mlsimport / includes / mlsimport-credentials.php

mlsimport-credentials.php in MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings 7.2, at includes/mlsimport-credentials.php

56 lines 2.2 KB

Raw Download Zip

1	<?php
2	/**
3	* Credential-field handling rule for the MLSImport plugin (GitHub issue #204).
4	*
5	* WHY THIS FILE EXISTS
6	* --------------------
7	* WordPress' sanitize_text_field() strips every "%" followed by two hex
8	* characters (it treats them as percent-encoded octets), collapses runs of
9	* whitespace and removes <...> sequences; esc_attr() turns & < > " ' into
10	* HTML entities. Running either over a password silently corrupts it: a
11	* customer password like Abcd1234%47Xyz was stored/sent as Abcd1234Xyz and
12	* authentication failed with a generic "check your Username and Password".
13	*
14	* THE RULE
15	* --------
16	* Credential values (passwords, client secrets, tokens) are NEVER sanitized
17	* or escaped on save or on read:
18	* - values read from $_POST use trim( wp_unslash( ... ) ),
19	* - values read from stored options use trim() only,
20	* - escaping happens exclusively at OUTPUT (esc_attr() on the rendered
21	* value="" attribute in the settings form, which is already correct).
22	*
23	* This file provides the single shared predicate that generic sanitizer
24	* loops (the settings whitelist copy and the onboarding step saver) use to
25	* decide whether a field is a credential and must skip sanitization.
26	*
27	* @link https://mlsimport.com/
28	* @since 7.1.0
29	*
30	* @package Mlsimport
31	* @subpackage Mlsimport/includes
32	*/
33
34	// If this file is called directly, abort.
35	if ( ! defined( 'ABSPATH' ) ) {
36	exit;
37	}
38
39	/**
40	* Decide whether an option/field key holds a credential value.
41	*
42	* Step by step:
43	* 1. Lowercase the key so the match is case-insensitive.
44	* 2. Match keys ENDING in "password", "secret" or "token" — this covers
45	* every credential the plugin stores (mlsimport_password, auth_password,
46	* client_secret, mlsimport__client_secret, mlsimport__password,
47	* mlsimport_mls_token, and the onboarding step keys password/mls_token)
48	* while leaving usernames, ids and display fields to normal sanitizing.
49	*
50	* @param string $key Option or posted-field key.
51	* @return bool True when the key's value must never be sanitized/escaped.
52	*/
53	function mlsimport_is_credential_key( $key ) {
54	return (bool) preg_match( '/(password\|secret\|token)$/', strtolower( (string) $key ) );
55	}
56