Changeset 3794790

Timestamp:

11/10/2026 04:14:48 PM (20 hours ago)

Author:

motov.net

Message:

6.30: make the 6.29 protected-PDF rebuild safe. Each copy records a keyed fingerprint of the restriction settings it was built with (<copy>.protection) instead of relying on file dates; copies are written to a temp file with a length check and renamed into place; TCPDF errors throw instead of die(); a rebuild only happens for an existing order with its stored password, in that order's writable protected directory, and on any failure (missing/corrupt source, unwritable directory, write error) the buyer keeps the existing protected copy. Admin resend never attaches the master; email-log Resend rebuilds outdated copies; plugin-order rebuild runs after the eligibility checks; restore_pdf_marker no longer clears a parallel build's result.

Location:

ebook-store/trunk

Files:

• EbookStoreEbook.class.php (modified) (4 diffs)
• ebook_store.php (modified) (1 diff)
• fpdi/qrcode.class.php (modified) (2 diffs)
• functions.php (modified) (6 diffs)
• includes/ebook-store-bootstrap.php (modified) (1 diff)
• readme.txt (modified) (3 diffs)

ebook-store/trunk/EbookStoreEbook.class.php

@@ -347 +347 @@
                         // cache hit can skip generating it entirely. A copy built with other
                         // restriction settings is rebuilt instead (same password: it is
-                        // stored on the order).
-                        if (file_exists($ebook_pdf_path) && ! ebook_store_pdf_cache_is_stale($ebook_pdf_path)) {
+                        // stored on the order), unless the source is gone, in which case the
+                        // buyer keeps the copy they have.
+                        $had_copy = file_exists($ebook_pdf_path);
+                        if ($had_copy && (! ebook_store_pdf_cache_is_stale($ebook_pdf_path) || ! is_readable($this->files[$format]) || ! wp_is_writable($cache_dir))) {
                                 return $ebook_pdf_path;
                         }
@@ -408 +410 @@
 
                                 $pdf->applyProtection($password, $owner_password);
-                                $pdf->Output($ebook_pdf_path, 'F');
+                                // Atomic: a failure leaves any previous copy untouched.
+                                ebook_store_write_protected_pdf($pdf, $ebook_pdf_path);
                         } catch (\Throwable $e) {
-                                // A half-written file must not be served as a cache hit next time.
-                                if (file_exists($ebook_pdf_path)) {
-                                        @unlink($ebook_pdf_path);
-                                }
                                 if (function_exists('ebook_store_log')) {
                                         ebook_store_log('pdf', 'PDF protection failed: ' . $e->getMessage(), array('order_id' => $order_id, 'ebook_id' => $this->ebook_id, 'file' => $this->files[$format]));
+                                }
+                                // Rebuilding an existing copy failed: the buyer keeps that copy.
+                                if ($had_copy && file_exists($ebook_pdf_path)) {
+                                        return $ebook_pdf_path;
                                 }
                                 wp_die( esc_html( sprintf(
@@ -566 +569 @@
 }
 /**
- * Protected PDF copies older than this timestamp are rebuilt on their next
- * download.
- *
- * It is set the first time 6.29+ runs, because every copy made by 6.20-6.28
- * carries inverted restrictions, and moved forward whenever a restriction
- * setting changes, so a new setting reaches buyers who already have a copy.
- *
- * @return int Unix timestamp.
+ * A keyed fingerprint of the settings applyProtection() writes into a PDF: the
+ * four reader restrictions and the owner password.
+ *
+ * Every protected copy is stored with the fingerprint it was built with (a
+ * "<file>.protection" record next to it), so a copy is rebuilt exactly when
+ * these settings differ from the ones it carries. Copies made by 6.20-6.29
+ * have no record and are rebuilt once: up to 6.28 their restrictions came out
+ * inverted.
+ *
+ * @return string
  */
-function ebook_store_get_pdf_cache_valid_after() {
-        $valid_after = get_option( 'ebook_store_pdf_cache_valid_after', null );
-        if ( $valid_after === null || $valid_after === false || $valid_after === '' ) {
-                $valid_after = time();
-                add_option( 'ebook_store_pdf_cache_valid_after', $valid_after );
-        }
-
-        return (int) $valid_after;
+function ebook_store_pdf_protection_fingerprint() {
+        $parts = array( 'ebook-store-pdf-protection-2' );
+        foreach ( array( 'disable_pdf_printing', 'disable_pdf_copy', 'disable_pdf_modify', 'disable_annot-forms' ) as $option ) {
+                $parts[] = get_option( $option ) == 1 ? '1' : '0';
+        }
+        $parts[] = (string) get_option( 'ebook_store_owner_password' );
+
+        // Keyed, so the record does not expose the owner password to offline guessing.
+        return hash_hmac( 'sha256', implode( '|', $parts ), wp_salt( 'auth' ) );
 }
 
 /**
- * Was this cached protected PDF built before the current restriction settings?
+ * @param string $file Protected PDF copy.
+ * @return string Path of the record holding the fingerprint it was built with.
+ */
+function ebook_store_pdf_fingerprint_path( $file ) {
+        return $file . '.protection';
+}
+
+/**
+ * Was this protected copy built with other restriction settings than the
+ * current ones (or before copies recorded them)?
  *
  * @param string $file Path of a per-order protected copy.
@@ -596 +611 @@
         }
 
-        $built = @filemtime( $file );
-
-        return $built !== false && $built < ebook_store_get_pdf_cache_valid_after();
+        $recorded = @file_get_contents( ebook_store_pdf_fingerprint_path( $file ) );
+
+        return ! is_string( $recorded ) || ! hash_equals( ebook_store_pdf_protection_fingerprint(), trim( $recorded ) );
 }
 
 /**
- * Mark every cached protected PDF as outdated. Hooked to the restriction and
- * owner-password settings.
+ * Write a finished protected PDF to its final path atomically and record the
+ * settings it was built with.
+ *
+ * The file is written next to the destination and renamed over it, so a
+ * download that is streaming the previous copy, or arrives meanwhile, never
+ * sees a half-written file, and a failed build leaves the previous copy intact.
+ *
+ * @param QRPDF  $pdf  Document with protection applied.
+ * @param string $dest Final path.
+ * @throws RuntimeException When the file cannot be written or moved into place.
  */
-function ebook_store_invalidate_pdf_cache() {
-        update_option( 'ebook_store_pdf_cache_valid_after', time() );
-}
-foreach ( array( 'disable_pdf_printing', 'disable_pdf_copy', 'disable_pdf_modify', 'disable_annot-forms', 'ebook_store_owner_password' ) as $ebook_store_protection_option ) {
-        add_action( 'update_option_' . $ebook_store_protection_option, 'ebook_store_invalidate_pdf_cache' );
-        add_action( 'add_option_' . $ebook_store_protection_option, 'ebook_store_invalidate_pdf_cache' );
-}
-unset( $ebook_store_protection_option );
+function ebook_store_write_protected_pdf( $pdf, $dest ) {
+        // Fixed-length name: prefixing the destination's basename could exceed the
+        // file-name limit for books whose source PDF has a long name.
+        $tmp = trailingslashit( dirname( $dest ) ) . '.tmp-' . wp_generate_password( 12, false, false ) . '.pdf';
+
+        try {
+                // Write the bytes here rather than through Output( 'F' ), which ignores a
+                // short write: on a full disk a truncated file would replace a good copy.
+                $bytes = (string) $pdf->Output( '', 'S' );
+                if ( strncmp( $bytes, '%PDF-', 5 ) !== 0 ) {
+                        throw new RuntimeException( 'The protected PDF could not be generated.' );
+                }
+                $written = @file_put_contents( $tmp, $bytes, LOCK_EX );
+                if ( $written !== strlen( $bytes ) ) {
+                        throw new RuntimeException( 'The protected PDF could not be written completely.' );
+                }
+                // rename() replaces the destination atomically, also on Windows. If it
+                // fails, the previous copy stays exactly as it was.
+                if ( ! @rename( $tmp, $dest ) ) {
+                        throw new RuntimeException( 'The protected PDF could not be moved into place.' );
+                }
+        } finally {
+                if ( file_exists( $tmp ) ) {
+                        @unlink( $tmp );
+                }
+        }
+
+        $fingerprint = ebook_store_pdf_protection_fingerprint();
+        if ( @file_put_contents( ebook_store_pdf_fingerprint_path( $dest ), $fingerprint, LOCK_EX ) !== strlen( $fingerprint ) && function_exists( 'ebook_store_log' ) ) {
+                // The copy is fine, only unrecorded: it will be rebuilt on its next use.
+                ebook_store_log( 'pdf', 'Could not record the protection settings of a PDF copy.', array( 'file' => basename( $dest ) ) );
+        }
+}
+
+/**
+ * Unprotected source PDF of an ebook, or '' when it is missing or cannot be
+ * processed for protection.
+ *
+ * @param int $ebook_id Ebook post ID.
+ * @return string
+ */
+function ebook_store_get_rebuildable_master_pdf( $ebook_id ) {
+        $attachment = get_post_meta( absint( $ebook_id ), 'ebook_wp_custom_attachment', true );
+        $master     = ( is_array( $attachment ) && ! empty( $attachment['file'] ) ) ? (string) $attachment['file'] : '';
+
+        if ( $master === '' || ! is_readable( $master ) || ! function_exists( 'ebook_store_encryptable' ) || ! ebook_store_encryptable( $master ) ) {
+                return '';
+        }
+
+        return $master;
+}
+
+/**
+ * The protected copy to deliver: rebuilt with the current settings when it
+ * was made with other ones, otherwise (or if the rebuild is impossible or
+ * fails) the existing protected copy. Never the unprotected master.
+ *
+ * With PDF protection switched off nothing is rebuilt, as before.
+ *
+ * @param string $file     Existing per-order protected copy.
+ * @param int    $order_id ebook_order post ID or WooCommerce order ID.
+ * @param int    $ebook_id Ebook post ID.
+ * @return string
+ */
+function ebook_store_refresh_protected_pdf( $file, $order_id, $ebook_id ) {
+        if ( ! get_option( 'encrypt_pdf' ) || ! ebook_store_pdf_cache_is_stale( $file ) ) {
+                return $file;
+        }
+
+        $order_id = absint( $order_id );
+        $keep     = function ( $reason ) use ( $file, $order_id, $ebook_id ) {
+                if ( function_exists( 'ebook_store_log' ) ) {
+                        ebook_store_log( 'pdf', 'Outdated protected copy kept: ' . $reason, array( 'order_id' => $order_id, 'ebook_id' => $ebook_id ) );
+                }
+                return $file;
+        };
+
+        // Rebuild only for an order that still exists and carries its password, so
+        // the new copy has the buyer's details and opens with the same password.
+        $is_plugin_order = get_post_type( $order_id ) === 'ebook_order';
+        $is_wc_order     = ! $is_plugin_order && function_exists( 'wc_get_order' ) && is_a( wc_get_order( $order_id ), 'WC_Order' );
+        if ( ( ! $is_plugin_order && ! $is_wc_order ) || ! metadata_exists( 'post', $order_id, 'password' ) ) {
+                return $keep( 'the order or its stored password no longer exists.' );
+        }
+
+        // Only the order's own protected copy is replaced, in its own directory.
+        $cache_dir = ebook_store_get_cache_dir( $order_id );
+        if ( $cache_dir === '' || wp_normalize_path( dirname( $file ) ) !== wp_normalize_path( $cache_dir ) || ! wp_is_writable( $cache_dir ) ) {
+                return $keep( 'the protected directory is unavailable or not writable.' );
+        }
+
+        $master = ebook_store_get_rebuildable_master_pdf( $ebook_id );
+        if ( $master === '' ) {
+                return $keep( 'the source PDF is missing or cannot be processed.' );
+        }
+
+        try {
+                if ( $is_plugin_order ) {
+                        $rebuilt = ebook_store_rebuild_order_pdf( $order_id, $master );
+                } else {
+                        $ebook   = new EbookStoreEbook( $ebook_id );
+                        $rebuilt = $ebook->encrypted( $order_id, 'pdf' );
+                }
+        } catch ( \Throwable $e ) {
+                return $keep( 'rebuild failed: ' . $e->getMessage() );
+        }
+
+        if ( ! is_string( $rebuilt ) || $rebuilt === '' || ! file_exists( $rebuilt ) || wp_normalize_path( dirname( $rebuilt ) ) !== wp_normalize_path( $cache_dir ) ) {
+                return $keep( 'the rebuild did not produce a copy in the protected directory.' );
+        }
+
+        return $rebuilt;
+}
 
 /**

ebook-store/trunk/ebook_store.php

@@ -8 +8 @@
 Domain Path: /languages
 Author URI:https://www.shopfiles.com/index.php/products/wordpress-ebook-store
-Version: 6.29
+Version: 6.30
 Requires at least: 5.8
 Requires PHP: 7.4

ebook-store/trunk/fpdi/qrcode.class.php

@@ -191 +191 @@
 
         /**
+         * Throw instead of die(). The bundled TCPDF config sets
+         * K_TCPDF_THROW_EXCEPTION_ERROR to false, so its errors ended the request
+         * and no caller could fall back to the buyer's existing copy.
+         *
+         * @param string $msg Error message.
+         * @throws RuntimeException Always.
+         */
+        public function Error($msg) {
+                $this->_destroy(true);
+                throw new RuntimeException('TCPDF ERROR: ' . $msg);
+        }
+
+        /**
          * Apply the reader restrictions and passwords, mapping the plugin's options
          * to TCPDF's permission model.
@@ -215 +228 @@
                 if (get_option('disable_annot-forms') == 1) {
                         $blocked = array_merge($blocked, array('annot-forms', 'fill-forms'));
-                }
-
-                // Record the cache baseline before the first file is written, so a copy
-                // built now is not mistaken for one made with older settings.
-                if (function_exists('ebook_store_get_pdf_cache_valid_after')) {
-                        ebook_store_get_pdf_cache_valid_after();
                 }
 

ebook-store/trunk/functions.php

@@ -5345 +5345 @@
                         
                 }
-                // A protected copy built with other restriction settings (every copy made
-                // by 6.20-6.28, whose restrictions came out inverted) is rebuilt with the
-                // current ones. The buyer keeps the same password: it is stored on the order.
-                if ( $wants_order_pdf && get_post_type( $order_id ) === 'ebook_order' && get_option( 'encrypt_pdf' )
-                        && ebook_store_pdf_cache_is_stale( (string) get_post_meta( $order_id, 'encrypted_pdf', true ) ) ) {
-                        ebook_store_rebuild_order_pdf( $order_id, $requested_file );
-                }
                 if (get_post_meta($order_id,'encrypted_pdf',true) != '' && $_REQUEST['type'] != 'bonus') {
                         $requested_file = get_post_meta($order_id,'encrypted_pdf',true);
@@ -5417 +5410 @@
                 if ($strtotime !== false && $strtotime > $gmt_timestamp && $strtotime < time()) {
                         wp_die('Oops, the link you are using has expired, you need to order again.');
+                }
+
+                // A plugin order's protected copy made with other restriction settings
+                // (every copy made by 6.20-6.28, whose restrictions came out inverted) is
+                // rebuilt with the current ones, now that the order is known to be
+                // eligible. The password stays the one stored on the order, and if the
+                // rebuild is impossible the existing protected copy is served.
+                if ( $wants_order_pdf && get_post_type( $order_id ) === 'ebook_order'
+                        && $requested_file !== '' && $requested_file === (string) get_post_meta( $order_id, 'encrypted_pdf', true ) ) {
+                        $requested_file = ebook_store_refresh_protected_pdf( $requested_file, $order_id, $ebook );
                 }
 
@@ -6816 +6819 @@
                 $attachment_file = (string) get_post_meta( $order_id, 'encrypted_epub', true );
         }
-        // An outdated protected copy (other restriction settings) is rebuilt below too.
-        if ( $attachment_file === '' || ! file_exists( $attachment_file ) || ebook_store_pdf_cache_is_stale( $attachment_file ) ) {
+        // An existing protected copy made with other restriction settings is rebuilt;
+        // if that is impossible the existing protected copy is sent, never the master.
+        if ( $attachment_file !== '' && file_exists( $attachment_file ) ) {
+                $attachment_file = ebook_store_refresh_protected_pdf( $attachment_file, $order_id, $ebook_id );
+        }
+        if ( $attachment_file === '' || ! file_exists( $attachment_file ) ) {
                 $master_attachment = ebook_attachment( $ebook_id, true );
                 $attachment_file = isset( $master_attachment[0]['file'] ) ? (string) $master_attachment[0]['file'] : '';
@@ -7102 +7109 @@
                 )
         );
+
+        // A protected copy made with other restriction settings is rebuilt before
+        // it is sent again; if that is impossible the logged copy is sent as before.
+        $log_order_id = absint( get_post_meta( $log_id, 'related_order_id', true ) );
+        $log_ebook_id = absint( get_post_meta( $log_id, 'ebook_id', true ) );
+        if ( $log_order_id && $log_ebook_id ) {
+                foreach ( $attachments as $index => $path ) {
+                        $attachments[ $index ] = ebook_store_refresh_protected_pdf( $path, $log_order_id, $log_ebook_id );
+                }
+        }
 
         $mail_result = wp_mail( $recipient, $subject, $body_html, $headers, $attachments );
@@ -8247 +8264 @@
 
                 $pdf->applyProtection($password, $owner_password);
-                $pdf->Output($destfile, 'F');
+                // Atomic: a download streaming the previous copy, or a failed build,
+                // never leaves a half-written file at $destfile.
+                ebook_store_write_protected_pdf($pdf, $destfile);
                 $generated = file_exists($destfile);
         } finally {
@@ -8302 +8321 @@
         $previous = $GLOBALS['ebook_store_pdf_in_progress'][ $order_id ];
         unset( $GLOBALS['ebook_store_pdf_in_progress'][ $order_id ] );
+        if ( $previous === 'in_progress' ) {
+                // Another request was already building this copy when this one began.
+                // That request owns the marker and the result; clearing them here could
+                // leave the order with no protected copy at all.
+                return;
+        }
+        if ( (string) get_post_meta( $order_id, 'encrypted_pdf', true ) !== 'in_progress' ) {
+                // A parallel build finished meanwhile and recorded its copy: keep it.
+                return;
+        }
         delete_post_meta( $order_id, 'encrypted_pdf_started' );
-        if ( $previous !== '' && $previous !== 'in_progress' ) {
+        if ( $previous !== '' ) {
                 update_post_meta( $order_id, 'encrypted_pdf', wp_slash( $previous ) );
         } else {

ebook-store/trunk/includes/ebook-store-bootstrap.php

@@ -141 +141 @@
         if ( ( $installed === '' || version_compare( $installed, '6.27', '<' ) ) && ! wp_next_scheduled( 'ebook_store_license_plan_refresh' ) ) {
                 wp_schedule_single_event( time() + 5, 'ebook_store_license_plan_refresh' );
+        }
+
+        // 6.29 dated protected copies with this option; 6.30 records the settings
+        // next to each copy instead.
+        if ( $installed !== '' && version_compare( $installed, '6.30', '<' ) ) {
+                delete_option( 'ebook_store_pdf_cache_valid_after' );
         }
 

ebook-store/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1.4
 Requires PHP: 7.4
-Stable tag: 6.29
+Stable tag: 6.30
 License: GPLv2 or later
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
@@ -218 +218 @@
 == Changelog ==
 
+= 6.30 =
+* Follow-up to 6.29. If an outdated protected copy cannot be rebuilt (for example, the ebook's original PDF was removed or replaced with one that cannot be processed), the buyer now keeps receiving the copy they already had. In 6.29 the download failed, and on WooCommerce stores that copy was deleted.
+* Protected copies are now written to a temporary file and swapped in, so two downloads at the same moment can no longer receive a broken PDF.
+* Each protected copy records the restriction settings it was made with, so it is rebuilt exactly when those settings change, including after a site move that resets file dates. Resending from the email log now rebuilds outdated copies too.
+* An admin resend never attaches the unprotected original instead of the buyer's copy. Nothing is rebuilt while PDF protection is switched off.
+
 = 6.29 =
 * Fixed: PDF reader restrictions were applied in reverse since 6.20. With every restriction switched off, buyers received a PDF that could not be printed, copied, edited or annotated; with every restriction switched on, the PDF had no restrictions at all. Each setting now does what it says.
@@ -245 +251 @@
 * PayPal: new REST API checkout with OAuth, signed webhooks and refunds from the order screen. PayPal is retiring the Buy Now form and IPN in January 2027. Stores without REST credentials keep using the old form until they switch.
 
-= 6.24 =
-* Stripe: one order per payment even when the thank-you page and the webhook arrive together; the checkout session is created on click, not on page load.
-* Adyen: recoverable webhook failures are redelivered instead of dropped; payment-link records live as long as the link.
-* WooCommerce: download allowance counted per ebook, "Reset downloads" order action, "Read online" serves the buyer's protected copy.
-* PayPal (legacy form): price, currency and tax are signed and verified. Free-download email form enforced server-side. Free and donation ebooks are no longer switched to paid by a licence-check hiccup.
-
 Earlier versions: see the full changelog at https://plugins.trac.wordpress.org/browser/ebook-store/tags/6.24/readme.txt
 
 == Upgrade Notice ==
+
+= 6.30 =
+Makes the 6.29 PDF restriction fix safe in rare cases: a copy that cannot be rebuilt is kept instead of lost, and simultaneous downloads can no longer get a broken file. Recommended for everyone on 6.29.
 
 = 6.29 =