setup-config.php 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457
  1. <?php
  2. /**
  3. * Retrieves and creates the wp-config.php file.
  4. *
  5. * The permissions for the base directory must allow for writing files in order
  6. * for the wp-config.php to be created using this page.
  7. *
  8. * @package WordPress
  9. * @subpackage Administration
  10. */
  11. /**
  12. * We are installing.
  13. */
  14. define( 'WP_INSTALLING', true );
  15. /**
  16. * We are blissfully unaware of anything.
  17. */
  18. define( 'WP_SETUP_CONFIG', true );
  19. /**
  20. * Disable error reporting
  21. *
  22. * Set this to error_reporting( -1 ) for debugging
  23. */
  24. error_reporting( 0 );
  25. if ( ! defined( 'ABSPATH' ) ) {
  26. define( 'ABSPATH', dirname( dirname( __FILE__ ) ) . '/' );
  27. }
  28. require( ABSPATH . 'wp-settings.php' );
  29. /** Load WordPress Administration Upgrade API */
  30. require_once( ABSPATH . 'wp-admin/includes/upgrade.php' );
  31. /** Load WordPress Translation Installation API */
  32. require_once( ABSPATH . 'wp-admin/includes/translation-install.php' );
  33. nocache_headers();
  34. // Support wp-config-sample.php one level up, for the develop repo.
  35. if ( file_exists( ABSPATH . 'wp-config-sample.php' ) ) {
  36. $config_file = file( ABSPATH . 'wp-config-sample.php' );
  37. } elseif ( file_exists( dirname( ABSPATH ) . '/wp-config-sample.php' ) ) {
  38. $config_file = file( dirname( ABSPATH ) . '/wp-config-sample.php' );
  39. } else {
  40. wp_die(
  41. sprintf(
  42. /* translators: %s: wp-config-sample.php */
  43. __( 'Sorry, I need a %s file to work from. Please re-upload this file to your WordPress installation.' ),
  44. '<code>wp-config-sample.php</code>'
  45. )
  46. );
  47. }
  48. // Check if wp-config.php has been created
  49. if ( file_exists( ABSPATH . 'wp-config.php' ) ) {
  50. wp_die(
  51. '<p>' . sprintf(
  52. /* translators: 1: wp-config.php, 2: install.php */
  53. __( 'The file %1$s already exists. If you need to reset any of the configuration items in this file, please delete it first. You may try <a href="%2$s">installing now</a>.' ),
  54. '<code>wp-config.php</code>',
  55. 'install.php'
  56. ) . '</p>'
  57. );
  58. }
  59. // Check if wp-config.php exists above the root directory but is not part of another installation
  60. if ( @file_exists( ABSPATH . '../wp-config.php' ) && ! @file_exists( ABSPATH . '../wp-settings.php' ) ) {
  61. wp_die(
  62. '<p>' . sprintf(
  63. /* translators: 1: wp-config.php, 2: install.php */
  64. __( 'The file %1$s already exists one level above your WordPress installation. If you need to reset any of the configuration items in this file, please delete it first. You may try <a href="%2$s">installing now</a>.' ),
  65. '<code>wp-config.php</code>',
  66. 'install.php'
  67. ) . '</p>'
  68. );
  69. }
  70. $step = isset( $_GET['step'] ) ? (int) $_GET['step'] : -1;
  71. /**
  72. * Display setup wp-config.php file header.
  73. *
  74. * @ignore
  75. * @since 2.3.0
  76. *
  77. * @global string $wp_local_package
  78. * @global WP_Locale $wp_locale WordPress date and time locale object.
  79. *
  80. * @param string|array $body_classes
  81. */
  82. function setup_config_display_header( $body_classes = array() ) {
  83. $body_classes = (array) $body_classes;
  84. $body_classes[] = 'wp-core-ui';
  85. $dir_attr = '';
  86. if ( is_rtl() ) {
  87. $body_classes[] = 'rtl';
  88. $dir_attr = ' dir="rtl"';
  89. }
  90. header( 'Content-Type: text/html; charset=utf-8' );
  91. ?>
  92. <!DOCTYPE html>
  93. <html xmlns="http://www.w3.org/1999/xhtml"<?php echo $dir_attr; ?>>
  94. <head>
  95. <meta name="viewport" content="width=device-width" />
  96. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  97. <meta name="robots" content="noindex,nofollow" />
  98. <title><?php _e( 'WordPress &rsaquo; Setup Configuration File' ); ?></title>
  99. <?php wp_admin_css( 'install', true ); ?>
  100. </head>
  101. <body class="<?php echo implode( ' ', $body_classes ); ?>">
  102. <p id="logo"><a href="<?php echo esc_url( __( 'https://wordpress.org/' ) ); ?>"><?php _e( 'WordPress' ); ?></a></p>
  103. <?php
  104. } // end function setup_config_display_header();
  105. $language = '';
  106. if ( ! empty( $_REQUEST['language'] ) ) {
  107. $language = preg_replace( '/[^a-zA-Z0-9_]/', '', $_REQUEST['language'] );
  108. } elseif ( isset( $GLOBALS['wp_local_package'] ) ) {
  109. $language = $GLOBALS['wp_local_package'];
  110. }
  111. switch ( $step ) {
  112. case -1:
  113. if ( wp_can_install_language_pack() && empty( $language ) ) {
  114. $languages = wp_get_available_translations();
  115. if ( $languages ) {
  116. setup_config_display_header( 'language-chooser' );
  117. echo '<h1 class="screen-reader-text">Select a default language</h1>';
  118. echo '<form id="setup" method="post" action="?step=0">';
  119. wp_install_language_form( $languages );
  120. echo '</form>';
  121. break;
  122. }
  123. }
  124. // Deliberately fall through if we can't reach the translations API.
  125. case 0:
  126. if ( ! empty( $language ) ) {
  127. $loaded_language = wp_download_language_pack( $language );
  128. if ( $loaded_language ) {
  129. load_default_textdomain( $loaded_language );
  130. $GLOBALS['wp_locale'] = new WP_Locale();
  131. }
  132. }
  133. setup_config_display_header();
  134. $step_1 = 'setup-config.php?step=1';
  135. if ( isset( $_REQUEST['noapi'] ) ) {
  136. $step_1 .= '&amp;noapi';
  137. }
  138. if ( ! empty( $loaded_language ) ) {
  139. $step_1 .= '&amp;language=' . $loaded_language;
  140. }
  141. ?>
  142. <h1 class="screen-reader-text"><?php _e( 'Before getting started' ); ?></h1>
  143. <p><?php _e( 'Welcome to WordPress. Before getting started, we need some information on the database. You will need to know the following items before proceeding.' ); ?></p>
  144. <ol>
  145. <li><?php _e( 'Database name' ); ?></li>
  146. <li><?php _e( 'Database username' ); ?></li>
  147. <li><?php _e( 'Database password' ); ?></li>
  148. <li><?php _e( 'Database host' ); ?></li>
  149. <li><?php _e( 'Table prefix (if you want to run more than one WordPress in a single database)' ); ?></li>
  150. </ol>
  151. <p>
  152. <?php
  153. printf(
  154. /* translators: %s: wp-config.php */
  155. __( 'We&#8217;re going to use this information to create a %s file.' ),
  156. '<code>wp-config.php</code>'
  157. );
  158. ?>
  159. <strong>
  160. <?php
  161. printf(
  162. /* translators: 1: wp-config-sample.php, 2: wp-config.php */
  163. __( 'If for any reason this automatic file creation doesn&#8217;t work, don&#8217;t worry. All this does is fill in the database information to a configuration file. You may also simply open %1$s in a text editor, fill in your information, and save it as %2$s.' ),
  164. '<code>wp-config-sample.php</code>',
  165. '<code>wp-config.php</code>'
  166. );
  167. ?>
  168. </strong>
  169. <?php
  170. printf(
  171. /* translators: %s: Documentation URL. */
  172. __( 'Need more help? <a href="%s">We got it</a>.' ),
  173. __( 'https://wordpress.org/support/article/editing-wp-config-php/' )
  174. );
  175. ?>
  176. </p>
  177. <p><?php _e( 'In all likelihood, these items were supplied to you by your Web Host. If you don&#8217;t have this information, then you will need to contact them before you can continue. If you&#8217;re all ready&hellip;' ); ?></p>
  178. <p class="step"><a href="<?php echo $step_1; ?>" class="button button-large"><?php _e( 'Let&#8217;s go!' ); ?></a></p>
  179. <?php
  180. break;
  181. case 1:
  182. load_default_textdomain( $language );
  183. $GLOBALS['wp_locale'] = new WP_Locale();
  184. setup_config_display_header();
  185. $autofocus = wp_is_mobile() ? '' : ' autofocus';
  186. ?>
  187. <h1 class="screen-reader-text"><?php _e( 'Set up your database connection' ); ?></h1>
  188. <form method="post" action="setup-config.php?step=2">
  189. <p><?php _e( 'Below you should enter your database connection details. If you&#8217;re not sure about these, contact your host.' ); ?></p>
  190. <table class="form-table" role="presentation">
  191. <tr>
  192. <th scope="row"><label for="dbname"><?php _e( 'Database Name' ); ?></label></th>
  193. <td><input name="dbname" id="dbname" type="text" aria-describedby="dbname-desc" size="25" value="wordpress"<?php echo $autofocus; ?>/></td>
  194. <td id="dbname-desc"><?php _e( 'The name of the database you want to use with WordPress.' ); ?></td>
  195. </tr>
  196. <tr>
  197. <th scope="row"><label for="uname"><?php _e( 'Username' ); ?></label></th>
  198. <td><input name="uname" id="uname" type="text" aria-describedby="uname-desc" size="25" value="<?php echo htmlspecialchars( _x( 'username', 'example username' ), ENT_QUOTES ); ?>" /></td>
  199. <td id="uname-desc"><?php _e( 'Your database username.' ); ?></td>
  200. </tr>
  201. <tr>
  202. <th scope="row"><label for="pwd"><?php _e( 'Password' ); ?></label></th>
  203. <td><input name="pwd" id="pwd" type="text" aria-describedby="pwd-desc" size="25" value="<?php echo htmlspecialchars( _x( 'password', 'example password' ), ENT_QUOTES ); ?>" autocomplete="off" /></td>
  204. <td id="pwd-desc"><?php _e( 'Your database password.' ); ?></td>
  205. </tr>
  206. <tr>
  207. <th scope="row"><label for="dbhost"><?php _e( 'Database Host' ); ?></label></th>
  208. <td><input name="dbhost" id="dbhost" type="text" aria-describedby="dbhost-desc" size="25" value="localhost" /></td>
  209. <td id="dbhost-desc">
  210. <?php
  211. /* translators: %s: localhost */
  212. printf( __( 'You should be able to get this info from your web host, if %s doesn&#8217;t work.' ), '<code>localhost</code>' );
  213. ?>
  214. </td>
  215. </tr>
  216. <tr>
  217. <th scope="row"><label for="prefix"><?php _e( 'Table Prefix' ); ?></label></th>
  218. <td><input name="prefix" id="prefix" type="text" aria-describedby="prefix-desc" value="wp_" size="25" /></td>
  219. <td id="prefix-desc"><?php _e( 'If you want to run multiple WordPress installations in a single database, change this.' ); ?></td>
  220. </tr>
  221. </table>
  222. <?php
  223. if ( isset( $_GET['noapi'] ) ) {
  224. ?>
  225. <input name="noapi" type="hidden" value="1" /><?php } ?>
  226. <input type="hidden" name="language" value="<?php echo esc_attr( $language ); ?>" />
  227. <p class="step"><input name="submit" type="submit" value="<?php echo htmlspecialchars( __( 'Submit' ), ENT_QUOTES ); ?>" class="button button-large" /></p>
  228. </form>
  229. <?php
  230. break;
  231. case 2:
  232. load_default_textdomain( $language );
  233. $GLOBALS['wp_locale'] = new WP_Locale();
  234. $dbname = trim( wp_unslash( $_POST['dbname'] ) );
  235. $uname = trim( wp_unslash( $_POST['uname'] ) );
  236. $pwd = trim( wp_unslash( $_POST['pwd'] ) );
  237. $dbhost = trim( wp_unslash( $_POST['dbhost'] ) );
  238. $prefix = trim( wp_unslash( $_POST['prefix'] ) );
  239. $step_1 = 'setup-config.php?step=1';
  240. $install = 'install.php';
  241. if ( isset( $_REQUEST['noapi'] ) ) {
  242. $step_1 .= '&amp;noapi';
  243. }
  244. if ( ! empty( $language ) ) {
  245. $step_1 .= '&amp;language=' . $language;
  246. $install .= '?language=' . $language;
  247. } else {
  248. $install .= '?language=en_US';
  249. }
  250. $tryagain_link = '</p><p class="step"><a href="' . $step_1 . '" onclick="javascript:history.go(-1);return false;" class="button button-large">' . __( 'Try Again' ) . '</a>';
  251. if ( empty( $prefix ) ) {
  252. wp_die( __( '<strong>ERROR</strong>: "Table Prefix" must not be empty.' ) . $tryagain_link );
  253. }
  254. // Validate $prefix: it can only contain letters, numbers and underscores.
  255. if ( preg_match( '|[^a-z0-9_]|i', $prefix ) ) {
  256. wp_die( __( '<strong>ERROR</strong>: "Table Prefix" can only contain numbers, letters, and underscores.' ) . $tryagain_link );
  257. }
  258. // Test the db connection.
  259. /**#@+
  260. *
  261. * @ignore
  262. */
  263. define( 'DB_NAME', $dbname );
  264. define( 'DB_USER', $uname );
  265. define( 'DB_PASSWORD', $pwd );
  266. define( 'DB_HOST', $dbhost );
  267. /**#@-*/
  268. // Re-construct $wpdb with these new values.
  269. unset( $wpdb );
  270. require_wp_db();
  271. /*
  272. * The wpdb constructor bails when WP_SETUP_CONFIG is set, so we must
  273. * fire this manually. We'll fail here if the values are no good.
  274. */
  275. $wpdb->db_connect();
  276. if ( ! empty( $wpdb->error ) ) {
  277. wp_die( $wpdb->error->get_error_message() . $tryagain_link );
  278. }
  279. $errors = $wpdb->hide_errors();
  280. $wpdb->query( "SELECT $prefix" );
  281. $wpdb->show_errors( $errors );
  282. if ( ! $wpdb->last_error ) {
  283. // MySQL was able to parse the prefix as a value, which we don't want. Bail.
  284. wp_die( __( '<strong>ERROR</strong>: "Table Prefix" is invalid.' ) );
  285. }
  286. // Generate keys and salts using secure CSPRNG; fallback to API if enabled; further fallback to original wp_generate_password().
  287. try {
  288. $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_ []{}<>~`+=,.;:/?|';
  289. $max = strlen( $chars ) - 1;
  290. for ( $i = 0; $i < 8; $i++ ) {
  291. $key = '';
  292. for ( $j = 0; $j < 64; $j++ ) {
  293. $key .= substr( $chars, random_int( 0, $max ), 1 );
  294. }
  295. $secret_keys[] = $key;
  296. }
  297. } catch ( Exception $ex ) {
  298. $no_api = isset( $_POST['noapi'] );
  299. if ( ! $no_api ) {
  300. $secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' );
  301. }
  302. if ( $no_api || is_wp_error( $secret_keys ) ) {
  303. $secret_keys = array();
  304. for ( $i = 0; $i < 8; $i++ ) {
  305. $secret_keys[] = wp_generate_password( 64, true, true );
  306. }
  307. } else {
  308. $secret_keys = explode( "\n", wp_remote_retrieve_body( $secret_keys ) );
  309. foreach ( $secret_keys as $k => $v ) {
  310. $secret_keys[ $k ] = substr( $v, 28, 64 );
  311. }
  312. }
  313. }
  314. $key = 0;
  315. foreach ( $config_file as $line_num => $line ) {
  316. if ( '$table_prefix =' == substr( $line, 0, 15 ) ) {
  317. $config_file[ $line_num ] = '$table_prefix = \'' . addcslashes( $prefix, "\\'" ) . "';\r\n";
  318. continue;
  319. }
  320. if ( ! preg_match( '/^define\(\s*\'([A-Z_]+)\',([ ]+)/', $line, $match ) ) {
  321. continue;
  322. }
  323. $constant = $match[1];
  324. $padding = $match[2];
  325. switch ( $constant ) {
  326. case 'DB_NAME':
  327. case 'DB_USER':
  328. case 'DB_PASSWORD':
  329. case 'DB_HOST':
  330. $config_file[ $line_num ] = "define( '" . $constant . "'," . $padding . "'" . addcslashes( constant( $constant ), "\\'" ) . "' );\r\n";
  331. break;
  332. case 'DB_CHARSET':
  333. if ( 'utf8mb4' === $wpdb->charset || ( ! $wpdb->charset && $wpdb->has_cap( 'utf8mb4' ) ) ) {
  334. $config_file[ $line_num ] = "define( '" . $constant . "'," . $padding . "'utf8mb4' );\r\n";
  335. }
  336. break;
  337. case 'AUTH_KEY':
  338. case 'SECURE_AUTH_KEY':
  339. case 'LOGGED_IN_KEY':
  340. case 'NONCE_KEY':
  341. case 'AUTH_SALT':
  342. case 'SECURE_AUTH_SALT':
  343. case 'LOGGED_IN_SALT':
  344. case 'NONCE_SALT':
  345. $config_file[ $line_num ] = "define( '" . $constant . "'," . $padding . "'" . $secret_keys[ $key++ ] . "' );\r\n";
  346. break;
  347. }
  348. }
  349. unset( $line );
  350. if ( ! is_writable( ABSPATH ) ) :
  351. setup_config_display_header();
  352. ?>
  353. <p>
  354. <?php
  355. /* translators: %s: wp-config.php */
  356. printf( __( 'Sorry, but I can&#8217;t write the %s file.' ), '<code>wp-config.php</code>' );
  357. ?>
  358. </p>
  359. <p>
  360. <?php
  361. /* translators: %s: wp-config.php */
  362. printf( __( 'You can create the %s file manually and paste the following text into it.' ), '<code>wp-config.php</code>' );
  363. $config_text = '';
  364. foreach ( $config_file as $line ) {
  365. $config_text .= htmlentities( $line, ENT_COMPAT, 'UTF-8' );
  366. }
  367. ?>
  368. </p>
  369. <textarea id="wp-config" cols="98" rows="15" class="code" readonly="readonly"><?php echo $config_text; ?></textarea>
  370. <p><?php _e( 'After you&#8217;ve done that, click &#8220;Run the installation&#8221;.' ); ?></p>
  371. <p class="step"><a href="<?php echo $install; ?>" class="button button-large"><?php _e( 'Run the installation' ); ?></a></p>
  372. <script>
  373. (function(){
  374. if ( ! /iPad|iPod|iPhone/.test( navigator.userAgent ) ) {
  375. var el = document.getElementById('wp-config');
  376. el.focus();
  377. el.select();
  378. }
  379. })();
  380. </script>
  381. <?php
  382. else :
  383. /*
  384. * If this file doesn't exist, then we are using the wp-config-sample.php
  385. * file one level up, which is for the develop repo.
  386. */
  387. if ( file_exists( ABSPATH . 'wp-config-sample.php' ) ) {
  388. $path_to_wp_config = ABSPATH . 'wp-config.php';
  389. } else {
  390. $path_to_wp_config = dirname( ABSPATH ) . '/wp-config.php';
  391. }
  392. $handle = fopen( $path_to_wp_config, 'w' );
  393. foreach ( $config_file as $line ) {
  394. fwrite( $handle, $line );
  395. }
  396. fclose( $handle );
  397. chmod( $path_to_wp_config, 0666 );
  398. setup_config_display_header();
  399. ?>
  400. <h1 class="screen-reader-text"><?php _e( 'Successful database connection' ); ?></h1>
  401. <p><?php _e( 'All right, sparky! You&#8217;ve made it through this part of the installation. WordPress can now communicate with your database. If you are ready, time now to&hellip;' ); ?></p>
  402. <p class="step"><a href="<?php echo $install; ?>" class="button button-large"><?php _e( 'Run the installation' ); ?></a></p>
  403. <?php
  404. endif;
  405. break;
  406. }
  407. ?>
  408. <?php wp_print_scripts( 'language-chooser' ); ?>
  409. </body>
  410. </html>