Skip to main content

FluentCart 🚀

#Bug Report

Plugin Updates Fail on Sites with Port Numbers in URL

FluentCart Pro (tested January 11th, 2026)

Summary:
The download_license_package endpoint fails with "Product not found" error when the site URL contains a port number (e.g., localhost:10004).

Steps to Reproduce:

  1. Set up a licensed digital product with plugin updates enabled
  2. Install and activate the plugin on a local dev site with a port in the URL (e.g., http://localhost:10004)
  3. Activate the license successfully
  4. Trigger an update check - update is detected correctly
  5. Click "Update Now" - fails with "Download failed. Unprocessable Entity"

Root Cause:
In LicenseApiHandler.php, the downloadLicensePackage() method decodes the fct_package parameter and splits it using : as the delimiter:

$packageData = explode(':', $packageData);

The package format is: license_key:activation_hash:site_url:item_id:expires

When the site URL contains a port (e.g., localhost:10004), the colon in the URL breaks the parsing:

  • Expected: item_id at index 3
  • Actual: Port number (10004) ends up at index 3, causing product lookup to fail

Workaround:
Test on domains without port numbers. Production sites work fine.

Suggested Fix:
Use a delimiter that won't appear in URLs (e.g., || or :::), or URL-encode the site_url before building the package string.

  • 3 comments

Shahjahan Jewel

Noted. Looks like we did not take consideration with port number for local env.

Jeff Mapes

Shahjahan Jewel I test everything locally before going live. In most cases, it's a fair test, but discovered this one only fails locally but I tested on live site and had no problems, so that is more important.

Vivek Kumar

Shahjahan Jewel  A Similar Bug We investigated where a WordPress plugin update failed with the error on Prod site also:

PCLZIP_ERR_BAD_FORMAT (-10): Invalid End of Central Dir Record

What we observed:

  • The ZIP file was valid on the server and downloaded correctly from the file manager/FTP.
  • The same ZIP became corrupted only when downloaded through a PHP endpoint.
  • WordPress plugin updates failed, while browsers sometimes still downloaded the file.

Root cause:
The problem was not the ZIP file itself, but how it was being served.

The download handler was using code similar to:

$wp_filesystem->get_contents($file);
echo $content;

This approach is not binary-safe for files like ZIP archives. Depending on the filesystem driver, output buffering, compression (gzip/zlib), or memory handling, the file contents can be altered. Even a single modified byte is enough to corrupt a ZIP file, which causes WordPress (PclZip) to reject it.

Suggested Fix:
In the License.php file during download Instead of reading the file into memory and echoing it, the file can be streamed directly to the client.

A safe approach could be :

  • Clear all output buffers
  • Disable output compression and error display
  • Stream the file using readfile()
  • Exit immediately after streaming

Using readfile() ensures the file is sent as raw binary data without modification, which prevents corruption and allows WordPress plugin updates to work correctly.

Apart from these request to add some custom variable (e.g SKU, custom id etc )during product creation which can also be linked in the webhook integration to trigger any action on that product only is also requested .

Any other suggestion to cater this error [ Update failed: The package could not be installed. PCLZIP_ERR_BAD_FORMAT (-10) : Invalid End of Central Dir Record ]in prod is most welcome .