PluginProbe
Jetpack – WP Security, Backup, Speed, & Growth / 16.3-a.1
Jetpack – WP Security, Backup, Speed, & Growth v16.3-a.1
16.3-a.3 16.3-a.1 16.2 16.2-beta 12.0.3 12.1.3 12.2.3 12.3.2 12.4.2 12.5.2 12.6.4 12.7.3 12.8.3 12.9.5 13.0.2 13.1.5 13.2.4 13.3.3 13.4.5 13.5.2 13.6.2 13.7.2 13.8.3 13.9.2 14.0.1 All 504 releases
← All changes | json-endpoints/class.wpcom-json-api-site-settings-endpoint.php +407 -156 13.9.216.3-a.1 View file →
@@ -6,8 +6,12 @@
6 6 */
7 7
8 8 use Automattic\Jetpack\Waf\Brute_Force_Protection\Brute_Force_Protection_Shared_Functions;
9 9
10 +if ( ! defined( 'ABSPATH' ) ) {
11 + exit( 0 );
12 +}
13 +
10 14 new WPCOM_JSON_API_Site_Settings_Endpoint(
11 15 array(
12 16 'description' => 'Get detailed settings information about a site.',
13 17 'group' => '__do_not_document',
@@ -44,97 +48,99 @@
44 48 '$site' => '(int|string) Site ID or domain',
45 49 ),
46 50
47 51 'request_format' => array(
48 - 'migration_source_site_domain' => '(string) The source site URL, from the migration flow',
49 - 'in_site_migration_flow' => '(string) The migration flow the site is in',
50 - 'blogname' => '(string) Blog name',
51 - 'blogdescription' => '(string) Blog description',
52 - 'default_pingback_flag' => '(bool) Notify blogs linked from article?',
53 - 'default_ping_status' => '(bool) Allow link notifications from other blogs?',
54 - 'default_comment_status' => '(bool) Allow comments on new articles?',
55 - 'blog_public' => '(string) Site visibility; -1: private, 0: discourage search engines, 1: allow search engines',
56 - 'wpcom_data_sharing_opt_out' => '(bool) Did the site opt out of sharing public content with third parties and research partners?',
57 - 'jetpack_sync_non_public_post_stati' => '(bool) allow sync of post and pages with non-public posts stati',
58 - 'jetpack_relatedposts_enabled' => '(bool) Enable related posts?',
59 - 'jetpack_relatedposts_show_context' => '(bool) Show post\'s tags and category in related posts?',
60 - 'jetpack_relatedposts_show_date' => '(bool) Show date in related posts?',
61 - 'jetpack_relatedposts_show_headline' => '(bool) Show headline in related posts?',
62 - 'jetpack_relatedposts_show_thumbnails' => '(bool) Show thumbnails in related posts?',
63 - 'jetpack_protect_whitelist' => '(array) List of IP addresses to always allow',
64 - 'instant_search_enabled' => '(bool) Enable the new Jetpack Instant Search interface',
65 - 'jetpack_search_enabled' => '(bool) Enable Jetpack Search',
66 - 'jetpack_search_supported' => '(bool) Jetpack Search is supported',
67 - 'infinite_scroll' => '(bool) Support infinite scroll of posts?',
68 - 'default_category' => '(int) Default post category',
69 - 'default_post_format' => '(string) Default post format',
70 - 'require_name_email' => '(bool) Require comment authors to fill out name and email?',
71 - 'comment_registration' => '(bool) Require users to be registered and logged in to comment?',
72 - 'close_comments_for_old_posts' => '(bool) Automatically close comments on old posts?',
73 - 'close_comments_days_old' => '(int) Age at which to close comments',
74 - 'thread_comments' => '(bool) Enable threaded comments?',
75 - 'thread_comments_depth' => '(int) Depth to thread comments',
76 - 'page_comments' => '(bool) Break comments into pages?',
77 - 'comments_per_page' => '(int) Number of comments to display per page',
78 - 'default_comments_page' => '(string) newest|oldest Which page of comments to display first',
79 - 'comment_order' => '(string) asc|desc Order to display comments within page',
80 - 'comments_notify' => '(bool) Email me when someone comments?',
81 - 'moderation_notify' => '(bool) Email me when a comment is helf for moderation?',
82 - 'social_notifications_like' => '(bool) Email me when someone likes my post?',
83 - 'social_notifications_reblog' => '(bool) Email me when someone reblogs my post?',
84 - 'social_notifications_subscribe' => '(bool) Email me when someone subscribes to my blog?',
85 - 'comment_moderation' => '(bool) Moderate comments for manual approval?',
86 - 'comment_previously_approved' => '(bool) Moderate comments unless author has a previously-approved comment?',
87 - 'comment_max_links' => '(int) Moderate comments that contain X or more links',
88 - 'moderation_keys' => '(string) Words or phrases that trigger comment moderation, one per line',
89 - 'disallowed_keys' => '(string) Words or phrases that mark comment spam, one per line',
90 - 'lang_id' => '(int) ID for language blog is written in',
91 - 'wga' => '(array) Google Analytics Settings',
92 - 'disabled_likes' => '(bool) Are likes globally disabled (they can still be turned on per post)?',
93 - 'disabled_reblogs' => '(bool) Are reblogs disabled on posts?',
94 - 'jetpack_comment_likes_enabled' => '(bool) Are comment likes enabled for all comments?',
95 - 'sharing_button_style' => '(string) Style to use for sharing buttons (icon-text, icon, text, or official)',
96 - 'sharing_label' => '(string) Label to use for sharing buttons, e.g. "Share this:"',
97 - 'sharing_show' => '(string|array:string) Post type or array of types where sharing buttons are to be displayed',
98 - 'sharing_open_links' => '(string) Link target for sharing buttons (same or new)',
99 - 'twitter_via' => '(string) Twitter username to include in tweets when people share using the Twitter button',
100 - 'jetpack-twitter-cards-site-tag' => '(string) The Twitter username of the owner of the site\'s domain.',
101 - 'eventbrite_api_token' => '(int) The Keyring token ID for an Eventbrite token to associate with the site',
102 - 'timezone_string' => '(string) PHP-compatible timezone string like \'UTC-5\'',
103 - 'gmt_offset' => '(int) Site offset from UTC in hours',
104 - 'date_format' => '(string) PHP Date-compatible date format',
105 - 'time_format' => '(string) PHP Date-compatible time format',
106 - 'start_of_week' => '(int) Starting day of week (0 = Sunday, 6 = Saturday)',
107 - 'jetpack_testimonial' => '(bool) Whether testimonial custom post type is enabled for the site',
108 - 'jetpack_testimonial_posts_per_page' => '(int) Number of testimonials to show per page',
109 - 'jetpack_portfolio' => '(bool) Whether portfolio custom post type is enabled for the site',
110 - 'jetpack_portfolio_posts_per_page' => '(int) Number of portfolio projects to show per page',
111 - Jetpack_SEO_Utils::FRONT_PAGE_META_OPTION => '(string) The seo meta description for the site.',
112 - Jetpack_SEO_Titles::TITLE_FORMATS_OPTION => '(array) SEO meta title formats. Allowed keys: front_page, posts, pages, groups, archives',
113 - 'verification_services_codes' => '(array) Website verification codes. Allowed keys: google, pinterest, bing, yandex, facebook',
114 - 'markdown_supported' => '(bool) Whether markdown is supported for this site',
115 - 'wpcom_publish_posts_with_markdown' => '(bool) Whether markdown is enabled for posts',
116 - 'wpcom_publish_comments_with_markdown' => '(bool) Whether markdown is enabled for comments',
117 - 'site_icon' => '(int) Media attachment ID to use as site icon. Set to zero or an otherwise empty value to clear',
118 - 'api_cache' => '(bool) Turn on/off the Jetpack JSON API cache',
119 - 'posts_per_page' => '(int) Number of posts to show on blog pages',
120 - 'posts_per_rss' => '(int) Number of posts to show in the RSS feed',
121 - 'rss_use_excerpt' => '(bool) Whether the RSS feed will use post excerpts',
122 - 'launchpad_screen' => '(string) Whether or not launchpad is presented and what size it will be',
123 - 'sm_enabled' => '(bool) Whether the newsletter subscribe modal is enabled',
124 - 'jetpack_subscribe_overlay_enabled' => '(bool) Whether the newsletter subscribe overlay is enabled',
52 + 'migration_source_site_domain' => '(string) The source site URL, from the migration flow',
53 + 'in_site_migration_flow' => '(string) The migration flow the site is in',
54 + 'blogname' => '(string) Blog name',
55 + 'blogdescription' => '(string) Blog description',
56 + 'default_pingback_flag' => '(bool) Notify blogs linked from article?',
57 + 'default_ping_status' => '(bool) Allow link notifications from other blogs?',
58 + 'default_comment_status' => '(bool) Allow comments on new articles?',
59 + 'blog_public' => '(string) Site visibility; -1: private, 0: discourage search engines, 1: allow search engines',
60 + 'wpcom_data_sharing_opt_out' => '(bool) Did the site opt out of sharing public content with third parties and research partners?',
61 + 'jetpack_sync_non_public_post_stati' => '(bool) allow sync of post and pages with non-public posts stati',
62 + 'jetpack_relatedposts_enabled' => '(bool) Enable related posts?',
63 + 'jetpack_relatedposts_show_context' => '(bool) Show post\'s tags and category in related posts?',
64 + 'jetpack_relatedposts_show_date' => '(bool) Show date in related posts?',
65 + 'jetpack_relatedposts_show_headline' => '(bool) Show headline in related posts?',
66 + 'jetpack_relatedposts_show_thumbnails' => '(bool) Show thumbnails in related posts?',
67 + 'jetpack_protect_whitelist' => '(array) List of IP addresses to always allow',
68 + 'instant_search_enabled' => '(bool) Enable the new Jetpack Instant Search interface',
69 + 'jetpack_search_enabled' => '(bool) Enable Jetpack Search',
70 + 'jetpack_search_supported' => '(bool) Jetpack Search is supported',
71 + 'infinite_scroll' => '(bool) Support infinite scroll of posts?',
72 + 'default_category' => '(int) Default post category',
73 + 'default_post_format' => '(string) Default post format',
74 + 'require_name_email' => '(bool) Require comment authors to fill out name and email?',
75 + 'comment_registration' => '(bool) Require users to be registered and logged in to comment?',
76 + 'close_comments_for_old_posts' => '(bool) Automatically close comments on old posts?',
77 + 'close_comments_days_old' => '(int) Age at which to close comments',
78 + 'thread_comments' => '(bool) Enable threaded comments?',
79 + 'thread_comments_depth' => '(int) Depth to thread comments',
80 + 'page_comments' => '(bool) Break comments into pages?',
81 + 'comments_per_page' => '(int) Number of comments to display per page',
82 + 'default_comments_page' => '(string) newest|oldest Which page of comments to display first',
83 + 'comment_order' => '(string) asc|desc Order to display comments within page',
84 + 'comments_notify' => '(bool) Email me when someone comments?',
85 + 'moderation_notify' => '(bool) Email me when a comment is helf for moderation?',
86 + 'social_notifications_like' => '(bool) Email me when someone likes my post?',
87 + 'social_notifications_reblog' => '(bool) Email me when someone reblogs my post?',
88 + 'social_notifications_subscribe' => '(bool) Email me when someone subscribes to my blog?',
89 + 'comment_moderation' => '(bool) Moderate comments for manual approval?',
90 + 'comment_previously_approved' => '(bool) Moderate comments unless author has a previously-approved comment?',
91 + 'comment_max_links' => '(int) Moderate comments that contain X or more links',
92 + 'moderation_keys' => '(string) Words or phrases that trigger comment moderation, one per line',
93 + 'disallowed_keys' => '(string) Words or phrases that mark comment spam, one per line',
94 + 'lang_id' => '(int) ID for language blog is written in',
95 + 'wga' => '(array) Google Analytics Settings',
96 + 'disabled_likes' => '(bool) Are likes globally disabled (they can still be turned on per post)?',
97 + 'disabled_reblogs' => '(bool) Are reblogs disabled on posts?',
98 + 'jetpack_comment_likes_enabled' => '(bool) Are comment likes enabled for all comments?',
99 + 'sharing_button_style' => '(string) Style to use for sharing buttons (icon-text, icon, text, or official)',
100 + 'sharing_label' => '(string) Label to use for sharing buttons, e.g. "Share this:"',
101 + 'sharing_show' => '(string|array:string) Post type or array of types where sharing buttons are to be displayed',
102 + 'sharing_open_links' => '(string) Link target for sharing buttons (same or new)',
103 + 'twitter_via' => '(string) Twitter username to include in tweets when people share using the Twitter button',
104 + 'jetpack-twitter-cards-site-tag' => '(string) The Twitter username of the owner of the site\'s domain.',
105 + 'eventbrite_api_token' => '(int) The Keyring token ID for an Eventbrite token to associate with the site',
106 + 'timezone_string' => '(string) PHP-compatible timezone string like \'UTC-5\'',
107 + 'gmt_offset' => '(int) Site offset from UTC in hours',
108 + 'date_format' => '(string) PHP Date-compatible date format',
109 + 'time_format' => '(string) PHP Date-compatible time format',
110 + 'start_of_week' => '(int) Starting day of week (0 = Sunday, 6 = Saturday)',
111 + 'jetpack_testimonial' => '(bool) Whether testimonial custom post type is enabled for the site',
112 + 'jetpack_testimonial_posts_per_page' => '(int) Number of testimonials to show per page',
113 + 'jetpack_portfolio' => '(bool) Whether portfolio custom post type is enabled for the site',
114 + 'jetpack_portfolio_posts_per_page' => '(int) Number of portfolio projects to show per page',
115 + Jetpack_SEO_Utils::FRONT_PAGE_META_OPTION => '(string) The seo meta description for the site.',
116 + Jetpack_SEO_Titles::TITLE_FORMATS_OPTION => '(array) SEO meta title formats. Allowed keys: front_page, posts, pages, groups, archives',
117 + 'verification_services_codes' => '(array) Website verification codes. Allowed keys: google, pinterest, bing, yandex, facebook',
118 + 'markdown_supported' => '(bool) Whether markdown is supported for this site',
119 + 'wpcom_publish_posts_with_markdown' => '(bool) Whether markdown is enabled for posts',
120 + 'wpcom_publish_comments_with_markdown' => '(bool) Whether markdown is enabled for comments',
121 + 'site_icon' => '(int) Media attachment ID to use as site icon. Set to zero or an otherwise empty value to clear',
122 + 'api_cache' => '(bool) Turn on/off the Jetpack JSON API cache',
123 + 'posts_per_page' => '(int) Number of posts to show on blog pages',
124 + 'posts_per_rss' => '(int) Number of posts to show in the RSS feed',
125 + 'rss_use_excerpt' => '(bool) Whether the RSS feed will use post excerpts',
126 + 'launchpad_screen' => '(string) Whether or not launchpad is presented and what size it will be',
127 + 'sm_enabled' => '(bool) Whether the newsletter subscribe modal is enabled',
128 + 'jetpack_subscribe_overlay_enabled' => '(bool) Whether the newsletter subscribe overlay is enabled',
129 + 'jetpack_subscribe_floating_button_enabled' => '(bool) Whether the newsletter floating subscribe button is enabled',
125 130 'jetpack_subscriptions_subscribe_post_end_enabled' => '(bool) Whether the Subscribe block at the end of each post placement is enabled',
126 131 'jetpack_subscriptions_login_navigation_enabled' => '(bool) Whether the Subscriber Login block navigation placement is enabled',
127 132 'jetpack_subscriptions_subscribe_navigation_enabled' => '(Bool) Whether the Subscribe block navigation placement is enabled',
128 - 'wpcom_ai_site_prompt' => '(string) User input in the AI site prompt',
129 - 'jetpack_waf_automatic_rules' => '(bool) Whether the WAF should enforce automatic firewall rules',
130 - 'jetpack_waf_ip_allow_list' => '(string) List of IP addresses to always allow',
131 - 'jetpack_waf_ip_allow_list_enabled' => '(bool) Whether the IP allow list is enabled',
132 - 'jetpack_waf_ip_block_list' => '(string) List of IP addresses the WAF should always block',
133 - 'jetpack_waf_ip_block_list_enabled' => '(bool) Whether the IP block list is enabled',
134 - 'jetpack_waf_share_data' => '(bool) Whether the WAF should share basic data with Jetpack',
135 - 'jetpack_waf_share_debug_data' => '(bool) Whether the WAF should share debug data with Jetpack',
133 + 'wpcom_ai_site_prompt' => '(string) User input in the AI site prompt',
134 + 'jetpack_waf_automatic_rules' => '(bool) Whether the WAF should enforce automatic firewall rules',
135 + 'jetpack_waf_ip_allow_list' => '(string) List of IP addresses to always allow',
136 + 'jetpack_waf_ip_allow_list_enabled' => '(bool) Whether the IP allow list is enabled',
137 + 'jetpack_waf_ip_block_list' => '(string) List of IP addresses the WAF should always block',
138 + 'jetpack_waf_ip_block_list_enabled' => '(bool) Whether the IP block list is enabled',
139 + 'jetpack_waf_share_data' => '(bool) Whether the WAF should share basic data with Jetpack',
140 + 'jetpack_waf_share_debug_data' => '(bool) Whether the WAF should share debug data with Jetpack',
136 141 'jetpack_waf_automatic_rules_last_updated_timestamp' => '(int) Timestamp of the last time the automatic rules were updated',
142 + 'mcp_abilities' => '(array) List of MCP Abilities',
137 143 ),
138 144
139 145 'response_format' => array(
140 146 'updated' => '(array)',
@@ -145,8 +151,10 @@
145 151 );
146 152
147 153 /**
148 154 * Manage Site settings endpoint.
155 + *
156 + * @phan-constructor-used-for-side-effects
149 157 */
150 158 class WPCOM_JSON_API_Site_Settings_Endpoint extends WPCOM_JSON_API_Endpoint {
151 159
152 160 /**
@@ -326,12 +334,14 @@
326 334 case 'ID':
327 335 $response[ $key ] = $blog_id;
328 336 break;
329 337 case 'name':
330 - $response[ $key ] = (string) htmlspecialchars_decode( get_bloginfo( 'name' ), ENT_QUOTES );
338 + $name = get_bloginfo( 'name' );
339 + $response[ $key ] = is_string( $name ) ? htmlspecialchars_decode( $name, ENT_QUOTES ) : '';
331 340 break;
332 341 case 'description':
333 - $response[ $key ] = (string) htmlspecialchars_decode( get_bloginfo( 'description' ), ENT_QUOTES );
342 + $description = get_bloginfo( 'description' );
343 + $response[ $key ] = is_string( $description ) ? htmlspecialchars_decode( $description, ENT_QUOTES ) : '';
334 344 break;
335 345 case 'URL':
336 346 $response[ $key ] = (string) home_url();
337 347 break;
@@ -370,18 +380,19 @@
370 380 get_categories( array( 'hide_empty' => false ) )
371 381 )
372 382 );
373 383
374 - $newsletter_categories = maybe_unserialize( get_option( 'wpcom_newsletter_categories', array() ) );
375 - $newsletter_category_ids = array_map(
376 - function ( $newsletter_category ) {
377 - return $newsletter_category['term_id'];
378 - },
379 - $newsletter_categories
380 - );
384 + // Make sure we are returning a consistent type
385 + if ( ! class_exists( 'Jetpack_Newsletter_Category_Helper' ) ) {
386 + require_once JETPACK__PLUGIN_DIR . '_inc/lib/class-jetpack-newsletter-category-helper.php';
387 + }
388 + $newsletter_category_ids = Jetpack_Newsletter_Category_Helper::get_category_ids();
381 389
382 390 $api_cache = $site->is_jetpack() ? (bool) get_option( 'jetpack_api_cache_enabled' ) : true;
383 391
392 + // Get Sites MCP settings
393 + $mcp_abilities = $this->get_site_mcp_abilities();
394 +
384 395 $response[ $key ] = array(
385 396 // also exists as "options".
386 397 'admin_url' => get_admin_url(),
387 398 'default_ping_status' => 'closed' !== get_option( 'default_ping_status' ),
@@ -397,9 +408,9 @@
397 408 'jetpack_relatedposts_show_context' => ! empty( $jetpack_relatedposts_options['show_context'] ),
398 409 'jetpack_relatedposts_show_date' => ! empty( $jetpack_relatedposts_options['show_date'] ),
399 410 'jetpack_relatedposts_show_headline' => ! empty( $jetpack_relatedposts_options['show_headline'] ),
400 411 'jetpack_relatedposts_show_thumbnails' => ! empty( $jetpack_relatedposts_options['show_thumbnails'] ),
401 - 'jetpack_search_enabled' => (bool) $jetpack_search_active,
412 + 'jetpack_search_enabled' => $jetpack_search_active,
402 413 'jetpack_search_supported' => (bool) $jetpack_search_supported,
403 414 'default_category' => (int) get_option( 'default_category' ),
404 415 'post_categories' => (array) $post_categories,
405 416 'default_post_format' => get_option( 'default_post_format' ),
@@ -455,14 +466,26 @@
455 466 'markdown_supported' => true,
456 467 'site_icon' => $this->get_cast_option_value_or_null( 'site_icon', 'intval' ),
457 468 Jetpack_SEO_Utils::FRONT_PAGE_META_OPTION => get_option( Jetpack_SEO_Utils::FRONT_PAGE_META_OPTION, '' ),
458 469 Jetpack_SEO_Titles::TITLE_FORMATS_OPTION => get_option( Jetpack_SEO_Titles::TITLE_FORMATS_OPTION, array() ),
470 + 'verification_services_codes' => get_option( 'verification_services_codes', null ),
459 471 'api_cache' => $api_cache,
460 472 'posts_per_page' => (int) get_option( 'posts_per_page' ),
461 473 'posts_per_rss' => (int) get_option( 'posts_per_rss' ),
462 474 'rss_use_excerpt' => (bool) get_option( 'rss_use_excerpt' ),
463 475 'launchpad_screen' => (string) get_option( 'launchpad_screen' ),
464 - 'wpcom_featured_image_in_email' => (bool) get_option( 'wpcom_featured_image_in_email' ),
476 + 'wpcom_newsletter_send_default' => (bool) get_option( 'wpcom_newsletter_send_default', true ),
477 + 'wpcom_featured_image_in_email' => ( function () use ( $site ) {
478 + if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
479 + $registered_date = method_exists( $site, 'get_registered_date' ) ? $site->get_registered_date() : '';
480 + // Compare to May 2, 2025 (ISO 8601 format)
481 + if ( $registered_date && $registered_date !== '0000-00-00T00:00:00+00:00' && strtotime( $registered_date ) >= strtotime( '2025-05-02T00:00:00+00:00' ) ) {
482 + return (bool) get_option( 'wpcom_featured_image_in_email', true );
483 + }
484 + }
485 + // For all other sites, use the saved value or default to false for legacy behavior.
486 + return (bool) get_option( 'wpcom_featured_image_in_email', false );
487 + } )(),
465 488 'jetpack_gravatar_in_email' => (bool) get_option( 'jetpack_gravatar_in_email', true ),
466 489 'jetpack_author_in_email' => (bool) get_option( 'jetpack_author_in_email', true ),
467 490 'jetpack_post_date_in_email' => (bool) get_option( 'jetpack_post_date_in_email', true ),
468 491 'wpcom_newsletter_categories' => $newsletter_category_ids,
@@ -468,20 +491,22 @@
468 491 'wpcom_newsletter_categories' => $newsletter_category_ids,
469 492 'wpcom_newsletter_categories_enabled' => (bool) get_option( 'wpcom_newsletter_categories_enabled' ),
470 493 'sm_enabled' => (bool) get_option( 'sm_enabled' ),
471 494 'jetpack_subscribe_overlay_enabled' => (bool) get_option( 'jetpack_subscribe_overlay_enabled' ),
495 + 'jetpack_subscribe_floating_button_enabled' => (bool) get_option( 'jetpack_subscribe_floating_button_enabled' ),
472 496 'jetpack_subscriptions_subscribe_post_end_enabled' => (bool) get_option( 'jetpack_subscriptions_subscribe_post_end_enabled' ),
473 497 'jetpack_subscriptions_login_navigation_enabled' => (bool) get_option( 'jetpack_subscriptions_login_navigation_enabled' ),
474 498 'jetpack_subscriptions_subscribe_navigation_enabled' => (bool) get_option( 'jetpack_subscriptions_subscribe_navigation_enabled' ),
475 499 'wpcom_gifting_subscription' => (bool) get_option( 'wpcom_gifting_subscription', $this->get_wpcom_gifting_subscription_default() ),
476 500 'wpcom_reader_views_enabled' => (bool) get_option( 'wpcom_reader_views_enabled', true ),
477 - 'wpcom_subscription_emails_use_excerpt' => $this->get_wpcom_subscription_emails_use_excerpt_option(),
501 + 'wpcom_subscription_emails_use_excerpt' => (bool) get_option( 'wpcom_subscription_emails_use_excerpt' ),
478 502 'jetpack_subscriptions_reply_to' => (string) $this->get_subscriptions_reply_to_option(),
479 503 'jetpack_subscriptions_from_name' => (string) get_option( 'jetpack_subscriptions_from_name' ),
480 504 'show_on_front' => (string) get_option( 'show_on_front' ),
481 505 'page_on_front' => (string) get_option( 'page_on_front' ),
482 506 'page_for_posts' => (string) get_option( 'page_for_posts' ),
483 - 'subscription_options' => (array) get_option( 'subscription_options' ),
507 + 'subscription_options' => $this->get_subscription_options_in_user_locale(),
508 + 'supports_free_tier_customization' => true,
484 509 'jetpack_verbum_subscription_modal' => (bool) get_option( 'jetpack_verbum_subscription_modal', true ),
485 510 'enable_verbum_commenting' => (bool) get_option( 'enable_verbum_commenting', true ),
486 511 'enable_blocks_comments' => (bool) get_option( 'enable_blocks_comments', true ),
487 512 'highlander_comment_form_prompt' => $this->get_highlander_comment_form_prompt_option(),
@@ -496,10 +521,24 @@
496 521 'jetpack_waf_share_data' => (bool) get_option( 'jetpack_waf_share_data' ),
497 522 'jetpack_waf_share_debug_data' => (bool) get_option( 'jetpack_waf_share_debug_data' ),
498 523 'jetpack_waf_automatic_rules_last_updated_timestamp' => (int) get_option( 'jetpack_waf_automatic_rules_last_updated_timestamp' ),
499 524 'is_fully_managed_agency_site' => (bool) get_option( 'is_fully_managed_agency_site' ),
525 + 'wpcom_hide_action_bar' => (bool) get_option( 'wpcom_hide_action_bar' ),
526 + 'mcp_abilities' => $mcp_abilities,
500 527 );
501 528
529 + require_once JETPACK__PLUGIN_DIR . '/modules/memberships/class-jetpack-memberships.php';
530 + if ( class_exists( 'Jetpack_Memberships' ) ) {
531 + $response[ $key ]['newsletter_has_active_plan'] = count( Jetpack_Memberships::get_all_newsletter_plan_ids( false ) ) > 0;
532 + // Read-only/derived: the free tier's markdown description rendered to
533 + // safe HTML, colocated with subscription_options so it's
534 + // read-after-write consistent. Not part of the writable
535 + // subscription_options bag (which would round-trip and persist it).
536 + $response[ $key ]['free_tier_description_rendered'] = Jetpack_Memberships::render_tier_description_html(
537 + ( (array) get_option( 'subscription_options' ) )['free_tier_description'] ?? ''
538 + );
539 + }
540 +
502 541 if ( defined( 'IS_WPCOM' ) && IS_WPCOM ) {
503 542 $response[ $key ]['wpcom_publish_posts_with_markdown'] = (bool) WPCom_Markdown::get_instance()->is_posting_enabled();
504 543 $response[ $key ]['wpcom_publish_comments_with_markdown'] = (bool) WPCom_Markdown::get_instance()->is_commenting_enabled();
505 544
@@ -594,8 +633,158 @@
594 633 return false;
595 634 }
596 635
597 636 /**
637 + * Reads `subscription_options` with the current user's locale active, to
638 + * ensure that the defaults would be translated when displaying to the user
639 + * or comparing the options before saving.
640 + *
641 + * @return array The `subscription_options` value, defaults included.
642 + */
643 + private function get_subscription_options_in_user_locale() {
644 + $switched_locale = false;
645 +
646 + if ( function_exists( 'wpcom_switch_to_user_locale' ) ) {
647 + // Compare the locales before/after switch to decide if we should switch back
648 + $locale_before = determine_locale();
649 + // @phan-suppress-next-line PhanUndeclaredFunction -- Checked above. See also https://github.com/phan/phan/issues/1204.
650 + wpcom_switch_to_user_locale();
651 + $switched_locale = determine_locale() !== $locale_before;
652 + }
653 +
654 + // Resolve the defaults the same way get_option() does for a missing row (via the
655 + // `default_option_*` filter with $passed_default = false), then let any stored
656 + // sub-keys take precedence. Passing an array default keeps get_option() from
657 + // re-populating the defaults, so a partial row stays partial before the merge.
658 + $default_subscription_options = (array) apply_filters( 'default_option_subscription_options', array(), 'subscription_options', false );
659 + $stored_subscription_options = (array) get_option( 'subscription_options', array() );
660 + $subscription_options = array_merge( $default_subscription_options, $stored_subscription_options );
661 +
662 + if ( $switched_locale ) {
663 + restore_previous_locale();
664 + }
665 +
666 + return $subscription_options;
667 + }
668 +
669 + /**
670 + * Get list of all site level MCP abilities.
671 + *
672 + * @return array
673 + */
674 + private function get_all_site_mcp_abilities(): array {
675 + $all_abilities = array();
676 + $ability_registry_file = WP_CONTENT_DIR . '/mu-plugins/wpcom-mcp/includes/AbilitiesRegistry/Registry/AbilityRegistry.php';
677 + if ( file_exists( $ability_registry_file ) ) {
678 + require_once $ability_registry_file;
679 + // @phan-suppress-next-line PhanUndeclaredClassMethod
680 + $abilities_resources = Automattic\WpcomMcp\AbilitiesRegistry\Registry\AbilityRegistry::get_resources_for_server( 'site-level' );
681 + // @phan-suppress-next-line PhanUndeclaredClassMethod
682 + $abilities_tools = Automattic\WpcomMcp\AbilitiesRegistry\Registry\AbilityRegistry::get_tools_for_server( 'site-level' );
683 + // @phan-suppress-next-line PhanUndeclaredClassMethod
684 + $abilities_prompts = Automattic\WpcomMcp\AbilitiesRegistry\Registry\AbilityRegistry::get_prompts_for_server( 'site-level' );
685 + $all_abilities = array_merge( $abilities_resources, $abilities_tools, $abilities_prompts );
686 + }
687 + return apply_filters( 'jetpack_site_mcp_abilities', $all_abilities );
688 + }
689 +
690 + /**
691 + * Get ability meta from config.
692 + *
693 + * @param string $ability_name Ability name, i.e. wpcom-mcp/posts-search.
694 + *
695 + * @return array
696 + */
697 + private function get_mcp_abilities_metadata( string $ability_name ): array {
698 + $ability_meta = array();
699 + $ability_registry_file = WP_CONTENT_DIR . '/mu-plugins/wpcom-mcp/includes/AbilitiesRegistry/Registry/AbilityRegistry.php';
700 + if ( file_exists( $ability_registry_file ) ) {
701 + require_once $ability_registry_file;
702 + // @phan-suppress-next-line PhanUndeclaredClassMethod
703 + $ability_meta = Automattic\WpcomMcp\AbilitiesRegistry\Registry\AbilityRegistry::get_metadata( $ability_name );
704 + }
705 + return apply_filters( 'jetpack_site_mcp_ability_meta', $ability_meta, $ability_name );
706 + }
707 +
708 + /**
709 + * Get MCP abilities for the current site.
710 + *
711 + * @return array
712 + */
713 + public function get_site_mcp_abilities(): array {
714 + $current_mcp_abilities = get_option( 'mcp_abilities', array() );
715 + if ( ! is_array( $current_mcp_abilities ) ) {
716 + $current_mcp_abilities = array();
717 + }
718 +
719 + $all_abilities = $this->get_all_site_mcp_abilities();
720 + if ( empty( $all_abilities ) ) {
721 + return array();
722 + }
723 +
724 + $computed_abilities = array();
725 + foreach ( $all_abilities as $ability_name ) {
726 + // Get base metadata first
727 + $ability_meta = $this->get_mcp_abilities_metadata( $ability_name );
728 + if ( ! empty( $ability_meta ) ) {
729 + // Use stored value or fall back to metadata default
730 + $enabled = $current_mcp_abilities[ $ability_name ] ?? $ability_meta['enabled'] ?? false;
731 +
732 + $computed_abilities[ $ability_name ] = array(
733 + 'name' => $ability_name,
734 + 'title' => $ability_meta['title'] ?? '',
735 + 'description' => $ability_meta['description'] ?? '',
736 + 'category' => $ability_meta['category'] ?? '',
737 + 'type' => $ability_meta['type'] ?? '',
738 + 'enabled' => (bool) $enabled,
739 + );
740 + }
741 + }
742 + return $computed_abilities;
743 + }
744 +
745 + /**
746 + * Sets the MCP abilities for the current site.
747 + *
748 + * @param mixed $value MCP abilities array.
749 + *
750 + * @return true|WP_Error
751 + */
752 + public function set_site_mcp_abilities( $value ) {
753 + // Validate input format
754 + if ( ! is_array( $value ) ) {
755 + return new WP_Error( 'invalid_format', __( 'Site MCP abilities must be an array', 'jetpack' ) );
756 + }
757 +
758 + $all_abilities = $this->get_all_site_mcp_abilities();
759 +
760 + // Filter ability names that don't exist
761 + $value = array_filter(
762 + $value,
763 + function ( $ability_name ) use ( $all_abilities ) {
764 + return in_array( $ability_name, $all_abilities, true );
765 + },
766 + ARRAY_FILTER_USE_KEY
767 + );
768 +
769 + // Validate each ability exists and value is boolean-like
770 + foreach ( $value as $ability_name => $enabled ) {
771 + if ( ! is_string( $ability_name ) || ( ! WPCOM_JSON_API::is_truthy( $enabled ) && ! WPCOM_JSON_API::is_falsy( $enabled ) ) ) {
772 + $error_message = sprintf(
773 + // Translators: %s is an MCP ability name
774 + __( 'Invalid ability: %s', 'jetpack' ),
775 + $ability_name
776 + );
777 + return new WP_Error( 'invalid_ability', $error_message );
778 + }
779 + }
780 +
781 + update_option( 'mcp_abilities', $value );
782 +
783 + return true;
784 + }
785 +
786 + /**
598 787 * Get locale.
599 788 *
600 789 * @param string $key Language.
601 790 */
@@ -643,8 +832,12 @@
643 832 $jetpack_relatedposts_options = array();
644 833 $sharing_options = array();
645 834 $updated = array();
646 835
836 + if ( ! class_exists( 'Jetpack_Newsletter_Category_Helper' ) ) {
837 + require_once JETPACK__PLUGIN_DIR . '_inc/lib/class-jetpack-newsletter-category-helper.php';
838 + }
839 +
647 840 foreach ( $input as $key => $value ) {
648 841
649 842 if ( ! is_array( $value ) ) {
650 843 $value = trim( $value );
@@ -686,8 +879,9 @@
686 879 case 'jetpack_search_enabled':
687 880 if ( $value ) {
688 881 Jetpack::activate_module( $blog_id, 'search' );
689 882 } else {
883 + // @phan-suppress-next-line PhanParamTooMany -- Phan doesn't know about the WP.com variant of the Jetpack class.
690 884 Jetpack::deactivate_module( $blog_id, 'search' );
691 885 }
692 886 $updated[ $key ] = (bool) $value;
693 887 break;
@@ -702,8 +896,9 @@
702 896 if ( 'jetpack_relatedposts_enabled' === $key ) {
703 897 if ( $value ) {
704 898 Jetpack::activate_module( $blog_id, 'related-posts' );
705 899 } else {
900 + // @phan-suppress-next-line PhanParamTooMany -- Phan doesn't know about the WP.com variant of the Jetpack class.
706 901 Jetpack::deactivate_module( $blog_id, 'related-posts' );
707 902 }
708 903 }
709 904 $just_the_key = substr( $key, 21 );
@@ -812,9 +1007,9 @@
812 1007 if ( ! is_array( $value ) ) {
813 1008 break;
814 1009 }
815 1010
816 - $allowed_keys = array( 'invitation', 'comment_follow', 'welcome' );
1011 + $allowed_keys = array( 'invitation', 'comment_follow', 'welcome', 'subscribe_modal_heading', 'free_tier_description', 'hide_free_tier' );
817 1012 $filtered_value = array_filter(
818 1013 $value,
819 1014 function ( $key ) use ( $allowed_keys ) {
820 1015 return in_array( $key, $allowed_keys, true );
@@ -825,8 +1020,16 @@
825 1020 if ( empty( $filtered_value ) ) {
826 1021 break;
827 1022 }
828 1023
1024 + // `hide_free_tier` is a boolean flag, so pull it out before the HTML
1025 + // sanitization below (which expects strings). Parse it with is_truthy()
1026 + // so stringy booleans (e.g. "false", "0") are interpreted correctly
1027 + // rather than being treated as truthy by a plain `! empty()`.
1028 + $has_hide_free_tier = array_key_exists( 'hide_free_tier', $filtered_value );
1029 + $hide_free_tier = $has_hide_free_tier && WPCOM_JSON_API::is_truthy( $filtered_value['hide_free_tier'] );
1030 + unset( $filtered_value['hide_free_tier'] );
1031 +
829 1032 array_walk_recursive(
830 1033 $filtered_value,
831 1034 function ( &$value ) {
832 1035 $value = wp_kses(
@@ -839,13 +1042,89 @@
839 1042 );
840 1043 }
841 1044 );
842 1045
843 - $old_subscription_options = get_option( 'subscription_options' );
844 - $new_subscription_options = array_merge( $old_subscription_options, $filtered_value );
1046 + // Normalize whitespace-only `subscribe_modal_heading` input to empty so
1047 + // the modal template's `empty()` fallback fires. PHP's `empty()` treats
1048 + // `" "` as non-empty, which would otherwise render a blank heading.
1049 + if ( isset( $filtered_value['subscribe_modal_heading'] ) ) {
1050 + $filtered_value['subscribe_modal_heading'] = trim( $filtered_value['subscribe_modal_heading'] );
1051 + }
845 1052
1053 + // The free tier description is stored as plain markdown source, so strip
1054 + // all HTML and cap its length to match the paid-tier description field.
1055 + // WordPress core guarantees mb_substr() (polyfilled in wp-includes/compat.php
1056 + // when the mbstring extension is unavailable), so it's safe to use directly.
1057 + // A JSON payload could supply a non-scalar (array/object) for this field,
1058 + // which would fatal in wp_kses()/mb_substr() on PHP 8+, so drop invalid values.
1059 + if ( isset( $filtered_value['free_tier_description'] ) ) {
1060 + if ( is_scalar( $filtered_value['free_tier_description'] ) ) {
1061 + $filtered_value['free_tier_description'] = mb_substr( wp_kses( (string) $filtered_value['free_tier_description'], array() ), 0, 500 );
1062 + } else {
1063 + unset( $filtered_value['free_tier_description'] );
1064 + }
1065 + }
1066 +
1067 + if ( $has_hide_free_tier ) {
1068 + $filtered_value['hide_free_tier'] = $hide_free_tier;
1069 + }
1070 +
1071 + // Clients that render the settings form tend to post the whole
1072 + // `subscription_options` bag back, including sub-keys the user never
1073 + // touched. This could result in a translated value inadvertently
1074 + // saved in the database.
1075 + // Get the value from db or the default options populated by filter.
1076 + $current_subscription_options = $this->get_subscription_options_in_user_locale();
1077 + $changed_subscription_options = array();
1078 +
1079 + foreach ( $filtered_value as $subscription_option_key => $subscription_option_value ) {
1080 + $current_subscription_option = $current_subscription_options[ $subscription_option_key ] ?? null;
1081 +
1082 + // The incoming value has already been through wp_kses() above, and
1083 + // wp_kses() is not guaranteed to be byte-preserving — it rewrites
1084 + // attribute quoting, and differently across WordPress versions. Put the
1085 + // current value through the same pass so the comparison reflects a real
1086 + // edit rather than a sanitizer rewrite; without this, a default carrying
1087 + // markup (`invitation`) never compares equal and is persisted on every
1088 + // save. Safe to apply to an already-sanitized value: the pass is
1089 + // idempotent.
1090 + if ( is_string( $current_subscription_option ) ) {
1091 + $current_subscription_option = wp_kses(
1092 + $current_subscription_option,
1093 + array(
1094 + 'a' => array(
1095 + 'href' => array(),
1096 + ),
1097 + )
1098 + );
1099 + }
1100 +
1101 + // A sub-key the site has never stored reads as unset everywhere this
1102 + // option is consumed, so an empty incoming value for it is not a change.
1103 + if (
1104 + null === $current_subscription_option
1105 + && ( '' === $subscription_option_value || false === $subscription_option_value )
1106 + ) {
1107 + continue;
1108 + }
1109 +
1110 + if ( $current_subscription_option === $subscription_option_value ) {
1111 + continue;
1112 + }
1113 +
1114 + $changed_subscription_options[ $subscription_option_key ] = $subscription_option_value;
1115 + }
1116 +
1117 + if ( empty( $changed_subscription_options ) ) {
1118 + break;
1119 + }
1120 +
1121 + // Get the value from the database or an empty array.
1122 + $old_subscription_options = get_option( 'subscription_options', array() );
1123 + $new_subscription_options = array_merge( $old_subscription_options, $changed_subscription_options );
1124 +
846 1125 if ( update_option( $key, $new_subscription_options ) ) {
847 - $updated[ $key ] = $filtered_value;
1126 + $updated[ $key ] = $changed_subscription_options;
848 1127 }
849 1128 break;
850 1129
851 1130 case 'woocommerce_onboarding_profile':
@@ -1002,9 +1281,9 @@
1002 1281 case 'jetpack_subscriptions_reply_to':
1003 1282 require_once JETPACK__PLUGIN_DIR . 'modules/subscriptions/class-settings.php';
1004 1283 $to_set_value = Automattic\Jetpack\Modules\Subscriptions\Settings::is_valid_reply_to( $value )
1005 1284 ? (string) $value
1006 - : Automattic\Jetpack\Modules\Subscriptions\Settings::get_default_reply_to();
1285 + : Automattic\Jetpack\Modules\Subscriptions\Settings::$default_reply_to;
1007 1286
1008 1287 if ( update_option( $key, $to_set_value ) ) {
1009 1288 $updated[ $key ] = $to_set_value;
1010 1289 }
@@ -1033,49 +1312,24 @@
1033 1312 update_option( 'lang_id', (int) $value );
1034 1313 $updated[ $key ] = (int) $value;
1035 1314 break;
1036 1315
1316 + case 'wpcom_newsletter_send_default':
1317 + update_option( 'wpcom_newsletter_send_default', (int) (bool) $value );
1318 + $updated[ $key ] = (int) (bool) $value;
1319 + break;
1320 +
1037 1321 case 'wpcom_featured_image_in_email':
1038 1322 update_option( 'wpcom_featured_image_in_email', (int) (bool) $value );
1039 1323 $updated[ $key ] = (int) (bool) $value;
1040 1324 break;
1041 1325
1042 - case 'wpcom_newsletter_categories':
1043 - $sanitized_category_ids = (array) $value;
1326 + case Jetpack_Newsletter_Category_Helper::NEWSLETTER_CATEGORIES_OPTION:
1327 + $update_newsletter_categories = Jetpack_Newsletter_Category_Helper::save_category_ids( (array) $value );
1328 + if ( $update_newsletter_categories ) {
1329 + $updated[ $key ] = $update_newsletter_categories;
1330 + }
1044 1331
1045 - array_walk_recursive(
1046 - $sanitized_category_ids,
1047 - function ( &$value ) {
1048 - if ( is_int( $value ) && $value > 0 ) {
1049 - return;
1050 - }
1051 -
1052 - $value = (int) $value;
1053 - if ( $value <= 0 ) {
1054 - $value = null;
1055 - }
1056 - }
1057 - );
1058 -
1059 - $sanitized_category_ids = array_unique(
1060 - array_filter(
1061 - $sanitized_category_ids,
1062 - function ( $category_id ) {
1063 - return $category_id !== null;
1064 - }
1065 - )
1066 - );
1067 -
1068 - $new_value = array_map(
1069 - function ( $category_id ) {
1070 - return array( 'term_id' => $category_id );
1071 - },
1072 - $sanitized_category_ids
1073 - );
1074 -
1075 - if ( update_option( $key, $new_value ) ) {
1076 - $updated[ $key ] = $sanitized_category_ids;
1077 - }
1078 1332 break;
1079 1333
1080 1334 case 'wpcom_newsletter_categories_enabled':
1081 1335 update_option( 'wpcom_newsletter_categories_enabled', (int) (bool) $value );
@@ -1091,8 +1345,13 @@
1091 1345 update_option( 'jetpack_subscribe_overlay_enabled', (int) (bool) $value );
1092 1346 $updated[ $key ] = (int) (bool) $value;
1093 1347 break;
1094 1348
1349 + case 'jetpack_subscribe_floating_button_enabled':
1350 + update_option( 'jetpack_subscribe_floating_button_enabled', (int) (bool) $value );
1351 + $updated[ $key ] = (int) (bool) $value;
1352 + break;
1353 +
1095 1354 case 'jetpack_subscriptions_subscribe_post_end_enabled':
1096 1355 update_option( 'jetpack_subscriptions_subscribe_post_end_enabled', (int) (bool) $value );
1097 1356 $updated[ $key ] = (int) (bool) $value;
1098 1357 break;
@@ -1175,8 +1434,9 @@
1175 1434 $updated[ $key ] = $value;
1176 1435 break;
1177 1436
1178 1437 case 'is_fully_managed_agency_site':
1438 + case 'wpcom_hide_action_bar':
1179 1439 $coerce_value = (int) (bool) $value;
1180 1440 if ( update_option( $key, $coerce_value ) ) {
1181 1441 $updated[ $key ] = (bool) $coerce_value;
1182 1442 }
@@ -1181,8 +1441,16 @@
1181 1441 $updated[ $key ] = (bool) $coerce_value;
1182 1442 }
1183 1443 break;
1184 1444
1445 + case 'mcp_abilities':
1446 + $result = $this->set_site_mcp_abilities( $value );
1447 + if ( is_wp_error( $result ) ) {
1448 + return $result;
1449 + }
1450 + $updated[ $key ] = $this->get_site_mcp_abilities();
1451 + break;
1452 +
1185 1453 default:
1186 1454 // allow future versions of this endpoint to support additional settings keys.
1187 1455 if ( has_filter( 'site_settings_endpoint_update_' . $key ) ) {
1188 1456 /**
@@ -1275,25 +1543,8 @@
1275 1543 );
1276 1544 }
1277 1545
1278 1546 /**
1279 - * Get the value of the wpcom_subscription_emails_use_excerpt option.
1280 - * When the option is not set, it will return the value of the rss_use_excerpt option.
1281 - *
1282 - * @return bool
1283 - */
1284 - protected function get_wpcom_subscription_emails_use_excerpt_option() {
1285 - $wpcom_subscription_emails_use_excerpt = get_option( 'wpcom_subscription_emails_use_excerpt', null );
1286 -
1287 - if ( $wpcom_subscription_emails_use_excerpt === null ) {
1288 - $rss_use_excerpt = get_option( 'rss_use_excerpt', null );
1289 - $wpcom_subscription_emails_use_excerpt = $rss_use_excerpt === null ? false : $rss_use_excerpt;
1290 - }
1291 -
1292 - return (bool) $wpcom_subscription_emails_use_excerpt;
1293 - }
1294 -
1295 - /**
1296 1547 * Get the string value of the jetpack_subscriptions_reply_to option.
1297 1548 * When the option is not set, it will retun 'no-reply'.
1298 1549 *
1299 1550 * @return string
@@ -1301,9 +1552,9 @@
1301 1552 protected function get_subscriptions_reply_to_option() {
1302 1553 $reply_to = get_option( 'jetpack_subscriptions_reply_to', null );
1303 1554 if ( $reply_to === null ) {
1304 1555 require_once JETPACK__PLUGIN_DIR . 'modules/subscriptions/class-settings.php';
1305 - return Automattic\Jetpack\Modules\Subscriptions\Settings::get_default_reply_to();
1556 + return Automattic\Jetpack\Modules\Subscriptions\Settings::$default_reply_to;
1306 1557 }
1307 1558 return $reply_to;
1308 1559 }
1309 1560