
 `http://example.com/updates/?action=download&slug=my-plugin` (the server
 interprets this and returns the zip file), then the plugin folder is
 renamed to `actiondownloadslugmy-plugin`, based on the query string.

 I've been tracing the root cause of the issue in `wp-admin/includes/class-
 wp-upgrader.php`, and it's happening in `WP_Upgrader::run()`. The plugin
 is downloaded into a temporary folder via `download_package()`. It uses
 `download_url($package)` which calls `wp_tempnam($url)` to create the
 temporary folder name.  Then it's unpacked, and by the time it gets to
 `install_package()` the destination directory is different from the
 original plugin folder.  It seems that before `install_package()`, the
 plugin folder should be renamed from the temporary one to the correct one,
 based on the information available in $package.

 I checked how a plugin hosted on WordPress.org is updated. The options
 passed to `WP_Upgrader::run()` are the same, with the download URL
 pointing to a zip file.  I wonder where it's going wrong in my case..
 Could it be that the zip file itself is the problem?  I was having another
 issue there where if the zip contained a root folder with all the files,
 the update process would throw an error that the plugin was "empty".

 It would be great if someone could help me figure this out..

--
Ticket URL: <https://core.trac.wordpress.org/ticket/30945>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform