← All changes | custom-pages/class-metasync-custom-pages-api.php +15 -15 2.6.21 → 2.7.1 View file →

		@@ -851,10 +851,10 @@
851	851	}
852	852
853	853	$zip_path = $tmp_file;
854	854
855		- } elseif (!empty($_FILES['zip_file']) && is_array($_FILES['zip_file'])) {
856		- $file = $_FILES['zip_file'];
	855	+ } elseif (!empty($_FILES['zip_file']) && is_array($_FILES['zip_file'])) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- REST route authenticated by API key, not cookies
	856	+ $file = $_FILES['zip_file']; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- REST route authenticated by API key, not cookies
857	857	$_lps_input['source_type'] = 'upload';
858	858
859	859	if (!isset($file['error']) || $file['error'] !== UPLOAD_ERR_OK) {
860	860	$_lps_http_st = 400;
		@@ -929,9 +929,9 @@
929	929	return $response;
930	930
931	931	} finally {
932	932	if (!empty($tmp_file) && file_exists($tmp_file)) {
933		- @unlink($tmp_file);
	933	+ @wp_delete_file($tmp_file);
934	934	}
935	935	}
936	936	} finally {
937	937	self::write_lps_import_audit(array(
		@@ -1290,9 +1290,9 @@
1290	1290
1291	1291	} finally {
1292	1292	if (is_resource($lps_import_lock)) {
1293	1293	@flock($lps_import_lock, LOCK_UN);
1294		- @fclose($lps_import_lock);
	1294	+ @fclose($lps_import_lock); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- operates on a native stream handle
1295	1295	}
1296	1296	}
1297	1297	}
1298	1298
		@@ -1316,14 +1316,14 @@
1316	1316	wp_mkdir_p($lock_dir);
1317	1317	}
1318	1318	$lock_path = trailingslashit($lock_dir) . md5($assets_folder) . '.lock';
1319	1319
1320		- $handle = @fopen($lock_path, 'c');
	1320	+ $handle = @fopen($lock_path, 'c'); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fopen -- streaming file I/O; WP_Filesystem cannot return a raw stream handle
1321	1321	if ($handle === false) {
1322	1322	return new WP_Error('lock_unavailable', 'Could not open the import lock file.', array('status' => 500));
1323	1323	}
1324	1324	if (!flock($handle, LOCK_EX | LOCK_NB)) {
1325		- fclose($handle);
	1325	+ fclose($handle); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_fclose -- operates on a native stream handle
1326	1326	return new WP_Error(
1327	1327	'import_in_progress',
1328	1328	'Another import for this assets_folder is already in progress. Retry shortly.',
1329	1329	array('status' => 423)
		@@ -1344,9 +1344,9 @@
1344	1344	{
1345	1345	if (file_exists($target_dir)) {
1346	1346	$this->recursive_rmdir($target_dir);
1347	1347	}
1348		- if (!@rename($staging_dir, $target_dir)) {
	1348	+ if (!@rename($staging_dir, $target_dir)) { // phpcs:ignore WordPress.WP.AlternativeFunctions.rename_rename -- atomic same-filesystem replace; WP_Filesystem::move() needs credential bootstrapping on non-direct hosts
1349	1349	$this->recursive_rmdir($staging_dir);
1350	1350	return new WP_Error(
1351	1351	'assets_swap_failed',
1352	1352	'Failed to move the extracted assets into place.',
		@@ -1425,9 +1425,9 @@
1425	1425	if (class_exists('Metasync_Edge_Cache_Purge')) {
1426	1426	Metasync_Edge_Cache_Purge::purge($urls);
1427	1427	}
1428	1428	} catch (\Throwable $e) {
1429		- error_log('MetaSync: LPS import cache purge failed - ' . $e->getMessage());
	1429	+ error_log('MetaSync: LPS import cache purge failed - ' . $e->getMessage()); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- genuine failure path, bounded, no secrets
1430	1430	}
1431	1431	}
1432	1432
1433	1433	/**
		@@ -1964,9 +1964,9 @@
1964	1964	return true;
1965	1965	}
1966	1966
1967	1967	if (!is_dir($dir)) {
1968		- return @unlink($dir);
	1968	+ return @unlink($dir); // phpcs:ignore WordPress.WP.AlternativeFunctions.unlink_unlink -- boolean return value is consumed
1969	1969	}
1970	1970
1971	1971	$iterator = new RecursiveIteratorIterator(
1972	1972	new RecursiveDirectoryIterator($dir, RecursiveDirectoryIterator::SKIP_DOTS),
		@@ -1974,15 +1974,15 @@
1974	1974	);
1975	1975
1976	1976	foreach ($iterator as $item) {
1977	1977	if ($item->isDir()) {
1978		- @rmdir($item->getPathname());
	1978	+ @rmdir($item->getPathname()); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_rmdir -- WP_Filesystem would prompt for FTP credentials on non-direct hosts
1979	1979	} else {
1980		- @unlink($item->getPathname());
	1980	+ @wp_delete_file($item->getPathname());
1981	1981	}
1982	1982	}
1983	1983
1984		- return @rmdir($dir);
	1984	+ return @rmdir($dir); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_rmdir -- WP_Filesystem would prompt for FTP credentials on non-direct hosts
1985	1985	}
1986	1986
1987	1987	/**
1988	1988	* Write exactly one persistent audit record for an LPS ZIP import.
		@@ -2100,9 +2100,9 @@
2100	2100
2101	2101	$site_url = function_exists('get_site_url') ? get_site_url() : '';
2102	2102
2103	2103	$meta_payload = array(
2104		- 'timestamp' => function_exists('current_time') ? current_time('mysql') : date('Y-m-d H:i:s'),
	2104	+ 'timestamp' => function_exists('current_time') ? current_time('mysql') : gmdate('Y-m-d H:i:s'),
2105	2105	'site_url' => $site_url,
2106	2106	'api_key_prefix' => $api_key_prefix,
2107	2107	'plugin_version' => defined('METASYNC_VERSION') ? METASYNC_VERSION : '',
2108	2108	'auth_method' => $auth_method,
		@@ -2142,9 +2142,9 @@
2142	2142
2143	2143	// Optional deep-debug breadcrumb — the DB write above always happens
2144	2144	// regardless of WP_DEBUG; this line is purely supplementary.
2145	2145	if (defined('WP_DEBUG') && WP_DEBUG) {
2146		- error_log(sprintf(
	2146	+ error_log(sprintf( // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- debug-gated, no secrets
2147	2147	'Metasync LPS import audit: status=%s http=%d created=%d updated=%d failed=%d',
2148	2148	$overall_status,
2149	2149	$http_status,
2150	2150	$counts['created'],
		@@ -2153,9 +2153,9 @@
2153	2153	));
2154	2154	}
2155	2155	} catch (\Throwable $e) {
2156	2156	if (defined('WP_DEBUG') && WP_DEBUG) {
2157		- error_log('Metasync LPS audit log failed: ' . $e->getMessage());
	2157	+ error_log('Metasync LPS audit log failed: ' . $e->getMessage()); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- debug-gated, no secrets
2158	2158	}
2159	2159	}
2160	2160	}
2161	2161	}