How to allow theme update downloads to WordPress installs only?

Question

I am working on custom theme update script that works fine but after the update if you click on update success notification link "Show Details" , the full link to update is displayed.

and since I was doing this in my download script

if(isset($_GET['download'])){

    // run download

}else{

    exit;

}

you were able to copy the link and download the zip directly.

I checked another download script that checks for user_agent , and if WordPress string is within it allows the download so I made a mod to my script like so

$user_agent = $_SERVER['HTTP_USER_AGENT'];

if(isset($_GET['download']) && stristr( $user_agent, 'WordPress' ) == TRUE ){

    // run download

}else{

    exit;

}

now I am not sure how reliable this is so my question is is there a reliable string/header anything that is sent by update-core.php?action=do-theme-upgrade

that I can check for to make sure that only WordPress install is allowed to download the update.

Answer 1

$_SERVER['HTTP_USER_AGENT'] is something you should not rely on.

This can be anything from:

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36

to

☆*:｡゜ﾟ･*ヽ(^ᴗ^)ﾉ*･゜ﾟ｡:*☆ ¯\_(ツ)_/¯(ಠ益ಠ)(ಥ‿ಥ)(ʘ‿ʘ)ლ(ಠ_ಠლ)( ͡° ͜ʖ ͡°)ヽ(ﾟДﾟ)ﾉʕ•̫͡•ʔᶘ ᵒᴥᵒᶅ(=^ ^=)oO

So you need to thinker something other to rely upon.

---

Why don't you simply use form action do-theme-upgrade?

File: wp-admin/update-core.php
336: function list_theme_updates() {
337:    $themes = get_theme_updates();
338:    if ( empty( $themes ) ) {
339:        echo '<h2>' . __( 'Themes' ) . '</h2>';
340:        echo '<p>' . __( 'Your themes are all up to date.' ) . '</p>';
341:        return;
342:    }
343: 
344:    $form_action = 'update-core.php?action=do-theme-upgrade';