From a6a904ef1542e7f18108489690d3ec7d4b0cc2a9 Mon Sep 17 00:00:00 2001
From: HostForge Systems <systems@hostforge.cloud>
Date: Sat, 18 Apr 2026 11:45:23 +0800
Subject: [PATCH] fix(mu-plugins): strengthen HostForge core management
 behavior and refresh admin update state

---
 .../CoreUpdates/Disable_Core_Updates.php      | 79 +++++++++++--------
 1 file changed, 48 insertions(+), 31 deletions(-)

diff --git a/code/wp-content/mu-plugins/hostforge-systems/src/Modules/CoreUpdates/Disable_Core_Updates.php b/code/wp-content/mu-plugins/hostforge-systems/src/Modules/CoreUpdates/Disable_Core_Updates.php
index 7dbc57ec23..6473edbbb7 100644
--- a/code/wp-content/mu-plugins/hostforge-systems/src/Modules/CoreUpdates/Disable_Core_Updates.php
+++ b/code/wp-content/mu-plugins/hostforge-systems/src/Modules/CoreUpdates/Disable_Core_Updates.php
@@ -34,52 +34,40 @@ class Disable_Core_Updates implements Module_Interface
 		add_filter('site_transient_update_core', [$this, 'filter_core_update_transient']);
 		add_filter('pre_set_site_transient_update_core', [$this, 'filter_core_update_transient']);
 
-		add_action('admin_init', [$this, 'remove_core_update_nag']);
-		add_action('admin_init', [$this, 'clear_existing_core_update_transient']);
-		add_action('admin_menu', [$this, 'remove_update_core_submenu'], 999);
-		add_action('admin_notices', [$this, 'render_dashboard_notice']);
+		add_action('admin_init', [$this, 'clear_core_update_transient'], 1);
+		add_action('admin_init', [$this, 'remove_core_update_nag'], 1);
+		add_action('admin_init', [$this, 'maybe_redirect_updates_screen'], 1);
+
+		add_action('admin_menu', [$this, 'remove_updates_submenu'], 999);
+		add_action('admin_notices', [$this, 'render_admin_notice']);
 	}
 
 	/**
-	 * Return an empty core update response.
+	 * Force an empty WordPress core update response.
 	 *
 	 * @param mixed $transient Existing transient value.
 	 * @return \stdClass
 	 */
 	public function filter_core_update_transient($transient): stdClass
 	{
-		$current_version = get_bloginfo('version');
-
 		$clean = new stdClass();
 		$clean->updates = [];
-		$clean->version_checked = $current_version;
+		$clean->version_checked = get_bloginfo('version');
 		$clean->last_checked = time();
-
-		if (isset($transient->translations) && is_array($transient->translations)) {
-			$clean->translations = $transient->translations;
-		} else {
-			$clean->translations = [];
-		}
+		$clean->translations = [];
 
 		return $clean;
 	}
 
 	/**
-	 * Remove the default WordPress core update nag.
+	 * Clear any cached WordPress core update transient.
+	 *
+	 * This runs on every admin request so stale update data
+	 * does not continue to appear in wp-admin.
 	 *
 	 * @return void
 	 */
-	public function remove_core_update_nag(): void
-	{
-		remove_action('admin_notices', 'update_nag', 3);
-	}
-
-	/**
-	 * Clear any previously cached core update transient.
-	 *
-	 * @return void
-	 */
-	public function clear_existing_core_update_transient(): void
+	public function clear_core_update_transient(): void
 	{
 		if (! is_admin()) {
 			return;
@@ -89,26 +77,53 @@ class Disable_Core_Updates implements Module_Interface
 	}
 
 	/**
-	 * Remove the WordPress Updates submenu.
+	 * Remove the default WordPress update nag.
 	 *
 	 * @return void
 	 */
-	public function remove_update_core_submenu(): void
+	public function remove_core_update_nag(): void
 	{
-		if (! current_user_can('update_core')) {
+		remove_action('admin_notices', 'update_nag', 3);
+	}
+
+	/**
+	 * Redirect users away from the WordPress Updates screen.
+	 *
+	 * @return void
+	 */
+	public function maybe_redirect_updates_screen(): void
+	{
+		if (! is_admin()) {
 			return;
 		}
 
+		global $pagenow;
+
+		if ($pagenow !== 'update-core.php') {
+			return;
+		}
+
+		wp_safe_redirect(admin_url());
+		exit;
+	}
+
+	/**
+	 * Remove the Updates submenu from wp-admin.
+	 *
+	 * @return void
+	 */
+	public function remove_updates_submenu(): void
+	{
 		remove_submenu_page('index.php', 'update-core.php');
 		remove_submenu_page('options-general.php', 'update-core.php');
 	}
 
 	/**
-	 * Render a HostForge notice on dashboard and update-related screens.
+	 * Render a HostForge notice in wp-admin.
 	 *
 	 * @return void
 	 */
-	public function render_dashboard_notice(): void
+	public function render_admin_notice(): void
 	{
 		if (! is_admin()) {
 			return;
@@ -122,6 +137,8 @@ class Disable_Core_Updates implements Module_Interface
 
 		$allowed_screens = [
 			'dashboard',
+			'plugins',
+			'themes',
 			'update-core',
 		];