| @@ -142,8 +142,9 @@ | ||
| 142 | 142 | // If everything is okay return the response. |
| 143 | 143 | if ( isset( $response ) && is_object( $response ) && false !== $response ) { |
| 144 | 144 | return $response; |
| 145 | 145 | } |
| 146 | + return false; | |
| 146 | 147 | } |
| 147 | 148 | |
| 148 | 149 | /** |
| 149 | 150 | * Sends and receives data to and from the server API. |
| @@ -169,8 +170,40 @@ | ||
| 169 | 170 | ); |
| 170 | 171 | |
| 171 | 172 | $params = apply_filters( 'mainwp_plugin_information_sslverify', $default, $args ); |
| 172 | 173 | |
| 174 | + // MWP-1546 (Codex follow-up): redact api_key everywhere it appears | |
| 175 | + // before handing data to the logger. The previous code only masked | |
| 176 | + // the top-level api_key; the per-extension api_keys nested inside | |
| 177 | + // the bulk-check `extensions` payload (and the api_key= param baked | |
| 178 | + // into target_url itself) were both written to the log in plaintext. | |
| 179 | + // For installs running the file logger that turned every cron | |
| 180 | + // update-check tick into a persistence path for credentials. | |
| 181 | + $log_args = $args; | |
| 182 | + if ( isset( $log_args['api_key'] ) ) { | |
| 183 | + $log_args['api_key'] = '***'; | |
| 184 | + } | |
| 185 | + | |
| 186 | + if ( ! empty( $log_args['extensions'] ) ) { | |
| 187 | + $log_exts = json_decode( base64_decode( $log_args['extensions'] ), true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions -- NOSONAR base64_decode used for http encoding compatible. | |
| 188 | + if ( is_array( $log_exts ) ) { | |
| 189 | + foreach ( $log_exts as $log_ext_key => $log_ext ) { | |
| 190 | + if ( is_array( $log_ext ) && isset( $log_ext['api_key'] ) ) { | |
| 191 | + $log_exts[ $log_ext_key ]['api_key'] = '***'; | |
| 192 | + } | |
| 193 | + } | |
| 194 | + } else { | |
| 195 | + $log_exts = array(); | |
| 196 | + } | |
| 197 | + $log_args['_decoded_extensions'] = $log_exts; | |
| 198 | + unset( $log_args['extensions'] ); | |
| 199 | + } | |
| 200 | + | |
| 201 | + // Strip api_key from the URL query string before logging. | |
| 202 | + $log_target_url = preg_replace( '/(\?|&)api_key=[^&]*/', '$1api_key=***', $target_url ); | |
| 203 | + | |
| 204 | + MainWP_Logger::instance()->log_events( 'extension-updates-check', sprintf( '[target_url=%s] :: [params=%s] :: [bulk_check=%s]', $log_target_url, print_r( $log_args, true ), $bulk_check ? 'true' : 'false' ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions -- print_r used for debugging. | |
| 205 | + | |
| 173 | 206 | $request = wp_remote_get( |
| 174 | 207 | $target_url, |
| 175 | 208 | $params |
| 176 | 209 | ); |
| @@ -179,8 +212,10 @@ | ||
| 179 | 212 | return false; |
| 180 | 213 | } |
| 181 | 214 | |
| 182 | 215 | $response = wp_remote_retrieve_body( $request ); |
| 216 | + | |
| 217 | + MainWP_Logger::instance()->log_events( 'extension-updates-check', sprintf( '[response=%s]', $response ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions -- print_r used for debugging. | |
| 183 | 218 | |
| 184 | 219 | if ( isset( $args['json'] ) ) { // bulkupdatecheck: json. |
| 185 | 220 | $response = json_decode( $response, true ); |
| 186 | 221 | } else { // pluginupdatecheck, plugininformation : serialize. |
