← All changes | includes/class-metasync-bookingpress-compat.php +31 -10 2.6.25 → 2.7.2 View file →

		@@ -23,11 +23,16 @@
23	23	* bookingpress_cart_id cookie (set by the separate cart module). Those
24	24	* visitors keep the session; see the cookie guard below.
25	25	*
26	26	* This shim removes the global session start on public HTML requests so host
27		- * page caching can engage again. Admin, AJAX, cron, CLI and REST requests
28		- * are untouched, and any code that genuinely needs a session still starts
29		- * its own.
	27	+ * page caching can engage again. Admin, AJAX, cron and CLI requests are
	28	+ * untouched. REST requests are also affected: the shim runs on `init` at
	29	+ * priority 0, before WordPress defines the REST_REQUEST constant (that happens
	30	+ * during `parse_request`), so is_public_html_request() cannot distinguish a
	31	+ * REST request at that point and treats it as a public HTML request. This is
	32	+ * harmless in practice — REST responses are not host page-cached anyway, and
	33	+ * BookingPress manages its own sessions inside its AJAX/REST handlers. Any
	34	+ * code that genuinely needs a session still starts its own.
30	35	*
31	36	* @package MetaSync
32	37	* @subpackage MetaSync/includes
33	38	* @since 2.6.22
		@@ -81,8 +86,12 @@
81	86	/**
82	87	* Only public page renders matter for host caching; every other request
83	88	* context is left exactly as WordPress finds it.
84	89	*
	90	+ * Note: REST_REQUEST is not defined until `parse_request`, so at the
	91	+ * `init` priority 0 where the shim runs it is always absent and a REST
	92	+ * request reads as a public HTML request here. See the class docblock.
	93	+ *
85	94	* @return bool True for front-end HTML requests.
86	95	*/
87	96	private static function is_public_html_request()
88	97	{
		@@ -114,14 +123,23 @@
114	123	private static function remove_spam_protection_session_hook()
115	124	{
116	125	$removed = false;
117	126
	127	+ # BookingPress 1.6.2 registers the callback once at priority 1, but a
	128	+ # future version could register it more than once (or at another
	129	+ # priority). Loop until remove_action() reports no match left so every
	130	+ # instance is cleared regardless of how many were registered.
118	131	if (!empty($GLOBALS['bookingpress_spam_protection']) && is_object($GLOBALS['bookingpress_spam_protection'])) {
119		- $removed = remove_action(
120		- 'init',
121		- array($GLOBALS['bookingpress_spam_protection'], 'bookingpress_start_session'),
122		- 1
123		- );
	132	+ do {
	133	+ $did = remove_action(
	134	+ 'init',
	135	+ array($GLOBALS['bookingpress_spam_protection'], 'bookingpress_start_session'),
	136	+ 1
	137	+ );
	138	+ if ($did) {
	139	+ $removed = true;
	140	+ }
	141	+ } while ($did);
124	142	}
125	143
126	144	if ($removed) {
127	145	return true;
		@@ -146,8 +164,11 @@
146	164	if (empty($callbacks)) {
147	165	return false;
148	166	}
149	167
	168	+ # Registry-scan fallback: sweep every priority and unset every matching
	169	+ # callback rather than stopping after the first. Catches multiple
	170	+ # registrations (future-proofing) and renamed globals/subclasses alike.
150	171	foreach ($callbacks as $priority => $entries) {
151	172	if (!is_array($entries)) {
152	173	continue;
153	174	}
		@@ -158,12 +179,12 @@
158	179	&& is_a($fn[0], 'bookingpress_spam_protection')
159	180	&& $fn[1] === 'bookingpress_start_session'
160	181	) {
161	182	unset($callbacks[$priority][$callback_id]);
162		- return true;
	183	+ $removed = true;
163	184	}
164	185	}
165	186	}
166	187
167		- return false;
	188	+ return $removed;
168	189	}
169	190	}