Mini Update Server Plugin

// Define our plugin version
if ( ! defined( 'EXAMPLE_PLUGIN_VERSION' ) ) {
    define( 'EXAMPLE_PLUGIN_VERSION', '1.11' );
}

add_action( 'plugins_loaded', function() {
    $updater_config = [
        'plugin_file' => plugin_basename( __FILE__ ),
        'slug'        => 'example-plugin',
        'name'        => 'Example Plugin',
        'version'     => EXAMPLE_PLUGIN_VERSION,
        'key'         => 'testkey123',                     // your updater key
        'server'      => 'https://delighted-crocodile-de1708.instawp.xyz/',
    ];

    // Include the UUPD drop‑in (copy updater.php into inc/updater.php)
    require_once __DIR__ . '/inc/updater.php';
    new UUPD_Updater( $updater_config );
} );

<?php
/**
 * Plugin Name: UUPD Server
 * Description: Provides a custom post type and secure file download or remote redirect for Universal Updater (UUPD_Updater), with placeholder support and referer-based domain detection.
 * Version: 1.0.1
 * Author: Stingray82
 * Text Domain: uupd-server
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

class UUPD_Server {
    const TOKEN_EXPIRY = 3600;

    public function __construct() {
        add_action( 'init', [ $this, 'register_cpt' ] );
        add_action( 'add_meta_boxes', [ $this, 'add_meta_boxes' ] );
        add_action( 'save_post_update', [ $this, 'save_meta' ], 10, 2 );
        add_action( 'admin_enqueue_scripts', [ $this, 'enqueue_media' ] );
        add_action( 'template_redirect', [ $this, 'handle_requests' ] );
    }

    public function register_cpt() {
        register_post_type( 'update', [
            'label'    => __( 'Updates', 'uupd-server' ),
            'public'   => false,
            'show_ui'  => true,
            'supports' => [ 'title' ],
        ] );
    }

    public function add_meta_boxes() {
        add_meta_box( 'uupd_meta', __( 'Update Details', 'uupd-server' ), [ $this, 'render_meta_box' ], 'update', 'normal', 'default' );
    }

    public function render_meta_box( $post ) {
        wp_nonce_field( 'uupd_save', 'uupd_nonce' );
        $m = get_post_meta( $post->ID );
        foreach ( [ 'slug','version','tested','requires','homepage','remote_url' ] as $f ) {
            $$f = $m[ $f ][0] ?? '';
        }
        $changelog = $m['changelog_html'][0] ?? '';
        $attachment_id = intval( $m['file_id'][0] ?? 0 );
        ?>
        <table class="form-table">
            <?php foreach ( [ 'slug','version','tested','requires','homepage','remote_url' ] as $f ): ?>
            <tr>
                <th><label for="uupd_<?php echo $f; ?>"><?php echo ucfirst( str_replace('_',' ', $f) ); ?></label></th>
                <td><input type="text" id="uupd_<?php echo $f; ?>" name="uupd_<?php echo $f; ?>" value="<?php echo esc_attr( $$f ); ?>" class="regular-text"></td>
            </tr>
            <?php endforeach; ?>
            <tr>
                <th><label for="uupd_changelog_html"><?php _e( 'Changelog', 'uupd-server' ); ?></label></th>
                <td><?php wp_editor( $changelog, 'uupd_changelog_html', [ 'textarea_name' => 'uupd_changelog_html', 'textarea_rows' => 10 ] ); ?></td>
            </tr>
            <tr>
                <th><label><?php _e( 'File', 'uupd-server' ); ?></label></th>
                <td>
                    <input type="hidden" id="uupd_file_id" name="uupd_file_id" value="<?php echo $attachment_id; ?>" />
                    <button type="button" class="button" id="uupd_file_button"><?php _e( 'Select or Upload File', 'uupd-server' ); ?></button>
                    <p class="description" id="uupd_file_name"><?php echo $attachment_id ? esc_html( get_the_title( $attachment_id ) ) : ''; ?></p>
                </td>
            </tr>
        </table>
        <p><?php _e( 'Remote URL may include {slug}, {key}, {domain} placeholders and takes precedence if set.', 'uupd-server' ); ?></p>
        <?php
    }

    public function enqueue_media() {
        global $post;
        if ( $post && $post->post_type === 'update' ) {
            wp_enqueue_media();
            wp_add_inline_script( 'jquery', "jQuery(function($){var frame;$('#uupd_file_button').on('click',function(e){e.preventDefault();if(frame)frame.open();else{frame=wp.media({title:'Select File',button:{text:'Use this file'},multiple:false});frame.on('select',function(){var a=frame.state().get('selection').first().toJSON();$('#uupd_file_id').val(a.id);$('#uupd_file_name').text(a.filename);});frame.open();}});});" );
        }
    }

    public function save_meta( $post_id, $post ) {
        if ( ! isset( $_POST['uupd_nonce'] ) || ! wp_verify_nonce( $_POST['uupd_nonce'], 'uupd_save' ) ) return;
        foreach ( [ 'slug','version','tested','requires','homepage','remote_url' ] as $f ) {
            if ( isset( $_POST['uupd_' . $f] ) )
                update_post_meta( $post_id, $f, sanitize_text_field( $_POST['uupd_' . $f] ) );
        }
        if ( isset( $_POST['uupd_changelog_html'] ) )
            update_post_meta( $post_id, 'changelog_html', wp_kses_post( $_POST['uupd_changelog_html'] ) );
        if ( isset( $_POST['uupd_file_id'] ) )
            update_post_meta( $post_id, 'file_id', intval( $_POST['uupd_file_id'] ) );
        update_post_meta( $post_id, 'last_updated', current_time( 'mysql' ) );
    }

    public function handle_requests() {
        $action = $_GET['action'] ?? '';
        if ( $action === 'get_metadata' ) {
            $this->output_metadata();
        } elseif ( $action === 'download' ) {
            $this->serve_download();
        }
    }

    private function output_metadata() {
        $slug   = sanitize_text_field( $_GET['slug']   ?? '' );
        $key    = sanitize_text_field( $_GET['key']    ?? '' );

        // Domain: explicit > referer host > server host
        if ( ! empty( $_GET['domain'] ) ) {
            $domain = sanitize_text_field( $_GET['domain'] );
        } elseif ( ! empty( $_SERVER['HTTP_REFERER'] ) ) {
            $ref = wp_parse_url( $_SERVER['HTTP_REFERER'], PHP_URL_HOST );
            $domain = $ref ?: sanitize_text_field( $_SERVER['HTTP_HOST'] ?? '' );
        } else {
            $domain = sanitize_text_field( $_SERVER['HTTP_HOST'] ?? '' );
        }

        $posts = get_posts([ 'post_type'=>'update','meta_key'=>'slug','meta_value'=>$slug ]);
        if ( ! $posts ) wp_send_json_error('Invalid slug',404);
        $post = $posts[0];

        $meta = [];
        foreach([ 'slug','version','tested','requires','homepage','changelog_html','last_updated' ] as $f ) {
            $meta[ $f ] = get_post_meta( $post->ID, $f, true ) ?: '';
        }

        $remote = get_post_meta( $post->ID, 'remote_url', true );
        if ( $remote ) {
            $meta['download_url'] = $this->build_remote_url( $remote, $slug, $key, $domain );
        } else {
            $file_id = get_post_meta( $post->ID,'file_id',true );
            if ( $file_id ) {
                $expires = time() + self::TOKEN_EXPIRY;
                $data    = "{$slug}|{$file_id}|{$expires}";
                $token   = hash_hmac('sha256',$data,AUTH_KEY);
                $meta['download_url'] = esc_url_raw( add_query_arg([
                    'action'=>'download', 'slug'=>$slug, 'expires'=>$expires,
                    'token'=>$token, 'key'=>$key, 'domain'=>$domain,
                ], site_url('/') ) );
            }
        }

        header('Content-Type: application/json; charset=UTF-8');
        $json = wp_json_encode( $meta, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE );
        $json = str_replace(['<','>'], ['<','>'], $json);
        echo $json;
        exit;
    }

    private function build_remote_url( $template, $slug, $key, $domain ) {
        $replacements = [
            '{slug}'   => rawurlencode( $slug ),
            '{key}'    => rawurlencode( $key ),
            '{domain}' => rawurlencode( $domain ),
        ];
        return esc_url_raw( strtr( $template, $replacements ) );
    }

    private function serve_download() {
        $slug    = sanitize_text_field($_GET['slug']??'');
        $expires = intval($_GET['expires']??0);
        $token   = sanitize_text_field($_GET['token']??'');
        if ( time() > $expires ) wp_die('Download link expired',403);
        $posts = get_posts(['post_type'=>'update','meta_key'=>'slug','meta_value'=>$slug]);
        if ( ! $posts ) wp_die('Invalid slug',404);
        $post = $posts[0];
        $file_id = get_post_meta($post->ID,'file_id',true);
        if ( ! $file_id ) wp_die('No file available',404);
        $data = "{$slug}|{$file_id}|{$expires}";
        if ( ! hash_equals(hash_hmac('sha256',$data,AUTH_KEY),$token) ) wp_die('Invalid token',403);
        $file = get_attached_file($file_id);
        if ( ! file_exists($file) ) wp_die('File not found',404);
        header('Content-Description: File Transfer');
        header('Content-Type: application/octet-stream');
        header('Content-Disposition: attachment; filename="'.basename($file).'"');
        header('Expires: 0');header('Cache-Control: must-revalidate');header('Pragma: public');
        header('Content-Length: '.filesize($file));
        readfile($file);exit;
    }
}

new UUPD_Server();