public function downloadPlugin($name, $url, $signature) { if (is_dir(ipFile("Plugin/{$name}/"))) { Service::deactivatePlugin($name); Helper::removeDir(ipFile("Plugin/{$name}/")); } //download plugin $net = new \Ip\Internal\NetHelper(); $pluginTempFilename = $net->downloadFile($url, ipFile('file/secure/tmp/'), $name . '.zip'); if (!$pluginTempFilename) { throw new \Ip\Exception('Plugin file download failed.'); } $archivePath = ipFile('file/secure/tmp/' . $pluginTempFilename); //check signature $fileMd5 = md5_file($archivePath); $rsa = new \Crypt_RSA(); $rsa->loadKey($this->publicKey); $rsa->setSignatureMode(CRYPT_RSA_SIGNATURE_PKCS1); $verified = $rsa->verify($fileMd5, base64_decode($signature)); if (!$verified) { throw new \Ip\Exception('Plugin signature verification failed.'); } //extract $secureTmpDir = ipFile('file/secure/tmp/'); $tmpExtractedDir = \Ip\Internal\File\Functions::genUnoccupiedName($name, $secureTmpDir); \Ip\Internal\Helper\Zip::extract($secureTmpDir . $pluginTempFilename, $secureTmpDir . $tmpExtractedDir); unlink($archivePath); //install $extractedDir = $this->getFirstDir($secureTmpDir . $tmpExtractedDir); $installDir = Model::pluginInstallDir(); $newPluginDir = \Ip\Internal\File\Functions::genUnoccupiedName($name, $installDir); rename($secureTmpDir . $tmpExtractedDir . '/' . $extractedDir, $installDir . $newPluginDir); Service::activatePlugin($name); }