tinywp.php

<?php
/**
 * TinyWP
 *
 * Bootstrap installer that downloads WordPress from WordPress.org.
 * Requires PHP 8.4+ on Apache or Nginx, with zip and cURL (or allow_url_fopen).
 *
 * @package TinyWP
 */

declare(strict_types=1);

/**
 * Abort with a plain-text HTTP 500 response.
 *
 * @param string $message Error message.
 * @return never
 */
function tinywp_fail( string $message ): never {
	http_response_code( 500 );
	header( 'Content-Type: text/plain; charset=utf-8' );
	echo $message;
	exit( 1 );
}

/**
 * Refuse to run on old PHP, over an existing WordPress install, or without zip plus a download method.
 *
 * @param string $dest Installation directory.
 */
function tinywp_preflight( string $dest ): void {
	if ( PHP_VERSION_ID < 80400 ) {
		tinywp_fail( 'PHP 8.4 or greater is required.' );
	}

	if ( file_exists( $dest . DIRECTORY_SEPARATOR . 'wp-includes' . DIRECTORY_SEPARATOR . 'version.php' ) ) {
		tinywp_fail( 'WordPress is already installed.' );
	}

	if ( ! extension_loaded( 'zip' ) ) {
		tinywp_fail( 'The zip PHP extension is required.' );
	}

	$allow_url_fopen = filter_var( ini_get( 'allow_url_fopen' ), FILTER_VALIDATE_BOOLEAN );
	if ( ! function_exists( 'curl_init' ) && ! $allow_url_fopen ) {
		tinywp_fail( 'cURL or allow_url_fopen is required.' );
	}
}

/**
 * Download a URL to a local file. Prefers cURL, then file_get_contents.
 *
 * @param string $url  Remote HTTPS URL.
 * @param string $dest Local destination path.
 */
function tinywp_download( string $url, string $dest ): void {
	if ( function_exists( 'curl_init' ) ) {
		$handle = curl_init( $url );
		$out    = fopen( $dest, 'wb' );
		if ( false === $handle || false === $out ) {
			tinywp_fail( 'Could not start WordPress download.' );
		}

		curl_setopt_array(
			$handle,
			array(
				CURLOPT_FILE            => $out,
				CURLOPT_FOLLOWLOCATION  => true,
				CURLOPT_PROTOCOLS       => CURLPROTO_HTTPS,
				CURLOPT_REDIR_PROTOCOLS => CURLPROTO_HTTPS,
				CURLOPT_FAILONERROR     => true,
				CURLOPT_USERAGENT       => 'TinyWP',
			)
		);

		$ok = curl_exec( $handle );
		unset( $handle );
		fclose( $out );

		if ( true !== $ok ) {
			unlink( $dest );
			tinywp_fail( 'Could not download WordPress.' );
		}

		return;
	}

	$context  = stream_context_create(
		array(
			'http' => array(
				'follow_location' => 1,
				'user_agent'      => 'TinyWP',
			),
		)
	);
	$contents = file_get_contents( $url, false, $context );
	if ( false === $contents || false === file_put_contents( $dest, $contents ) ) {
		tinywp_fail( 'Could not download WordPress.' );
	}
}

/**
 * Move directory contents into a destination, then remove emptied source folders.
 *
 * @param string $from Source directory.
 * @param string $to   Destination directory.
 */
function tinywp_move_contents( string $from, string $to ): void {
	$entries = scandir( $from );
	if ( false === $entries ) {
		tinywp_fail( 'Could not read extracted WordPress files.' );
	}

	foreach ( $entries as $entry ) {
		if ( '.' === $entry || '..' === $entry ) {
			continue;
		}

		$src  = $from . DIRECTORY_SEPARATOR . $entry;
		$dest = $to . DIRECTORY_SEPARATOR . $entry;

		if ( is_dir( $src ) ) {
			if ( ! is_dir( $dest ) && ! mkdir( $dest, 0755, true ) ) {
				tinywp_fail( 'Could not create directory.' );
			}
			tinywp_move_contents( $src, $dest );
			if ( ! rmdir( $src ) ) {
				tinywp_fail( 'Could not remove directory.' );
			}
			continue;
		}

		if ( ! rename( $src, $dest ) ) {
			tinywp_fail( 'Could not move file.' );
		}
	}
}

/**
 * Extract latest.zip and flatten the wordpress/ prefix into $dest.
 *
 * ZipArchive is used here because PHP has no procedural zip API.
 *
 * @param string $zip_path Path to wordpress.zip.
 * @param string $dest     Installation directory.
 */
function tinywp_extract( string $zip_path, string $dest ): void {
	$zip = new ZipArchive();
	if ( true !== $zip->open( $zip_path ) ) {
		tinywp_fail( 'Could not open WordPress zip.' );
	}

	for ( $i = 0; $i < $zip->numFiles; $i++ ) {
		$name = $zip->getNameIndex( $i );
		if ( false === $name || str_contains( $name, '..' ) ) {
			$zip->close();
			tinywp_fail( 'Invalid path in WordPress zip.' );
		}
	}

	if ( true !== $zip->extractTo( $dest ) ) {
		$zip->close();
		tinywp_fail( 'Could not extract WordPress zip.' );
	}
	$zip->close();

	$wordpress_dir = $dest . DIRECTORY_SEPARATOR . 'wordpress';
	if ( ! is_dir( $wordpress_dir ) ) {
		tinywp_fail( 'WordPress zip did not contain a wordpress directory.' );
	}

	tinywp_move_contents( $wordpress_dir, $dest );

	if ( ! rmdir( $wordpress_dir ) ) {
		tinywp_fail( 'Could not remove wordpress directory.' );
	}
}

set_time_limit( 0 );

$dest     = __DIR__;
$zip_path = $dest . DIRECTORY_SEPARATOR . 'wordpress.zip';

tinywp_preflight( $dest );
tinywp_download( 'https://wordpress.org/latest.zip', $zip_path );
tinywp_extract( $zip_path, $dest );

unlink( $zip_path );
unlink( __FILE__ );

header( 'Location: ./wp-admin/setup-config.php', true, 302 );
exit;