Use download_url() to download language packs

[swissspidy]

Background: https://wordpress.slack.com/archives/C02RP4T41/p1517951327000586

I was tweaking WordPress a bit to download some language packs from another local site. Since I used self-signed certificates, I added the following lines to disable certificate verification:

add_filter( 'https_ssl_verify', '__return_false' );
add_filter( 'https_local_ssl_verify', '__return_false' );

This works when using the WordPress admin UI, but not when running wp language core update (which btw shouldn't update plugin translations, see #20). This is because since f45cec689c38411c6f05b7eef5bd8d6900d4db10 the command uses \ LanguagePackUpgrader::download_package() (and ultimately \WP_CLI\Utils\http_request()) to download packages (vs. download_url() in core) and this call can't be filtered.

Suggestion: Use download_url() so the same filters are available.

We can still pass the same HTTP options, so there shouldn't be any back compat issues.

[schlessera]

Currently wondering what approach would be preferable:

• Use download_url() so that filters work, as you suggested.
• Add a --skip-ssl-verify flag so that you can directly control this from the command line.

[swissspidy]

Maybe both?

At first glance download_url() does a few things differently:

• Uses wp_tempnam() to create a temporary file (vs. \WP_CLI\Utils\get_temp_dir())
• Has a lower timeout (300 vs. 600)
• Sets stream to true when making the HTTP request
• Verifies the Content-MD5 header if present and abandons the file if the hashes don't match.

--skip-ssl-verify could be useful for other commands as well, but I'm sure there's a better way to make global HTTP options possible.

[swissspidy]

\WP_CLI\Utils\get_temp_dir() obviously makes more sense than wp_tempnam().

Content-MD5 header verification would be handy though. Not sure about the implications of changing the other two options.

[swissspidy]

Doesn't look like any Content-MD5 is sent when download translations.

\WP_CLI\Utils\get_temp_dir() obviously makes more sense than wp_tempnam().

The caching happens later on separetly in the language pack upgrader, so I'm not sure if this would really make a huge difference.