| 1 |
<?php |
| 2 |
/** |
| 3 |
* Credential-field handling rule for the MLSImport plugin (GitHub issue #204). |
| 4 |
* |
| 5 |
* WHY THIS FILE EXISTS |
| 6 |
* -------------------- |
| 7 |
* WordPress' sanitize_text_field() strips every "%" followed by two hex |
| 8 |
* characters (it treats them as percent-encoded octets), collapses runs of |
| 9 |
* whitespace and removes <...> sequences; esc_attr() turns & < > " ' into |
| 10 |
* HTML entities. Running either over a password silently corrupts it: a |
| 11 |
* customer password like Abcd1234%47Xyz was stored/sent as Abcd1234Xyz and |
| 12 |
* authentication failed with a generic "check your Username and Password". |
| 13 |
* |
| 14 |
* THE RULE |
| 15 |
* -------- |
| 16 |
* Credential values (passwords, client secrets, tokens) are NEVER sanitized |
| 17 |
* or escaped on save or on read: |
| 18 |
* - values read from $_POST use trim( wp_unslash( ... ) ), |
| 19 |
* - values read from stored options use trim() only, |
| 20 |
* - escaping happens exclusively at OUTPUT (esc_attr() on the rendered |
| 21 |
* value="" attribute in the settings form, which is already correct). |
| 22 |
* |
| 23 |
* This file provides the single shared predicate that generic sanitizer |
| 24 |
* loops (the settings whitelist copy and the onboarding step saver) use to |
| 25 |
* decide whether a field is a credential and must skip sanitization. |
| 26 |
* |
| 27 |
* @link https://mlsimport.com/ |
| 28 |
* @since 7.1.0 |
| 29 |
* |
| 30 |
* @package Mlsimport |
| 31 |
* @subpackage Mlsimport/includes |
| 32 |
*/ |
| 33 |
|
| 34 |
// If this file is called directly, abort. |
| 35 |
if ( ! defined( 'ABSPATH' ) ) { |
| 36 |
exit; |
| 37 |
} |
| 38 |
|
| 39 |
/** |
| 40 |
* Decide whether an option/field key holds a credential value. |
| 41 |
* |
| 42 |
* Step by step: |
| 43 |
* 1. Lowercase the key so the match is case-insensitive. |
| 44 |
* 2. Match keys ENDING in "password", "secret" or "token" — this covers |
| 45 |
* every credential the plugin stores (mlsimport_password, auth_password, |
| 46 |
* client_secret, mlsimport_*_client_secret, mlsimport_*_password, |
| 47 |
* mlsimport_mls_token, and the onboarding step keys password/mls_token) |
| 48 |
* while leaving usernames, ids and display fields to normal sanitizing. |
| 49 |
* |
| 50 |
* @param string $key Option or posted-field key. |
| 51 |
* @return bool True when the key's value must never be sanitized/escaped. |
| 52 |
*/ |
| 53 |
function mlsimport_is_credential_key( $key ) { |
| 54 |
return (bool) preg_match( '/(password|secret|token)$/', strtolower( (string) $key ) ); |
| 55 |
} |
| 56 |
|
