PluginProbe
Jetpack – WP Security, Backup, Speed, & Growth / 16.3-a.1
Jetpack – WP Security, Backup, Speed, & Growth v16.3-a.1
16.3-a.3 16.3-a.1 16.2 16.2-beta 12.0.3 12.1.3 12.2.3 12.3.2 12.4.2 12.5.2 12.6.4 12.7.3 12.8.3 12.9.5 13.0.2 13.1.5 13.2.4 13.3.3 13.4.5 13.5.2 13.6.2 13.7.2 13.8.3 13.9.2 14.0.1 All 504 releases
jetpack / json-endpoints / class.wpcom-json-api-site-settings-endpoint.php

class.wpcom-json-api-site-settings-endpoint.php in Jetpack – WP Security, Backup, Speed, & Growth 16.3-a.1, at json-endpoints/class.wpcom-json-api-site-settings-endpoint.php

1,597 lines 67.4 KB
No matching file
Up and down to move Enter to open Esc to close
Raw Download Zip
1 <?php // phpcs:ignore WordPress.Files.FileName.InvalidClassFileName
2 /**
3 * Manage settings via the WordPress.com REST API.
4 *
5 * @package automattic/jetpack
6 */
7
8 use Automattic\Jetpack\Waf\Brute_Force_Protection\Brute_Force_Protection_Shared_Functions;
9
10 if ( ! defined( 'ABSPATH' ) ) {
11 exit( 0 );
12 }
13
14 new WPCOM_JSON_API_Site_Settings_Endpoint(
15 array(
16 'description' => 'Get detailed settings information about a site.',
17 'group' => '__do_not_document',
18 'stat' => 'sites:X',
19 'max_version' => '1.1',
20 'new_version' => '1.2',
21 'method' => 'GET',
22 'path' => '/sites/%s/settings',
23 'path_labels' => array(
24 '$site' => '(int|string) Site ID or domain',
25 ),
26
27 'query_parameters' => array(
28 'context' => false,
29 ),
30
31 'response_format' => WPCOM_JSON_API_Site_Settings_Endpoint::$site_format,
32
33 'example_request' => 'https://public-api.wordpress.com/rest/v1/sites/en.blog.wordpress.com/settings',
34 )
35 );
36
37 new WPCOM_JSON_API_Site_Settings_Endpoint(
38 array(
39 'description' => 'Update settings for a site.',
40 'group' => '__do_not_document',
41 'stat' => 'sites:X',
42 'max_version' => '1.1',
43 'new_version' => '1.2',
44 'method' => 'POST',
45 'path' => '/sites/%s/settings',
46 'a_new_very_long_key' => 'blabla',
47 'path_labels' => array(
48 '$site' => '(int|string) Site ID or domain',
49 ),
50
51 'request_format' => array(
52 'migration_source_site_domain' => '(string) The source site URL, from the migration flow',
53 'in_site_migration_flow' => '(string) The migration flow the site is in',
54 'blogname' => '(string) Blog name',
55 'blogdescription' => '(string) Blog description',
56 'default_pingback_flag' => '(bool) Notify blogs linked from article?',
57 'default_ping_status' => '(bool) Allow link notifications from other blogs?',
58 'default_comment_status' => '(bool) Allow comments on new articles?',
59 'blog_public' => '(string) Site visibility; -1: private, 0: discourage search engines, 1: allow search engines',
60 'wpcom_data_sharing_opt_out' => '(bool) Did the site opt out of sharing public content with third parties and research partners?',
61 'jetpack_sync_non_public_post_stati' => '(bool) allow sync of post and pages with non-public posts stati',
62 'jetpack_relatedposts_enabled' => '(bool) Enable related posts?',
63 'jetpack_relatedposts_show_context' => '(bool) Show post\'s tags and category in related posts?',
64 'jetpack_relatedposts_show_date' => '(bool) Show date in related posts?',
65 'jetpack_relatedposts_show_headline' => '(bool) Show headline in related posts?',
66 'jetpack_relatedposts_show_thumbnails' => '(bool) Show thumbnails in related posts?',
67 'jetpack_protect_whitelist' => '(array) List of IP addresses to always allow',
68 'instant_search_enabled' => '(bool) Enable the new Jetpack Instant Search interface',
69 'jetpack_search_enabled' => '(bool) Enable Jetpack Search',
70 'jetpack_search_supported' => '(bool) Jetpack Search is supported',
71 'infinite_scroll' => '(bool) Support infinite scroll of posts?',
72 'default_category' => '(int) Default post category',
73 'default_post_format' => '(string) Default post format',
74 'require_name_email' => '(bool) Require comment authors to fill out name and email?',
75 'comment_registration' => '(bool) Require users to be registered and logged in to comment?',
76 'close_comments_for_old_posts' => '(bool) Automatically close comments on old posts?',
77 'close_comments_days_old' => '(int) Age at which to close comments',
78 'thread_comments' => '(bool) Enable threaded comments?',
79 'thread_comments_depth' => '(int) Depth to thread comments',
80 'page_comments' => '(bool) Break comments into pages?',
81 'comments_per_page' => '(int) Number of comments to display per page',
82 'default_comments_page' => '(string) newest|oldest Which page of comments to display first',
83 'comment_order' => '(string) asc|desc Order to display comments within page',
84 'comments_notify' => '(bool) Email me when someone comments?',
85 'moderation_notify' => '(bool) Email me when a comment is helf for moderation?',
86 'social_notifications_like' => '(bool) Email me when someone likes my post?',
87 'social_notifications_reblog' => '(bool) Email me when someone reblogs my post?',
88 'social_notifications_subscribe' => '(bool) Email me when someone subscribes to my blog?',
89 'comment_moderation' => '(bool) Moderate comments for manual approval?',
90 'comment_previously_approved' => '(bool) Moderate comments unless author has a previously-approved comment?',
91 'comment_max_links' => '(int) Moderate comments that contain X or more links',
92 'moderation_keys' => '(string) Words or phrases that trigger comment moderation, one per line',
93 'disallowed_keys' => '(string) Words or phrases that mark comment spam, one per line',
94 'lang_id' => '(int) ID for language blog is written in',
95 'wga' => '(array) Google Analytics Settings',
96 'disabled_likes' => '(bool) Are likes globally disabled (they can still be turned on per post)?',
97 'disabled_reblogs' => '(bool) Are reblogs disabled on posts?',
98 'jetpack_comment_likes_enabled' => '(bool) Are comment likes enabled for all comments?',
99 'sharing_button_style' => '(string) Style to use for sharing buttons (icon-text, icon, text, or official)',
100 'sharing_label' => '(string) Label to use for sharing buttons, e.g. "Share this:"',
101 'sharing_show' => '(string|array:string) Post type or array of types where sharing buttons are to be displayed',
102 'sharing_open_links' => '(string) Link target for sharing buttons (same or new)',
103 'twitter_via' => '(string) Twitter username to include in tweets when people share using the Twitter button',
104 'jetpack-twitter-cards-site-tag' => '(string) The Twitter username of the owner of the site\'s domain.',
105 'eventbrite_api_token' => '(int) The Keyring token ID for an Eventbrite token to associate with the site',
106 'timezone_string' => '(string) PHP-compatible timezone string like \'UTC-5\'',
107 'gmt_offset' => '(int) Site offset from UTC in hours',
108 'date_format' => '(string) PHP Date-compatible date format',
109 'time_format' => '(string) PHP Date-compatible time format',
110 'start_of_week' => '(int) Starting day of week (0 = Sunday, 6 = Saturday)',
111 'jetpack_testimonial' => '(bool) Whether testimonial custom post type is enabled for the site',
112 'jetpack_testimonial_posts_per_page' => '(int) Number of testimonials to show per page',
113 'jetpack_portfolio' => '(bool) Whether portfolio custom post type is enabled for the site',
114 'jetpack_portfolio_posts_per_page' => '(int) Number of portfolio projects to show per page',
115 Jetpack_SEO_Utils::FRONT_PAGE_META_OPTION => '(string) The seo meta description for the site.',
116 Jetpack_SEO_Titles::TITLE_FORMATS_OPTION => '(array) SEO meta title formats. Allowed keys: front_page, posts, pages, groups, archives',
117 'verification_services_codes' => '(array) Website verification codes. Allowed keys: google, pinterest, bing, yandex, facebook',
118 'markdown_supported' => '(bool) Whether markdown is supported for this site',
119 'wpcom_publish_posts_with_markdown' => '(bool) Whether markdown is enabled for posts',
120 'wpcom_publish_comments_with_markdown' => '(bool) Whether markdown is enabled for comments',
121 'site_icon' => '(int) Media attachment ID to use as site icon. Set to zero or an otherwise empty value to clear',
122 'api_cache' => '(bool) Turn on/off the Jetpack JSON API cache',
123 'posts_per_page' => '(int) Number of posts to show on blog pages',
124 'posts_per_rss' => '(int) Number of posts to show in the RSS feed',
125 'rss_use_excerpt' => '(bool) Whether the RSS feed will use post excerpts',
126 'launchpad_screen' => '(string) Whether or not launchpad is presented and what size it will be',
127 'sm_enabled' => '(bool) Whether the newsletter subscribe modal is enabled',
128 'jetpack_subscribe_overlay_enabled' => '(bool) Whether the newsletter subscribe overlay is enabled',
129 'jetpack_subscribe_floating_button_enabled' => '(bool) Whether the newsletter floating subscribe button is enabled',
130 'jetpack_subscriptions_subscribe_post_end_enabled' => '(bool) Whether the Subscribe block at the end of each post placement is enabled',
131 'jetpack_subscriptions_login_navigation_enabled' => '(bool) Whether the Subscriber Login block navigation placement is enabled',
132 'jetpack_subscriptions_subscribe_navigation_enabled' => '(Bool) Whether the Subscribe block navigation placement is enabled',
133 'wpcom_ai_site_prompt' => '(string) User input in the AI site prompt',
134 'jetpack_waf_automatic_rules' => '(bool) Whether the WAF should enforce automatic firewall rules',
135 'jetpack_waf_ip_allow_list' => '(string) List of IP addresses to always allow',
136 'jetpack_waf_ip_allow_list_enabled' => '(bool) Whether the IP allow list is enabled',
137 'jetpack_waf_ip_block_list' => '(string) List of IP addresses the WAF should always block',
138 'jetpack_waf_ip_block_list_enabled' => '(bool) Whether the IP block list is enabled',
139 'jetpack_waf_share_data' => '(bool) Whether the WAF should share basic data with Jetpack',
140 'jetpack_waf_share_debug_data' => '(bool) Whether the WAF should share debug data with Jetpack',
141 'jetpack_waf_automatic_rules_last_updated_timestamp' => '(int) Timestamp of the last time the automatic rules were updated',
142 'mcp_abilities' => '(array) List of MCP Abilities',
143 ),
144
145 'response_format' => array(
146 'updated' => '(array)',
147 ),
148
149 'example_request' => 'https://public-api.wordpress.com/rest/v1/sites/en.blog.wordpress.com/settings',
150 )
151 );
152
153 /**
154 * Manage Site settings endpoint.
155 *
156 * @phan-constructor-used-for-side-effects
157 */
158 class WPCOM_JSON_API_Site_Settings_Endpoint extends WPCOM_JSON_API_Endpoint {
159
160 /**
161 * Site format.
162 *
163 * @var array
164 */
165 public static $site_format = array(
166 'ID' => '(int) Site ID',
167 'name' => '(string) Title of site',
168 'description' => '(string) Tagline or description of site',
169 'URL' => '(string) Full URL to the site',
170 'lang' => '(string) Primary language code of the site',
171 'locale_variant' => '(string) Locale variant code for the site, if set',
172 'settings' => '(array) An array of options/settings for the blog. Only viewable by users with post editing rights to the site.',
173 );
174
175 /**
176 * Endpoint response
177 *
178 * GET /sites/%s/settings
179 * POST /sites/%s/settings
180 *
181 * @param string $path Path.
182 * @param int $blog_id Blog ID.
183 */
184 public function callback( $path = '', $blog_id = 0 ) {
185 $blog_id = $this->api->switch_to_blog_and_validate_user( $this->api->get_blog_id( $blog_id ) );
186 if ( is_wp_error( $blog_id ) ) {
187 return $blog_id;
188 }
189
190 if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
191 // Source & include the infinite scroll compatibility files prior to loading theme functions.
192 add_filter( 'restapi_theme_action_copy_dirs', array( 'WPCOM_JSON_API_Site_Settings_Endpoint', 'wpcom_restapi_copy_theme_plugin_actions' ) );
193 $this->load_theme_functions();
194 }
195
196 if ( ! is_user_logged_in() ) {
197 return new WP_Error( 'Unauthorized', 'You must be logged-in to manage settings.', 401 );
198 } elseif ( ! current_user_can( 'manage_options' ) ) {
199 return new WP_Error( 'Forbidden', 'You do not have the capability to manage settings for this site.', 403 );
200 }
201
202 if ( 'GET' === $this->api->method ) {
203 /**
204 * Fires on each GET request to a specific endpoint.
205 *
206 * @module json-api
207 *
208 * @since 3.2.0
209 *
210 * @param string sites.
211 */
212 do_action( 'wpcom_json_api_objects', 'sites' );
213 return $this->get_settings_response();
214 } elseif ( 'POST' === $this->api->method ) {
215 return $this->update_settings();
216 } else {
217 return new WP_Error( 'bad_request', 'An unsupported request method was used.' );
218 }
219 }
220
221 /**
222 * Includes additional theme-specific files to be included in REST API theme
223 * context loading action copying.
224 *
225 * @see WPCOM_JSON_API_Endpoint#load_theme_functions
226 * @see the_neverending_home_page_theme_support
227 *
228 * @param array $copy_dirs Array of files to be included in theme context.
229 */
230 public static function wpcom_restapi_copy_theme_plugin_actions( $copy_dirs ) {
231 $theme_name = get_stylesheet();
232 $default_file_name = WP_CONTENT_DIR . "/mu-plugins/infinity/themes/{$theme_name}.php";
233
234 /**
235 * Filter the path to the Infinite Scroll compatibility file.
236 *
237 * @module infinite-scroll
238 *
239 * @since 2.0.0
240 *
241 * @param string $str IS compatibility file path.
242 * @param string $theme_name Theme name.
243 */
244 $customization_file = apply_filters( 'infinite_scroll_customization_file', $default_file_name, $theme_name );
245
246 if ( is_readable( $customization_file ) ) {
247 require_once $customization_file;
248 $copy_dirs[] = $customization_file;
249 }
250
251 return $copy_dirs;
252 }
253
254 /**
255 * Determines whether jetpack_relatedposts is supported
256 *
257 * @return bool
258 */
259 public function jetpack_relatedposts_supported() {
260 $wpcom_related_posts_theme_blacklist = array(
261 'Expound',
262 'Traveler',
263 'Opti',
264 'Currents',
265 );
266 return ( ! in_array( wp_get_theme()->get( 'Name' ), $wpcom_related_posts_theme_blacklist, true ) );
267 }
268
269 /**
270 * Returns category details
271 *
272 * @param WP_Term $category Category object.
273 *
274 * @return array
275 */
276 public function get_category_details( $category ) {
277 return array(
278 'value' => $category->term_id,
279 'name' => $category->name,
280 );
281 }
282
283 /**
284 * Returns an option value as the result of the callable being applied to
285 * it if a value is set, otherwise null.
286 *
287 * @param string $option_name Option name.
288 * @param callable $cast_callable Callable to invoke on option value.
289 *
290 * @return int|null Numeric option value or null.
291 */
292 protected function get_cast_option_value_or_null( $option_name, $cast_callable ) {
293 $option_value = get_option( $option_name, null );
294 if ( $option_value === null ) {
295 return $option_value;
296 }
297
298 return call_user_func( $cast_callable, $option_value );
299 }
300
301 /**
302 * Collects the necessary information to return for a get settings response.
303 *
304 * @return array
305 */
306 public function get_settings_response() {
307 $response = array();
308
309 // Allow update in later versions.
310 /**
311 * Filter the structure of site settings to return.
312 *
313 * @module json-api
314 *
315 * @since 3.9.3
316 *
317 * @param array $site_format Data structure.
318 */
319 $response_format = apply_filters( 'site_settings_site_format', self::$site_format );
320
321 $blog_id = (int) $this->api->get_blog_id_for_output();
322 $site = $this->get_platform()->get_site( $blog_id );
323
324 foreach ( array_keys( $response_format ) as $key ) {
325
326 // refactoring to change lang parameter to locale in 1.2.
327 $lang_or_locale = $this->get_locale( $key );
328 if ( $lang_or_locale ) {
329 $response[ $key ] = $lang_or_locale;
330 continue;
331 }
332
333 switch ( $key ) {
334 case 'ID':
335 $response[ $key ] = $blog_id;
336 break;
337 case 'name':
338 $name = get_bloginfo( 'name' );
339 $response[ $key ] = is_string( $name ) ? htmlspecialchars_decode( $name, ENT_QUOTES ) : '';
340 break;
341 case 'description':
342 $description = get_bloginfo( 'description' );
343 $response[ $key ] = is_string( $description ) ? htmlspecialchars_decode( $description, ENT_QUOTES ) : '';
344 break;
345 case 'URL':
346 $response[ $key ] = (string) home_url();
347 break;
348 case 'locale_variant':
349 if ( function_exists( 'wpcom_l10n_get_blog_locale_variant' ) ) {
350 $blog_locale_variant = wpcom_l10n_get_blog_locale_variant();
351 if ( $blog_locale_variant ) {
352 $response[ $key ] = $blog_locale_variant;
353 }
354 }
355 break;
356 case 'settings':
357 $jetpack_relatedposts_options = Jetpack_Options::get_option( 'relatedposts', array() );
358 // If the option's enabled key is NOT SET, it is considered enabled by the plugin.
359 if ( ! isset( $jetpack_relatedposts_options['enabled'] ) ) {
360 $jetpack_relatedposts_options['enabled'] = true;
361 }
362
363 $jetpack_relatedposts_options['enabled'] =
364 $jetpack_relatedposts_options['enabled']
365 && $site->is_module_active( 'related-posts' );
366
367 $jetpack_search_supported = false;
368 if ( function_exists( 'wpcom_is_jetpack_search_supported' ) ) {
369 $jetpack_search_supported = wpcom_is_jetpack_search_supported( $blog_id );
370 }
371
372 $jetpack_search_active =
373 $jetpack_search_supported
374 && $site->is_module_active( 'search' );
375
376 // array_values() is necessary to ensure the array starts at index 0.
377 $post_categories = array_values(
378 array_map(
379 array( $this, 'get_category_details' ),
380 get_categories( array( 'hide_empty' => false ) )
381 )
382 );
383
384 // Make sure we are returning a consistent type
385 if ( ! class_exists( 'Jetpack_Newsletter_Category_Helper' ) ) {
386 require_once JETPACK__PLUGIN_DIR . '_inc/lib/class-jetpack-newsletter-category-helper.php';
387 }
388 $newsletter_category_ids = Jetpack_Newsletter_Category_Helper::get_category_ids();
389
390 $api_cache = $site->is_jetpack() ? (bool) get_option( 'jetpack_api_cache_enabled' ) : true;
391
392 // Get Sites MCP settings
393 $mcp_abilities = $this->get_site_mcp_abilities();
394
395 $response[ $key ] = array(
396 // also exists as "options".
397 'admin_url' => get_admin_url(),
398 'default_ping_status' => 'closed' !== get_option( 'default_ping_status' ),
399 'default_comment_status' => 'closed' !== get_option( 'default_comment_status' ),
400
401 // new stuff starts here.
402 'instant_search_enabled' => (bool) get_option( 'instant_search_enabled' ),
403 'blog_public' => (int) get_option( 'blog_public' ),
404 'wpcom_data_sharing_opt_out' => (bool) get_option( 'wpcom_data_sharing_opt_out' ),
405 'jetpack_sync_non_public_post_stati' => (bool) Jetpack_Options::get_option( 'sync_non_public_post_stati' ),
406 'jetpack_relatedposts_allowed' => (bool) $this->jetpack_relatedposts_supported(),
407 'jetpack_relatedposts_enabled' => (bool) $jetpack_relatedposts_options['enabled'],
408 'jetpack_relatedposts_show_context' => ! empty( $jetpack_relatedposts_options['show_context'] ),
409 'jetpack_relatedposts_show_date' => ! empty( $jetpack_relatedposts_options['show_date'] ),
410 'jetpack_relatedposts_show_headline' => ! empty( $jetpack_relatedposts_options['show_headline'] ),
411 'jetpack_relatedposts_show_thumbnails' => ! empty( $jetpack_relatedposts_options['show_thumbnails'] ),
412 'jetpack_search_enabled' => $jetpack_search_active,
413 'jetpack_search_supported' => (bool) $jetpack_search_supported,
414 'default_category' => (int) get_option( 'default_category' ),
415 'post_categories' => (array) $post_categories,
416 'default_post_format' => get_option( 'default_post_format' ),
417 'default_pingback_flag' => (bool) get_option( 'default_pingback_flag' ),
418 'require_name_email' => (bool) get_option( 'require_name_email' ),
419 'comment_registration' => (bool) get_option( 'comment_registration' ),
420 'close_comments_for_old_posts' => (bool) get_option( 'close_comments_for_old_posts' ),
421 'close_comments_days_old' => (int) get_option( 'close_comments_days_old' ),
422 'thread_comments' => (bool) get_option( 'thread_comments' ),
423 'thread_comments_depth' => (int) get_option( 'thread_comments_depth' ),
424 'page_comments' => (bool) get_option( 'page_comments' ),
425 'comments_per_page' => (int) get_option( 'comments_per_page' ),
426 'default_comments_page' => get_option( 'default_comments_page' ),
427 'comment_order' => get_option( 'comment_order' ),
428 'comments_notify' => (bool) get_option( 'comments_notify' ),
429 'moderation_notify' => (bool) get_option( 'moderation_notify' ),
430 'social_notifications_like' => ( 'on' === get_option( 'social_notifications_like' ) ),
431 'social_notifications_reblog' => ( 'on' === get_option( 'social_notifications_reblog' ) ),
432 'social_notifications_subscribe' => ( 'on' === get_option( 'social_notifications_subscribe' ) ),
433 'comment_moderation' => (bool) get_option( 'comment_moderation' ),
434 'comment_whitelist' => (bool) get_option( 'comment_previously_approved' ),
435 'comment_previously_approved' => (bool) get_option( 'comment_previously_approved' ),
436 'comment_max_links' => (int) get_option( 'comment_max_links' ),
437 'moderation_keys' => get_option( 'moderation_keys' ),
438 'blacklist_keys' => get_option( 'disallowed_keys' ),
439 'disallowed_keys' => get_option( 'disallowed_keys' ),
440 'lang_id' => defined( 'IS_WPCOM' ) && IS_WPCOM
441 ? get_lang_id_by_code( wpcom_l10n_get_blog_locale_variant( $blog_id, true ) )
442 : get_option( 'lang_id' ),
443 'site_vertical_id' => (string) get_option( 'site_vertical_id' ),
444 'jetpack_cloudflare_analytics' => get_option( 'jetpack_cloudflare_analytics' ),
445 'disabled_likes' => (bool) get_option( 'disabled_likes' ),
446 'disabled_reblogs' => (bool) get_option( 'disabled_reblogs' ),
447 'jetpack_comment_likes_enabled' => (bool) get_option( 'jetpack_comment_likes_enabled', false ),
448 'twitter_via' => (string) get_option( 'twitter_via' ),
449 'jetpack-twitter-cards-site-tag' => (string) get_option( 'jetpack-twitter-cards-site-tag' ),
450 'eventbrite_api_token' => $this->get_cast_option_value_or_null( 'eventbrite_api_token', 'intval' ),
451 'gmt_offset' => get_option( 'gmt_offset' ),
452 'timezone_string' => get_option( 'timezone_string' ),
453 'date_format' => get_option( 'date_format' ),
454 'time_format' => get_option( 'time_format' ),
455 'start_of_week' => get_option( 'start_of_week' ),
456 'woocommerce_onboarding_profile' => (array) get_option( 'woocommerce_onboarding_profile', array() ),
457 'woocommerce_store_address' => (string) get_option( 'woocommerce_store_address' ),
458 'woocommerce_store_address_2' => (string) get_option( 'woocommerce_store_address_2' ),
459 'woocommerce_store_city' => (string) get_option( 'woocommerce_store_city' ),
460 'woocommerce_default_country' => (string) get_option( 'woocommerce_default_country' ),
461 'woocommerce_store_postcode' => (string) get_option( 'woocommerce_store_postcode' ),
462 'jetpack_testimonial' => (bool) get_option( 'jetpack_testimonial', '0' ),
463 'jetpack_testimonial_posts_per_page' => (int) get_option( 'jetpack_testimonial_posts_per_page', '10' ),
464 'jetpack_portfolio' => (bool) get_option( 'jetpack_portfolio', '0' ),
465 'jetpack_portfolio_posts_per_page' => (int) get_option( 'jetpack_portfolio_posts_per_page', '10' ),
466 'markdown_supported' => true,
467 'site_icon' => $this->get_cast_option_value_or_null( 'site_icon', 'intval' ),
468 Jetpack_SEO_Utils::FRONT_PAGE_META_OPTION => get_option( Jetpack_SEO_Utils::FRONT_PAGE_META_OPTION, '' ),
469 Jetpack_SEO_Titles::TITLE_FORMATS_OPTION => get_option( Jetpack_SEO_Titles::TITLE_FORMATS_OPTION, array() ),
470 'verification_services_codes' => get_option( 'verification_services_codes', null ),
471 'api_cache' => $api_cache,
472 'posts_per_page' => (int) get_option( 'posts_per_page' ),
473 'posts_per_rss' => (int) get_option( 'posts_per_rss' ),
474 'rss_use_excerpt' => (bool) get_option( 'rss_use_excerpt' ),
475 'launchpad_screen' => (string) get_option( 'launchpad_screen' ),
476 'wpcom_newsletter_send_default' => (bool) get_option( 'wpcom_newsletter_send_default', true ),
477 'wpcom_featured_image_in_email' => ( function () use ( $site ) {
478 if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
479 $registered_date = method_exists( $site, 'get_registered_date' ) ? $site->get_registered_date() : '';
480 // Compare to May 2, 2025 (ISO 8601 format)
481 if ( $registered_date && $registered_date !== '0000-00-00T00:00:00+00:00' && strtotime( $registered_date ) >= strtotime( '2025-05-02T00:00:00+00:00' ) ) {
482 return (bool) get_option( 'wpcom_featured_image_in_email', true );
483 }
484 }
485 // For all other sites, use the saved value or default to false for legacy behavior.
486 return (bool) get_option( 'wpcom_featured_image_in_email', false );
487 } )(),
488 'jetpack_gravatar_in_email' => (bool) get_option( 'jetpack_gravatar_in_email', true ),
489 'jetpack_author_in_email' => (bool) get_option( 'jetpack_author_in_email', true ),
490 'jetpack_post_date_in_email' => (bool) get_option( 'jetpack_post_date_in_email', true ),
491 'wpcom_newsletter_categories' => $newsletter_category_ids,
492 'wpcom_newsletter_categories_enabled' => (bool) get_option( 'wpcom_newsletter_categories_enabled' ),
493 'sm_enabled' => (bool) get_option( 'sm_enabled' ),
494 'jetpack_subscribe_overlay_enabled' => (bool) get_option( 'jetpack_subscribe_overlay_enabled' ),
495 'jetpack_subscribe_floating_button_enabled' => (bool) get_option( 'jetpack_subscribe_floating_button_enabled' ),
496 'jetpack_subscriptions_subscribe_post_end_enabled' => (bool) get_option( 'jetpack_subscriptions_subscribe_post_end_enabled' ),
497 'jetpack_subscriptions_login_navigation_enabled' => (bool) get_option( 'jetpack_subscriptions_login_navigation_enabled' ),
498 'jetpack_subscriptions_subscribe_navigation_enabled' => (bool) get_option( 'jetpack_subscriptions_subscribe_navigation_enabled' ),
499 'wpcom_gifting_subscription' => (bool) get_option( 'wpcom_gifting_subscription', $this->get_wpcom_gifting_subscription_default() ),
500 'wpcom_reader_views_enabled' => (bool) get_option( 'wpcom_reader_views_enabled', true ),
501 'wpcom_subscription_emails_use_excerpt' => (bool) get_option( 'wpcom_subscription_emails_use_excerpt' ),
502 'jetpack_subscriptions_reply_to' => (string) $this->get_subscriptions_reply_to_option(),
503 'jetpack_subscriptions_from_name' => (string) get_option( 'jetpack_subscriptions_from_name' ),
504 'show_on_front' => (string) get_option( 'show_on_front' ),
505 'page_on_front' => (string) get_option( 'page_on_front' ),
506 'page_for_posts' => (string) get_option( 'page_for_posts' ),
507 'subscription_options' => $this->get_subscription_options_in_user_locale(),
508 'supports_free_tier_customization' => true,
509 'jetpack_verbum_subscription_modal' => (bool) get_option( 'jetpack_verbum_subscription_modal', true ),
510 'enable_verbum_commenting' => (bool) get_option( 'enable_verbum_commenting', true ),
511 'enable_blocks_comments' => (bool) get_option( 'enable_blocks_comments', true ),
512 'highlander_comment_form_prompt' => $this->get_highlander_comment_form_prompt_option(),
513 'jetpack_comment_form_color_scheme' => (string) get_option( 'jetpack_comment_form_color_scheme' ),
514 'in_site_migration_flow' => (string) get_option( 'in_site_migration_flow', '' ),
515 'migration_source_site_domain' => (string) get_option( 'migration_source_site_domain' ),
516 'jetpack_waf_automatic_rules' => (bool) get_option( 'jetpack_waf_automatic_rules' ),
517 'jetpack_waf_ip_allow_list' => (string) get_option( 'jetpack_waf_ip_allow_list' ),
518 'jetpack_waf_ip_allow_list_enabled' => (bool) get_option( 'jetpack_waf_ip_allow_list_enabled' ),
519 'jetpack_waf_ip_block_list' => (string) get_option( 'jetpack_waf_ip_block_list' ),
520 'jetpack_waf_ip_block_list_enabled' => (bool) get_option( 'jetpack_waf_ip_block_list_enabled' ),
521 'jetpack_waf_share_data' => (bool) get_option( 'jetpack_waf_share_data' ),
522 'jetpack_waf_share_debug_data' => (bool) get_option( 'jetpack_waf_share_debug_data' ),
523 'jetpack_waf_automatic_rules_last_updated_timestamp' => (int) get_option( 'jetpack_waf_automatic_rules_last_updated_timestamp' ),
524 'is_fully_managed_agency_site' => (bool) get_option( 'is_fully_managed_agency_site' ),
525 'wpcom_hide_action_bar' => (bool) get_option( 'wpcom_hide_action_bar' ),
526 'mcp_abilities' => $mcp_abilities,
527 );
528
529 require_once JETPACK__PLUGIN_DIR . '/modules/memberships/class-jetpack-memberships.php';
530 if ( class_exists( 'Jetpack_Memberships' ) ) {
531 $response[ $key ]['newsletter_has_active_plan'] = count( Jetpack_Memberships::get_all_newsletter_plan_ids( false ) ) > 0;
532 // Read-only/derived: the free tier's markdown description rendered to
533 // safe HTML, colocated with subscription_options so it's
534 // read-after-write consistent. Not part of the writable
535 // subscription_options bag (which would round-trip and persist it).
536 $response[ $key ]['free_tier_description_rendered'] = Jetpack_Memberships::render_tier_description_html(
537 ( (array) get_option( 'subscription_options' ) )['free_tier_description'] ?? ''
538 );
539 }
540
541 if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
542 $response[ $key ]['wpcom_publish_posts_with_markdown'] = (bool) WPCom_Markdown::get_instance()->is_posting_enabled();
543 $response[ $key ]['wpcom_publish_comments_with_markdown'] = (bool) WPCom_Markdown::get_instance()->is_commenting_enabled();
544
545 // WPCOM-specific Infinite Scroll Settings.
546 if ( is_callable( array( 'The_Neverending_Home_Page', 'get_settings' ) ) ) {
547 /**
548 * Clear the cached copy of widget info so it's pulled fresh from blog options.
549 * It was primed during the initial load under the __REST API site__'s context.
550 *
551 * @see wp_get_sidebars_widgets https://core.trac.wordpress.org/browser/trunk/src/wp-includes/widgets.php?rev=42374#L931
552 */
553 $GLOBALS['_wp_sidebars_widgets'] = array(); // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited
554
555 $infinite_scroll_settings = The_Neverending_Home_Page::get_settings();
556 $response[ $key ]['infinite_scroll'] = get_option( 'infinite_scroll', true ) && 'scroll' === $infinite_scroll_settings->type;
557 if ( $infinite_scroll_settings->footer_widgets || 'click' === $infinite_scroll_settings->requested_type ) {
558 // The blog has footer widgets -- infinite scroll is blocked.
559 $response[ $key ]['infinite_scroll_blocked'] = 'footer';
560 } else {
561 $response[ $key ]['infinite_scroll_blocked'] = false;
562 }
563 }
564 }
565
566 // allow future versions of this endpoint to support additional settings keys.
567 /**
568 * Filter the current site setting in the returned response.
569 *
570 * @module json-api
571 *
572 * @since 3.9.3
573 * @since 13.6 Added the API object parameter.
574 *
575 * @param mixed $response_item A single site setting.
576 * @param WPCOM_JSON_API_Site_Settings_Endpoint $this The API object.
577 */
578 $response[ $key ] = apply_filters( 'site_settings_endpoint_get', $response[ $key ], $this );
579
580 if ( class_exists( 'Sharing_Service' ) ) {
581 $ss = new Sharing_Service();
582 $sharing = $ss->get_global_options();
583 $response[ $key ]['sharing_button_style'] = (string) $sharing['button_style'];
584 $response[ $key ]['sharing_label'] = (string) $sharing['sharing_label'];
585 $response[ $key ]['sharing_show'] = (array) $sharing['show'];
586 $response[ $key ]['sharing_open_links'] = (string) $sharing['open_links'];
587 }
588
589 $response[ $key ]['jetpack_protect_whitelist'] = Brute_Force_Protection_Shared_Functions::format_allow_list();
590
591 if ( ! current_user_can( 'edit_posts' ) ) {
592 unset( $response[ $key ] );
593 }
594 break;
595 }
596 }
597 return $response;
598 }
599
600 /**
601 * Get the default value for the wpcom_gifting_subscription option.
602 * The default value is the inverse of the plan's auto_renew setting.
603 *
604 * @return bool
605 */
606 protected function get_wpcom_gifting_subscription_default() {
607 if ( function_exists( 'wpcom_get_site_purchases' ) && function_exists( 'wpcom_purchase_has_feature' ) ) {
608 $purchases = wpcom_get_site_purchases();
609
610 foreach ( $purchases as $purchase ) {
611 if ( wpcom_purchase_has_feature( $purchase, \WPCOM_Features::SUBSCRIPTION_GIFTING ) ) {
612 /*
613 * We set default value as false when expiration date not match the following:
614 * - 54 days before the annual plan expiration.
615 * - 5 days before the monthly plan expiration.
616 * This is to match the gifting banner logic.
617 */
618 $days_of_warning = str_contains( $purchase->product_slug, 'monthly' ) ? 5 : 54;
619 $seconds_until_expiration = strtotime( $purchase->expiry_date ) - time();
620 if ( $seconds_until_expiration >= $days_of_warning * DAY_IN_SECONDS ) {
621 return false;
622 }
623
624 // We set default to the inverse of auto-renew.
625 if ( isset( $purchase->auto_renew ) ) {
626 return ! $purchase->auto_renew;
627 } elseif ( isset( $purchase->user_allows_auto_renew ) ) {
628 return ! $purchase->user_allows_auto_renew;
629 }
630 }
631 }
632 }
633 return false;
634 }
635
636 /**
637 * Reads `subscription_options` with the current user's locale active, to
638 * ensure that the defaults would be translated when displaying to the user
639 * or comparing the options before saving.
640 *
641 * @return array The `subscription_options` value, defaults included.
642 */
643 private function get_subscription_options_in_user_locale() {
644 $switched_locale = false;
645
646 if ( function_exists( 'wpcom_switch_to_user_locale' ) ) {
647 // Compare the locales before/after switch to decide if we should switch back
648 $locale_before = determine_locale();
649 // @phan-suppress-next-line PhanUndeclaredFunction -- Checked above. See also https://github.com/phan/phan/issues/1204.
650 wpcom_switch_to_user_locale();
651 $switched_locale = determine_locale() !== $locale_before;
652 }
653
654 // Resolve the defaults the same way get_option() does for a missing row (via the
655 // `default_option_*` filter with $passed_default = false), then let any stored
656 // sub-keys take precedence. Passing an array default keeps get_option() from
657 // re-populating the defaults, so a partial row stays partial before the merge.
658 $default_subscription_options = (array) apply_filters( 'default_option_subscription_options', array(), 'subscription_options', false );
659 $stored_subscription_options = (array) get_option( 'subscription_options', array() );
660 $subscription_options = array_merge( $default_subscription_options, $stored_subscription_options );
661
662 if ( $switched_locale ) {
663 restore_previous_locale();
664 }
665
666 return $subscription_options;
667 }
668
669 /**
670 * Get list of all site level MCP abilities.
671 *
672 * @return array
673 */
674 private function get_all_site_mcp_abilities(): array {
675 $all_abilities = array();
676 $ability_registry_file = WP_CONTENT_DIR . '/mu-plugins/wpcom-mcp/includes/AbilitiesRegistry/Registry/AbilityRegistry.php';
677 if ( file_exists( $ability_registry_file ) ) {
678 require_once $ability_registry_file;
679 // @phan-suppress-next-line PhanUndeclaredClassMethod
680 $abilities_resources = Automattic\WpcomMcp\AbilitiesRegistry\Registry\AbilityRegistry::get_resources_for_server( 'site-level' );
681 // @phan-suppress-next-line PhanUndeclaredClassMethod
682 $abilities_tools = Automattic\WpcomMcp\AbilitiesRegistry\Registry\AbilityRegistry::get_tools_for_server( 'site-level' );
683 // @phan-suppress-next-line PhanUndeclaredClassMethod
684 $abilities_prompts = Automattic\WpcomMcp\AbilitiesRegistry\Registry\AbilityRegistry::get_prompts_for_server( 'site-level' );
685 $all_abilities = array_merge( $abilities_resources, $abilities_tools, $abilities_prompts );
686 }
687 return apply_filters( 'jetpack_site_mcp_abilities', $all_abilities );
688 }
689
690 /**
691 * Get ability meta from config.
692 *
693 * @param string $ability_name Ability name, i.e. wpcom-mcp/posts-search.
694 *
695 * @return array
696 */
697 private function get_mcp_abilities_metadata( string $ability_name ): array {
698 $ability_meta = array();
699 $ability_registry_file = WP_CONTENT_DIR . '/mu-plugins/wpcom-mcp/includes/AbilitiesRegistry/Registry/AbilityRegistry.php';
700 if ( file_exists( $ability_registry_file ) ) {
701 require_once $ability_registry_file;
702 // @phan-suppress-next-line PhanUndeclaredClassMethod
703 $ability_meta = Automattic\WpcomMcp\AbilitiesRegistry\Registry\AbilityRegistry::get_metadata( $ability_name );
704 }
705 return apply_filters( 'jetpack_site_mcp_ability_meta', $ability_meta, $ability_name );
706 }
707
708 /**
709 * Get MCP abilities for the current site.
710 *
711 * @return array
712 */
713 public function get_site_mcp_abilities(): array {
714 $current_mcp_abilities = get_option( 'mcp_abilities', array() );
715 if ( ! is_array( $current_mcp_abilities ) ) {
716 $current_mcp_abilities = array();
717 }
718
719 $all_abilities = $this->get_all_site_mcp_abilities();
720 if ( empty( $all_abilities ) ) {
721 return array();
722 }
723
724 $computed_abilities = array();
725 foreach ( $all_abilities as $ability_name ) {
726 // Get base metadata first
727 $ability_meta = $this->get_mcp_abilities_metadata( $ability_name );
728 if ( ! empty( $ability_meta ) ) {
729 // Use stored value or fall back to metadata default
730 $enabled = $current_mcp_abilities[ $ability_name ] ?? $ability_meta['enabled'] ?? false;
731
732 $computed_abilities[ $ability_name ] = array(
733 'name' => $ability_name,
734 'title' => $ability_meta['title'] ?? '',
735 'description' => $ability_meta['description'] ?? '',
736 'category' => $ability_meta['category'] ?? '',
737 'type' => $ability_meta['type'] ?? '',
738 'enabled' => (bool) $enabled,
739 );
740 }
741 }
742 return $computed_abilities;
743 }
744
745 /**
746 * Sets the MCP abilities for the current site.
747 *
748 * @param mixed $value MCP abilities array.
749 *
750 * @return true|WP_Error
751 */
752 public function set_site_mcp_abilities( $value ) {
753 // Validate input format
754 if ( ! is_array( $value ) ) {
755 return new WP_Error( 'invalid_format', __( 'Site MCP abilities must be an array', 'jetpack' ) );
756 }
757
758 $all_abilities = $this->get_all_site_mcp_abilities();
759
760 // Filter ability names that don't exist
761 $value = array_filter(
762 $value,
763 function ( $ability_name ) use ( $all_abilities ) {
764 return in_array( $ability_name, $all_abilities, true );
765 },
766 ARRAY_FILTER_USE_KEY
767 );
768
769 // Validate each ability exists and value is boolean-like
770 foreach ( $value as $ability_name => $enabled ) {
771 if ( ! is_string( $ability_name ) || ( ! WPCOM_JSON_API::is_truthy( $enabled ) && ! WPCOM_JSON_API::is_falsy( $enabled ) ) ) {
772 $error_message = sprintf(
773 // Translators: %s is an MCP ability name
774 __( 'Invalid ability: %s', 'jetpack' ),
775 $ability_name
776 );
777 return new WP_Error( 'invalid_ability', $error_message );
778 }
779 }
780
781 update_option( 'mcp_abilities', $value );
782
783 return true;
784 }
785
786 /**
787 * Get locale.
788 *
789 * @param string $key Language.
790 */
791 protected function get_locale( $key ) {
792 if ( 'lang' === $key ) {
793 if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
794 return (string) get_blog_lang_code();
795 } else {
796 return get_locale();
797 }
798 }
799
800 return false;
801 }
802
803 /**
804 * Updates site settings for authorized users
805 *
806 * @return array|WP_Error
807 */
808 public function update_settings() {
809 /*
810 * $this->input() retrieves posted arguments whitelisted and casted to the $request_format
811 * specs that get passed in when this class is instantiated
812 */
813 $input = $this->input();
814 $unfiltered_input = $this->input( false, false );
815 /**
816 * Filters the settings to be updated on the site.
817 *
818 * @module json-api
819 *
820 * @since 3.6.0
821 * @since 6.1.1 Added $unfiltered_input parameter.
822 *
823 * @param array $input Associative array of site settings to be updated.
824 * Cast and filtered based on documentation.
825 * @param array $unfiltered_input Associative array of site settings to be updated.
826 * Neither cast nor filtered. Contains raw input.
827 */
828 $input = apply_filters( 'rest_api_update_site_settings', $input, $unfiltered_input );
829
830 $blog_id = get_current_blog_id();
831
832 $jetpack_relatedposts_options = array();
833 $sharing_options = array();
834 $updated = array();
835
836 if ( ! class_exists( 'Jetpack_Newsletter_Category_Helper' ) ) {
837 require_once JETPACK__PLUGIN_DIR . '_inc/lib/class-jetpack-newsletter-category-helper.php';
838 }
839
840 foreach ( $input as $key => $value ) {
841
842 if ( ! is_array( $value ) ) {
843 $value = trim( $value );
844 }
845
846 // preserve the raw value before unslashing the value. The slashes need to be preserved for date and time formats.
847 $raw_value = $value;
848 $value = wp_unslash( $value );
849
850 switch ( $key ) {
851
852 case 'default_ping_status':
853 case 'default_comment_status':
854 // settings are stored as closed|open.
855 $coerce_value = ( $value ) ? 'open' : 'closed';
856 if ( update_option( $key, $coerce_value ) ) {
857 $updated[ $key ] = $value;
858 }
859 break;
860 case 'launchpad_screen':
861 if ( in_array( $value, array( 'full', 'off', 'minimized' ), true ) ) {
862 if ( update_option( $key, $value ) ) {
863 $updated[ $key ] = $value;
864 }
865 }
866 break;
867 case 'jetpack_protect_whitelist':
868 if ( class_exists( 'Brute_Force_Protection_Shared_Functions' ) ) {
869 $result = Brute_Force_Protection_Shared_Functions::save_allow_list( $value );
870 if ( is_wp_error( $result ) ) {
871 return $result;
872 }
873 $updated[ $key ] = Brute_Force_Protection_Shared_Functions::format_allow_list();
874 }
875 break;
876 case 'jetpack_sync_non_public_post_stati':
877 Jetpack_Options::update_option( 'sync_non_public_post_stati', $value );
878 break;
879 case 'jetpack_search_enabled':
880 if ( $value ) {
881 Jetpack::activate_module( $blog_id, 'search' );
882 } else {
883 // @phan-suppress-next-line PhanParamTooMany -- Phan doesn't know about the WP.com variant of the Jetpack class.
884 Jetpack::deactivate_module( $blog_id, 'search' );
885 }
886 $updated[ $key ] = (bool) $value;
887 break;
888 case 'jetpack_relatedposts_enabled':
889 case 'jetpack_relatedposts_show_context':
890 case 'jetpack_relatedposts_show_date':
891 case 'jetpack_relatedposts_show_thumbnails':
892 case 'jetpack_relatedposts_show_headline':
893 if ( ! $this->jetpack_relatedposts_supported() ) {
894 break;
895 }
896 if ( 'jetpack_relatedposts_enabled' === $key ) {
897 if ( $value ) {
898 Jetpack::activate_module( $blog_id, 'related-posts' );
899 } else {
900 // @phan-suppress-next-line PhanParamTooMany -- Phan doesn't know about the WP.com variant of the Jetpack class.
901 Jetpack::deactivate_module( $blog_id, 'related-posts' );
902 }
903 }
904 $just_the_key = substr( $key, 21 );
905 $jetpack_relatedposts_options[ $just_the_key ] = $value;
906 break;
907
908 case 'social_notifications_like':
909 case 'social_notifications_reblog':
910 case 'social_notifications_subscribe':
911 // settings are stored as on|off.
912 $coerce_value = ( $value ) ? 'on' : 'off';
913 if ( update_option( $key, $coerce_value ) ) {
914 $updated[ $key ] = $value;
915 }
916 break;
917
918 case 'cloudflare_analytics':
919 if ( ! isset( $value['code'] ) || ! preg_match( '/^$|^[a-fA-F0-9]+$/i', $value['code'] ) ) {
920 return new WP_Error( 'invalid_code', __( 'Invalid Cloudflare Analytics ID', 'jetpack' ) );
921 }
922
923 if ( update_option( $key, $value ) ) {
924 $updated[ $key ] = $value;
925 }
926 break;
927
928 case 'jetpack_testimonial':
929 case 'jetpack_portfolio':
930 case 'jetpack_comment_likes_enabled':
931 case 'wpcom_reader_views_enabled':
932 case 'jetpack_verbum_subscription_modal':
933 // settings are stored as 1|0.
934 $coerce_value = (int) $value;
935 if ( update_option( $key, $coerce_value ) ) {
936 $updated[ $key ] = (bool) $value;
937 }
938 break;
939
940 case 'jetpack_testimonial_posts_per_page':
941 case 'jetpack_portfolio_posts_per_page':
942 // settings are stored as numeric.
943 $coerce_value = (int) $value;
944 if ( update_option( $key, $coerce_value ) ) {
945 $updated[ $key ] = $coerce_value;
946 }
947 break;
948
949 // Sharing options.
950 case 'sharing_button_style':
951 case 'sharing_show':
952 case 'sharing_open_links':
953 $sharing_options[ preg_replace( '/^sharing_/', '', $key ) ] = $value;
954 break;
955 case 'sharing_label':
956 $sharing_options[ $key ] = $value;
957 break;
958
959 // Keyring token option.
960 case 'eventbrite_api_token':
961 // These options can only be updated for sites hosted on WordPress.com.
962 if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
963 if ( empty( $value ) || WPCOM_JSON_API::is_falsy( $value ) ) {
964 if ( delete_option( $key ) ) {
965 $updated[ $key ] = null;
966 }
967 } elseif ( update_option( $key, $value ) ) {
968 $updated[ $key ] = (int) $value;
969 }
970 }
971 break;
972
973 case 'api_cache':
974 if ( empty( $value ) || WPCOM_JSON_API::is_falsy( $value ) ) {
975 if ( delete_option( 'jetpack_api_cache_enabled' ) ) {
976 $updated[ $key ] = false;
977 }
978 } elseif ( update_option( 'jetpack_api_cache_enabled', true ) ) {
979 $updated[ $key ] = true;
980 }
981 break;
982
983 case 'timezone_string':
984 /*
985 * Map UTC+- timezones to gmt_offsets and set timezone_string to empty
986 * https://github.com/WordPress/WordPress/blob/4.4.2/wp-admin/options.php#L175
987 */
988 if ( ! empty( $value ) && preg_match( '/^UTC[+-]/', $value ) ) {
989 $gmt_offset = preg_replace( '/UTC\+?/', '', $value );
990 if ( update_option( 'gmt_offset', $gmt_offset ) ) {
991 $updated['gmt_offset'] = $gmt_offset;
992 }
993
994 $value = '';
995 }
996
997 /*
998 * Always set timezone_string either with the given value or with an
999 * empty string
1000 */
1001 if ( update_option( $key, $value ) ) {
1002 $updated[ $key ] = $value;
1003 }
1004 break;
1005
1006 case 'subscription_options':
1007 if ( ! is_array( $value ) ) {
1008 break;
1009 }
1010
1011 $allowed_keys = array( 'invitation', 'comment_follow', 'welcome', 'subscribe_modal_heading', 'free_tier_description', 'hide_free_tier' );
1012 $filtered_value = array_filter(
1013 $value,
1014 function ( $key ) use ( $allowed_keys ) {
1015 return in_array( $key, $allowed_keys, true );
1016 },
1017 ARRAY_FILTER_USE_KEY
1018 );
1019
1020 if ( empty( $filtered_value ) ) {
1021 break;
1022 }
1023
1024 // `hide_free_tier` is a boolean flag, so pull it out before the HTML
1025 // sanitization below (which expects strings). Parse it with is_truthy()
1026 // so stringy booleans (e.g. "false", "0") are interpreted correctly
1027 // rather than being treated as truthy by a plain `! empty()`.
1028 $has_hide_free_tier = array_key_exists( 'hide_free_tier', $filtered_value );
1029 $hide_free_tier = $has_hide_free_tier && WPCOM_JSON_API::is_truthy( $filtered_value['hide_free_tier'] );
1030 unset( $filtered_value['hide_free_tier'] );
1031
1032 array_walk_recursive(
1033 $filtered_value,
1034 function ( &$value ) {
1035 $value = wp_kses(
1036 $value,
1037 array(
1038 'a' => array(
1039 'href' => array(),
1040 ),
1041 )
1042 );
1043 }
1044 );
1045
1046 // Normalize whitespace-only `subscribe_modal_heading` input to empty so
1047 // the modal template's `empty()` fallback fires. PHP's `empty()` treats
1048 // `" "` as non-empty, which would otherwise render a blank heading.
1049 if ( isset( $filtered_value['subscribe_modal_heading'] ) ) {
1050 $filtered_value['subscribe_modal_heading'] = trim( $filtered_value['subscribe_modal_heading'] );
1051 }
1052
1053 // The free tier description is stored as plain markdown source, so strip
1054 // all HTML and cap its length to match the paid-tier description field.
1055 // WordPress core guarantees mb_substr() (polyfilled in wp-includes/compat.php
1056 // when the mbstring extension is unavailable), so it's safe to use directly.
1057 // A JSON payload could supply a non-scalar (array/object) for this field,
1058 // which would fatal in wp_kses()/mb_substr() on PHP 8+, so drop invalid values.
1059 if ( isset( $filtered_value['free_tier_description'] ) ) {
1060 if ( is_scalar( $filtered_value['free_tier_description'] ) ) {
1061 $filtered_value['free_tier_description'] = mb_substr( wp_kses( (string) $filtered_value['free_tier_description'], array() ), 0, 500 );
1062 } else {
1063 unset( $filtered_value['free_tier_description'] );
1064 }
1065 }
1066
1067 if ( $has_hide_free_tier ) {
1068 $filtered_value['hide_free_tier'] = $hide_free_tier;
1069 }
1070
1071 // Clients that render the settings form tend to post the whole
1072 // `subscription_options` bag back, including sub-keys the user never
1073 // touched. This could result in a translated value inadvertently
1074 // saved in the database.
1075 // Get the value from db or the default options populated by filter.
1076 $current_subscription_options = $this->get_subscription_options_in_user_locale();
1077 $changed_subscription_options = array();
1078
1079 foreach ( $filtered_value as $subscription_option_key => $subscription_option_value ) {
1080 $current_subscription_option = $current_subscription_options[ $subscription_option_key ] ?? null;
1081
1082 // The incoming value has already been through wp_kses() above, and
1083 // wp_kses() is not guaranteed to be byte-preserving — it rewrites
1084 // attribute quoting, and differently across WordPress versions. Put the
1085 // current value through the same pass so the comparison reflects a real
1086 // edit rather than a sanitizer rewrite; without this, a default carrying
1087 // markup (`invitation`) never compares equal and is persisted on every
1088 // save. Safe to apply to an already-sanitized value: the pass is
1089 // idempotent.
1090 if ( is_string( $current_subscription_option ) ) {
1091 $current_subscription_option = wp_kses(
1092 $current_subscription_option,
1093 array(
1094 'a' => array(
1095 'href' => array(),
1096 ),
1097 )
1098 );
1099 }
1100
1101 // A sub-key the site has never stored reads as unset everywhere this
1102 // option is consumed, so an empty incoming value for it is not a change.
1103 if (
1104 null === $current_subscription_option
1105 && ( '' === $subscription_option_value || false === $subscription_option_value )
1106 ) {
1107 continue;
1108 }
1109
1110 if ( $current_subscription_option === $subscription_option_value ) {
1111 continue;
1112 }
1113
1114 $changed_subscription_options[ $subscription_option_key ] = $subscription_option_value;
1115 }
1116
1117 if ( empty( $changed_subscription_options ) ) {
1118 break;
1119 }
1120
1121 // Get the value from the database or an empty array.
1122 $old_subscription_options = get_option( 'subscription_options', array() );
1123 $new_subscription_options = array_merge( $old_subscription_options, $changed_subscription_options );
1124
1125 if ( update_option( $key, $new_subscription_options ) ) {
1126 $updated[ $key ] = $changed_subscription_options;
1127 }
1128 break;
1129
1130 case 'woocommerce_onboarding_profile':
1131 // Allow boolean values but sanitize_text_field everything else.
1132 $sanitized_value = (array) $value;
1133 array_walk_recursive(
1134 $sanitized_value,
1135 function ( &$value ) {
1136 if ( ! is_bool( $value ) ) {
1137 $value = sanitize_text_field( $value );
1138 }
1139 }
1140 );
1141 if ( update_option( $key, $sanitized_value ) ) {
1142 $updated[ $key ] = $sanitized_value;
1143 }
1144 break;
1145
1146 case 'woocommerce_store_address':
1147 case 'woocommerce_store_address_2':
1148 case 'woocommerce_store_city':
1149 case 'woocommerce_default_country':
1150 case 'woocommerce_store_postcode':
1151 $sanitized_value = sanitize_text_field( $value );
1152 if ( update_option( $key, $sanitized_value ) ) {
1153 $updated[ $key ] = $sanitized_value;
1154 }
1155 break;
1156
1157 case 'date_format':
1158 case 'time_format':
1159 // settings are stored as strings.
1160 // raw_value is used to help preserve any escaped characters that might exist in the formatted string.
1161 $sanitized_value = sanitize_text_field( $raw_value );
1162 if ( update_option( $key, $sanitized_value ) ) {
1163 $updated[ $key ] = $sanitized_value;
1164 }
1165 break;
1166
1167 case 'start_of_week':
1168 // setting is stored as int in 0-6 range (days of week).
1169 $coerce_value = (int) $value;
1170 $limit_value = ( $coerce_value >= 0 && $coerce_value <= 6 ) ? $coerce_value : 0;
1171 if ( update_option( $key, $limit_value ) ) {
1172 $updated[ $key ] = $limit_value;
1173 }
1174 break;
1175
1176 case 'site_icon':
1177 /*
1178 * settings are stored as deletable numeric (all empty
1179 * values as delete intent), validated as media image
1180 */
1181 if ( empty( $value ) || WPCOM_JSON_API::is_falsy( $value ) ) {
1182 /**
1183 * Fallback mechanism to clear a third party site icon setting. Can be used
1184 * to unset the option when an API request instructs the site to remove the site icon.
1185 *
1186 * @module json-api
1187 *
1188 * @since 4.10
1189 */
1190 if ( delete_option( $key ) || apply_filters( 'rest_api_site_icon_cleared', false ) ) {
1191 $updated[ $key ] = null;
1192 }
1193 } elseif ( is_numeric( $value ) ) {
1194 $coerce_value = (int) $value;
1195 if ( wp_attachment_is_image( $coerce_value ) && update_option( $key, $coerce_value ) ) {
1196 $updated[ $key ] = $coerce_value;
1197 }
1198 }
1199 break;
1200
1201 case Jetpack_SEO_Utils::FRONT_PAGE_META_OPTION:
1202 if ( ! Jetpack_SEO_Utils::is_enabled_jetpack_seo() && ! Jetpack_SEO_Utils::has_legacy_front_page_meta() ) {
1203 return new WP_Error( 'unauthorized', __( 'SEO tools are not enabled for this site.', 'jetpack' ), 403 );
1204 }
1205
1206 if ( ! is_string( $value ) ) {
1207 return new WP_Error( 'invalid_input', __( 'Invalid SEO meta description value.', 'jetpack' ), 400 );
1208 }
1209
1210 $new_description = Jetpack_SEO_Utils::update_front_page_meta_description( $value );
1211
1212 if ( ! empty( $new_description ) ) {
1213 $updated[ $key ] = $new_description;
1214 }
1215 break;
1216
1217 case Jetpack_SEO_Titles::TITLE_FORMATS_OPTION:
1218 if ( ! Jetpack_SEO_Utils::is_enabled_jetpack_seo() ) {
1219 if ( Jetpack_SEO_Utils::has_legacy_front_page_meta() ) {
1220 break;
1221 }
1222 return new WP_Error( 'unauthorized', __( 'SEO tools are not enabled for this site.', 'jetpack' ), 403 );
1223 }
1224
1225 if ( ! Jetpack_SEO_Titles::are_valid_title_formats( $value ) ) {
1226 return new WP_Error( 'invalid_input', __( 'Invalid SEO title format.', 'jetpack' ), 400 );
1227 }
1228
1229 $new_title_formats = Jetpack_SEO_Titles::update_title_formats( $value );
1230
1231 if ( ! empty( $new_title_formats ) ) {
1232 $updated[ $key ] = $new_title_formats;
1233 }
1234 break;
1235
1236 case 'verification_services_codes':
1237 $verification_codes = jetpack_verification_validate( $value );
1238
1239 if ( update_option( 'verification_services_codes', $verification_codes ) ) {
1240 $updated[ $key ] = $verification_codes;
1241 }
1242 break;
1243
1244 case 'wpcom_publish_posts_with_markdown':
1245 case 'wpcom_publish_comments_with_markdown':
1246 $coerce_value = (bool) $value;
1247 if ( update_option( $key, $coerce_value ) ) {
1248 $updated[ $key ] = $coerce_value;
1249 }
1250 break;
1251
1252 case 'wpcom_gifting_subscription':
1253 $coerce_value = (bool) $value;
1254
1255 /*
1256 * get_option returns a boolean false if the option doesn't exist, otherwise it always returns
1257 * a serialized value. Knowing that we can check if the option already exists.
1258 */
1259 $gift_toggle = get_option( $key );
1260 if ( false === $gift_toggle ) {
1261 // update_option will not create a new option if the initial value is false. So use add_option.
1262 if ( add_option( $key, $coerce_value ) ) {
1263 $updated[ $key ] = $coerce_value;
1264 }
1265 } elseif ( update_option( $key, $coerce_value ) ) { // If the option already exists use update_option.
1266 $updated[ $key ] = $coerce_value;
1267 }
1268 break;
1269
1270 case 'rss_use_excerpt':
1271 $sanitized_value = (int) (bool) $value;
1272 update_option( $key, $sanitized_value );
1273 $updated[ $key ] = $sanitized_value;
1274 break;
1275
1276 case 'wpcom_subscription_emails_use_excerpt':
1277 update_option( 'wpcom_subscription_emails_use_excerpt', (bool) $value );
1278 $updated[ $key ] = (bool) $value;
1279 break;
1280
1281 case 'jetpack_subscriptions_reply_to':
1282 require_once JETPACK__PLUGIN_DIR . 'modules/subscriptions/class-settings.php';
1283 $to_set_value = Automattic\Jetpack\Modules\Subscriptions\Settings::is_valid_reply_to( $value )
1284 ? (string) $value
1285 : Automattic\Jetpack\Modules\Subscriptions\Settings::$default_reply_to;
1286
1287 if ( update_option( $key, $to_set_value ) ) {
1288 $updated[ $key ] = $to_set_value;
1289 }
1290 break;
1291
1292 case 'jetpack_subscriptions_from_name':
1293 $sanitized_value = sanitize_text_field( $value );
1294 if ( update_option( $key, $sanitized_value ) ) {
1295 $updated[ $key ] = $sanitized_value;
1296 }
1297 break;
1298
1299 case 'instant_search_enabled':
1300 update_option( 'instant_search_enabled', (bool) $value );
1301 $updated[ $key ] = (bool) $value;
1302 break;
1303
1304 case 'lang_id':
1305 /*
1306 * Due to the fact that locale variants are set in a locale_variant option,
1307 * changing locale from variant to primary
1308 * would look like the same lang_id is being saved and update_option would return false,
1309 * even though the correct options would be set by pre_update_option_lang_id,
1310 * so we should always return lang_id as updated.
1311 */
1312 update_option( 'lang_id', (int) $value );
1313 $updated[ $key ] = (int) $value;
1314 break;
1315
1316 case 'wpcom_newsletter_send_default':
1317 update_option( 'wpcom_newsletter_send_default', (int) (bool) $value );
1318 $updated[ $key ] = (int) (bool) $value;
1319 break;
1320
1321 case 'wpcom_featured_image_in_email':
1322 update_option( 'wpcom_featured_image_in_email', (int) (bool) $value );
1323 $updated[ $key ] = (int) (bool) $value;
1324 break;
1325
1326 case Jetpack_Newsletter_Category_Helper::NEWSLETTER_CATEGORIES_OPTION:
1327 $update_newsletter_categories = Jetpack_Newsletter_Category_Helper::save_category_ids( (array) $value );
1328 if ( $update_newsletter_categories ) {
1329 $updated[ $key ] = $update_newsletter_categories;
1330 }
1331
1332 break;
1333
1334 case 'wpcom_newsletter_categories_enabled':
1335 update_option( 'wpcom_newsletter_categories_enabled', (int) (bool) $value );
1336 $updated[ $key ] = (int) (bool) $value;
1337 break;
1338
1339 case 'sm_enabled':
1340 update_option( 'sm_enabled', (int) (bool) $value );
1341 $updated[ $key ] = (int) (bool) $value;
1342 break;
1343
1344 case 'jetpack_subscribe_overlay_enabled':
1345 update_option( 'jetpack_subscribe_overlay_enabled', (int) (bool) $value );
1346 $updated[ $key ] = (int) (bool) $value;
1347 break;
1348
1349 case 'jetpack_subscribe_floating_button_enabled':
1350 update_option( 'jetpack_subscribe_floating_button_enabled', (int) (bool) $value );
1351 $updated[ $key ] = (int) (bool) $value;
1352 break;
1353
1354 case 'jetpack_subscriptions_subscribe_post_end_enabled':
1355 update_option( 'jetpack_subscriptions_subscribe_post_end_enabled', (int) (bool) $value );
1356 $updated[ $key ] = (int) (bool) $value;
1357 break;
1358
1359 case 'jetpack_subscriptions_login_navigation_enabled':
1360 update_option( 'jetpack_subscriptions_login_navigation_enabled', (int) (bool) $value );
1361 $updated[ $key ] = (int) (bool) $value;
1362 break;
1363
1364 case 'jetpack_subscriptions_subscribe_navigation_enabled':
1365 update_option( 'jetpack_subscriptions_subscribe_navigation_enabled', (int) (bool) $value );
1366 $updated[ $key ] = (int) (bool) $value;
1367 break;
1368
1369 case 'show_on_front':
1370 if ( in_array( $value, array( 'page', 'posts' ), true ) && update_option( $key, $value ) ) {
1371 $updated[ $key ] = $value;
1372 }
1373 break;
1374
1375 case 'page_on_front':
1376 case 'page_for_posts':
1377 if ( $value === '' ) { // empty function is not applicable here because '0' may be a valid page id
1378 if ( delete_option( $key ) ) {
1379 $updated[ $key ] = null;
1380 }
1381
1382 break;
1383 }
1384
1385 if ( ! $this->is_valid_page_id( $value ) ) {
1386 break;
1387 }
1388
1389 $related_option_key = $key === 'page_on_front' ? 'page_for_posts' : 'page_on_front';
1390 $related_option_value = get_option( $related_option_key );
1391 if ( $related_option_value === $value ) {
1392 // page_on_front and page_for_posts are not allowed to be the same
1393 break;
1394 }
1395
1396 if ( update_option( $key, $value ) ) {
1397 $updated[ $key ] = $value;
1398 }
1399
1400 break;
1401
1402 case 'in_site_migration_flow':
1403 if ( empty( $value ) ) {
1404 delete_option( 'in_site_migration_flow' );
1405 break;
1406 }
1407
1408 $migration_flow_whitelist = array(
1409 'site-migration',
1410 'migration-signup',
1411 );
1412
1413 if ( ! in_array( $value, $migration_flow_whitelist, true ) ) {
1414 break;
1415 }
1416
1417 update_option( 'in_site_migration_flow', $value );
1418 $updated[ $key ] = $value;
1419 break;
1420
1421 case 'migration_source_site_domain':
1422 // If we get an empty value, delete the option
1423 if ( empty( $value ) ) {
1424 delete_option( 'migration_source_site_domain' );
1425 break;
1426 }
1427
1428 // If we get a non-url value, don't update the option.
1429 if ( wp_http_validate_url( $value ) === false ) {
1430 break;
1431 }
1432
1433 update_option( 'migration_source_site_domain', $value );
1434 $updated[ $key ] = $value;
1435 break;
1436
1437 case 'is_fully_managed_agency_site':
1438 case 'wpcom_hide_action_bar':
1439 $coerce_value = (int) (bool) $value;
1440 if ( update_option( $key, $coerce_value ) ) {
1441 $updated[ $key ] = (bool) $coerce_value;
1442 }
1443 break;
1444
1445 case 'mcp_abilities':
1446 $result = $this->set_site_mcp_abilities( $value );
1447 if ( is_wp_error( $result ) ) {
1448 return $result;
1449 }
1450 $updated[ $key ] = $this->get_site_mcp_abilities();
1451 break;
1452
1453 default:
1454 // allow future versions of this endpoint to support additional settings keys.
1455 if ( has_filter( 'site_settings_endpoint_update_' . $key ) ) {
1456 /**
1457 * Filter current site setting value to be updated.
1458 *
1459 * @module json-api
1460 *
1461 * @since 3.9.3
1462 * @since 13.6 Added the API object parameter.
1463 *
1464 * @param mixed $response_item A single site setting value.
1465 * @param WPCOM_JSON_API_Site_Settings_Endpoint The API object parameter.
1466 */
1467 $value = apply_filters( 'site_settings_endpoint_update_' . $key, $value, $this );
1468
1469 if ( is_wp_error( $value ) ) {
1470 return $value;
1471 }
1472
1473 if ( $value ) {
1474 $updated[ $key ] = $value;
1475 }
1476 break;
1477 }
1478 // no worries, we've already whitelisted and casted arguments above.
1479 if ( update_option( $key, $value ) ) {
1480 $updated[ $key ] = $value;
1481 }
1482 }
1483 }
1484
1485 if ( $jetpack_relatedposts_options !== array() ) {
1486 // track new jetpack_relatedposts options against old.
1487 $old_relatedposts_options = Jetpack_Options::get_option( 'relatedposts' );
1488
1489 $jetpack_relatedposts_options_to_save = $old_relatedposts_options;
1490 foreach ( $jetpack_relatedposts_options as $key => $value ) {
1491 $jetpack_relatedposts_options_to_save[ $key ] = $value;
1492 }
1493
1494 if ( Jetpack_Options::update_option( 'relatedposts', $jetpack_relatedposts_options_to_save ) ) {
1495 foreach ( $jetpack_relatedposts_options as $key => $value ) {
1496 if ( in_array( $key, array( 'show_context', 'show_date' ), true ) ) {
1497 $has_initialized_option = ! isset( $old_relatedposts_options[ $key ] ) && $value;
1498 $has_updated_option = isset( $old_relatedposts_options[ $key ] ) && $value !== $old_relatedposts_options[ $key ];
1499
1500 if ( $has_initialized_option || $has_updated_option ) {
1501 $updated[ 'jetpack_relatedposts_' . $key ] = (bool) $value;
1502 }
1503 } elseif ( isset( $old_relatedposts_options[ $key ] ) && $value !== $old_relatedposts_options[ $key ] ) {
1504 $updated[ 'jetpack_relatedposts_' . $key ] = $value;
1505 }
1506 }
1507 }
1508 }
1509
1510 if ( ! empty( $sharing_options ) && class_exists( 'Sharing_Service' ) ) {
1511 $ss = new Sharing_Service();
1512
1513 /*
1514 * Merge current values with updated, since Sharing_Service expects
1515 * all values to be included when updating
1516 */
1517 $current_sharing_options = $ss->get_global_options();
1518 foreach ( $current_sharing_options as $key => $val ) {
1519 if ( ! isset( $sharing_options[ $key ] ) ) {
1520 $sharing_options[ $key ] = $val;
1521 }
1522 }
1523
1524 $updated_social_options = $ss->set_global_options( $sharing_options );
1525
1526 if ( isset( $input['sharing_button_style'] ) ) {
1527 $updated['sharing_button_style'] = (string) $updated_social_options['button_style'];
1528 }
1529 if ( isset( $input['sharing_label'] ) ) {
1530 // Sharing_Service won't report label as updated if set to default.
1531 $updated['sharing_label'] = (string) $sharing_options['sharing_label'];
1532 }
1533 if ( isset( $input['sharing_show'] ) ) {
1534 $updated['sharing_show'] = (array) $updated_social_options['show'];
1535 }
1536 if ( isset( $input['sharing_open_links'] ) ) {
1537 $updated['sharing_open_links'] = (string) $updated_social_options['open_links'];
1538 }
1539 }
1540
1541 return array(
1542 'updated' => $updated,
1543 );
1544 }
1545
1546 /**
1547 * Get the string value of the jetpack_subscriptions_reply_to option.
1548 * When the option is not set, it will retun 'no-reply'.
1549 *
1550 * @return string
1551 */
1552 protected function get_subscriptions_reply_to_option() {
1553 $reply_to = get_option( 'jetpack_subscriptions_reply_to', null );
1554 if ( $reply_to === null ) {
1555 require_once JETPACK__PLUGIN_DIR . 'modules/subscriptions/class-settings.php';
1556 return Automattic\Jetpack\Modules\Subscriptions\Settings::$default_reply_to;
1557 }
1558 return $reply_to;
1559 }
1560
1561 /**
1562 * Check if the given value is a valid page ID for the current site.
1563 *
1564 * @param mixed $value The value to check.
1565 * @return bool True if the value is a valid page ID for the current site, false otherwise.
1566 */
1567 protected function is_valid_page_id( $value ) {
1568 $all_page_ids = get_all_page_ids();
1569
1570 $valid_page_id = false;
1571 foreach ( $all_page_ids as $page_id ) {
1572 if ( $page_id === (string) $value ) {
1573 $valid_page_id = true;
1574 break;
1575 }
1576 }
1577
1578 return $valid_page_id;
1579 }
1580
1581 /**
1582 * Get the value of the highlander_comment_form_prompt option.
1583 * When the option is not set, it will return the default value.
1584 *
1585 * @return string
1586 */
1587 protected function get_highlander_comment_form_prompt_option() {
1588 $highlander_comment_form_prompt_option = get_option( 'highlander_comment_form_prompt' );
1589
1590 if ( empty( $highlander_comment_form_prompt_option ) ) {
1591 return (string) __( 'Leave a comment', 'jetpack' );
1592 }
1593
1594 return (string) $highlander_comment_form_prompt_option;
1595 }
1596 }
1597