| @@ -48,8 +48,83 @@ | ||
| 48 | 48 | const DEFAULT_GEMINI_MODEL = 'gemini-3.5-flash'; |
| 49 | 49 | const DEFAULT_OPENROUTER_MODEL = 'openai/gpt-4o-mini'; |
| 50 | 50 | |
| 51 | 51 | /** |
| 52 | + * Canonical default author-archive templates. | |
| 53 | + * | |
| 54 | + * Same single-source-of-truth rule as the model constants above: the | |
| 55 | + * defaults array, the REST endpoint, the get-settings ability and | |
| 56 | + * Author_Archives_Manager all read these instead of repeating the literal, | |
| 57 | + * which had already drifted — the title default hardcoded an en dash while | |
| 58 | + * the feature resolves %separator% from Site Identity (#318). | |
| 59 | + * | |
| 60 | + * @since 1.29.1 | |
| 61 | + */ | |
| 62 | + /** | |
| 63 | + * AI providers this plugin supports. | |
| 64 | + * | |
| 65 | + * Single source of truth for the REST enum, the connection test's dispatch | |
| 66 | + * and sanitize_setting(), so the three cannot disagree about what is legal. | |
| 67 | + * | |
| 68 | + * @since 2.2.0 | |
| 69 | + * @var string[] | |
| 70 | + */ | |
| 71 | + public const SUPPORTED_AI_PROVIDERS = ['openai', 'claude', 'gemini', 'openrouter']; | |
| 72 | + | |
| 73 | + /** | |
| 74 | + * The stored value meaning "the user has not chosen a provider yet". | |
| 75 | + * | |
| 76 | + * A fresh install ships with no provider selected: picking one is the | |
| 77 | + * user's call, and pre-selecting OpenAI made the settings screen open with | |
| 78 | + * a warning about a missing key for a provider nobody had asked for (#572). | |
| 79 | + * Every write path accepts this alongside SUPPORTED_AI_PROVIDERS. | |
| 80 | + * | |
| 81 | + * @since 2.1.3 | |
| 82 | + */ | |
| 83 | + public const AI_PROVIDER_NONE = ''; | |
| 84 | + | |
| 85 | + /** | |
| 86 | + * One-time marker for {@see Settings::retire_seeded_ai_provider()}. | |
| 87 | + */ | |
| 88 | + private const PROVIDER_MIGRATION_OPTION = 'thinkrank_ai_provider_migration'; | |
| 89 | + private const PROVIDER_MIGRATION_VERSION = '1'; | |
| 90 | + | |
| 91 | + /** | |
| 92 | + * Legal values for the `ai_provider` setting, including "not chosen". | |
| 93 | + * | |
| 94 | + * @since 2.1.3 | |
| 95 | + * @return string[] | |
| 96 | + */ | |
| 97 | + public static function selectable_ai_providers(): array { | |
| 98 | + return array_merge([self::AI_PROVIDER_NONE], self::SUPPORTED_AI_PROVIDERS); | |
| 99 | + } | |
| 100 | + | |
| 101 | + const DEFAULT_AUTHOR_ARCHIVES_TITLE = '%author_name% %separator% %site_title% %page%'; | |
| 102 | + const DEFAULT_AUTHOR_ARCHIVES_META_DESC = 'Articles written by %author_name% on %site_title%'; | |
| 103 | + | |
| 104 | + /** | |
| 105 | + * String settings where a stored empty string is a real value, not "unset". | |
| 106 | + * | |
| 107 | + * get() normally treats '' the same as a missing option and returns the | |
| 108 | + * default, which is right for most keys — a blank API key or model name is | |
| 109 | + * never what the user meant. For these template fields it is the opposite: | |
| 110 | + * clearing the box means "render no template", and the consumers already | |
| 111 | + * branch on an empty value. Without the opt-out the save appeared to | |
| 112 | + * succeed and the default reappeared on the next request (#316). | |
| 113 | + * | |
| 114 | + * @since 1.29.1 | |
| 115 | + * @var string[] | |
| 116 | + */ | |
| 117 | + private const EMPTY_IS_A_VALUE = [ | |
| 118 | + 'author_archives_title', | |
| 119 | + 'author_archives_meta_desc', | |
| 120 | + // '' is the "no provider chosen" state, not "fall back to the default". | |
| 121 | + // Without this, deselecting a provider would be undone by any caller | |
| 122 | + // that passes its own fallback to get() (#572). | |
| 123 | + 'ai_provider', | |
| 124 | + ]; | |
| 125 | + | |
| 126 | + /** | |
| 52 | 127 | * Shared singleton instance |
| 53 | 128 | * |
| 54 | 129 | * @var Settings|null |
| 55 | 130 | */ |
| @@ -98,9 +173,9 @@ | ||
| 98 | 173 | * @var array |
| 99 | 174 | */ |
| 100 | 175 | private array $defaults = [ |
| 101 | 176 | // AI Settings |
| 102 | - 'ai_provider' => 'openai', | |
| 177 | + 'ai_provider' => self::AI_PROVIDER_NONE, | |
| 103 | 178 | 'openai_api_key' => '', |
| 104 | 179 | 'openai_model' => self::DEFAULT_OPENAI_MODEL, |
| 105 | 180 | 'claude_api_key' => '', |
| 106 | 181 | 'claude_model' => self::DEFAULT_CLAUDE_MODEL, // Recommended default (best speed/quality balance) |
| @@ -156,43 +231,14 @@ | ||
| 156 | 231 | 'seo_score_threshold' => 70, |
| 157 | 232 | 'enable_meta_generation' => true, |
| 158 | 233 | 'enable_schema_markup' => true, |
| 159 | 234 | |
| 160 | - // Auto AI Optimization (on-publish metadata fill; #248 P1) | |
| 161 | - 'auto_ai_meta_enabled' => false, | |
| 162 | - 'auto_ai_meta_post_types' => ['post'], | |
| 163 | - | |
| 164 | - // Brand Visibility v2. The brand profile drives question generation | |
| 165 | - // and mention detection; per-platform keys let this feature query | |
| 166 | - // several assistants without changing the site-wide AI provider. | |
| 167 | - 'bv_brand_name' => '', | |
| 168 | - 'bv_variants' => [], | |
| 169 | - 'bv_location' => '', | |
| 170 | - 'bv_category' => '', | |
| 171 | - 'bv_description' => '', | |
| 172 | - 'bv_competitors' => [], | |
| 173 | - 'bv_queries' => [], | |
| 174 | - 'bv_platforms' => ['chatgpt'], | |
| 175 | - 'bv_samples' => 1, | |
| 176 | - 'bv_key_chatgpt' => '', | |
| 177 | - 'bv_key_gemini' => '', | |
| 178 | - 'bv_key_claude' => '', | |
| 179 | - 'bv_key_perplexity' => '', | |
| 180 | - // Empty = use the platform's default model (see Brand_Visibility_Providers). | |
| 181 | - 'bv_model_chatgpt' => '', | |
| 182 | - 'bv_model_gemini' => '', | |
| 183 | - 'bv_model_claude' => '', | |
| 184 | - 'bv_model_perplexity' => '', | |
| 185 | - | |
| 186 | - // AI Brand Visibility (BYO-key checks; #248 P1) | |
| 187 | - 'brand_visibility_queries' => [], | |
| 188 | - | |
| 189 | 235 | // Author Archives Settings |
| 190 | 236 | 'author_archives_enabled' => true, |
| 191 | 237 | 'author_archives_index' => true, |
| 192 | 238 | 'author_archives_show_empty' => false, |
| 193 | - 'author_archives_title' => '%author_name% – %site_title% %page%', | |
| 194 | - 'author_archives_meta_desc' => 'Articles written by %author_name% on %site_title%', | |
| 239 | + 'author_archives_title' => self::DEFAULT_AUTHOR_ARCHIVES_TITLE, | |
| 240 | + 'author_archives_meta_desc' => self::DEFAULT_AUTHOR_ARCHIVES_META_DESC, | |
| 195 | 241 | |
| 196 | 242 | // UI Settings |
| 197 | 243 | 'show_welcome_message' => true, |
| 198 | 244 | 'dashboard_widgets' => ['seo_score', 'ai_usage', 'recent_briefs'], |
| @@ -203,8 +249,16 @@ | ||
| 203 | 249 | 'retry_attempts' => 3, |
| 204 | 250 | // Exposes the standalone Migration admin page for re-running SEO data |
| 205 | 251 | // imports after setup. Hidden by default; opt-in for advanced/support use. |
| 206 | 252 | 'enable_migration_tools' => false, |
| 253 | + // Exposes ThinkRank's own export / restore. Off by default, like the | |
| 254 | + // migration toggle above: both are occasional, admin-only tools, and a | |
| 255 | + // menu item nobody asked for is a menu item in the way. Your data is | |
| 256 | + // never locked in — the switch is one click away in | |
| 257 | + // Settings > Import / Export, and turning it on immediately restores | |
| 258 | + // the screen and the menu item. Off hides the export card and, unless | |
| 259 | + // migration tools are on, the Import / Export menu item with it. | |
| 260 | + 'enable_import_export' => false, | |
| 207 | 261 | |
| 208 | 262 | // Privacy Settings |
| 209 | 263 | 'data_retention_days' => 90, |
| 210 | 264 | 'anonymize_logs' => true, |
| @@ -213,16 +267,8 @@ | ||
| 213 | 267 | // Integration Settings |
| 214 | 268 | 'google_analytics_id' => '', |
| 215 | 269 | 'search_console_property' => '', |
| 216 | 270 | |
| 217 | - // GA4 Tracking Settings | |
| 218 | - 'ga4_measurement_id' => '', | |
| 219 | - 'ga4_auto_inject' => false, | |
| 220 | - 'ga4_anonymize_ip' => false, | |
| 221 | - 'ga4_exclude_admin' => false, | |
| 222 | - 'ga4_tracking_verified' => false, | |
| 223 | - 'ga4_last_verification' => '', | |
| 224 | - | |
| 225 | 271 | // SEO Analytics Settings |
| 226 | 272 | 'seo_analytics_enabled' => false, |
| 227 | 273 | 'seo_analytics_setup_completed' => false, |
| 228 | 274 | 'seo_analytics_google_analytics_property_id' => '', |
| @@ -271,11 +317,102 @@ | ||
| 271 | 317 | * @return void |
| 272 | 318 | */ |
| 273 | 319 | public function init(): void { |
| 274 | 320 | add_action('admin_init', [$this, 'register_settings']); |
| 321 | + // Admin-only: a front-end pageview can never need this migration, and | |
| 322 | + // the marker is a non-autoloaded option, so hooking it unconditionally | |
| 323 | + // bought one dedicated query on every request for the life of the | |
| 324 | + // install (#588). | |
| 325 | + if (is_admin()) { | |
| 326 | + add_action('init', [self::class, 'retire_seeded_ai_provider']); | |
| 327 | + } | |
| 275 | 328 | } |
| 276 | 329 | |
| 277 | 330 | /** |
| 331 | + * Clear the OpenAI selection that older versions seeded on activation. | |
| 332 | + * | |
| 333 | + * Changing the default only helps installs created after the change. Every | |
| 334 | + * site activated before it still carries `ai_provider = 'openai'` written by | |
| 335 | + * Activator::set_default_options(), and still opens Settings warning about a | |
| 336 | + * missing key for a provider nobody picked — the whole complaint in #572. | |
| 337 | + * | |
| 338 | + * "OpenAI with no OpenAI key" is provably not a user's choice: the settings | |
| 339 | + * form refuses to save a provider without a key, so the only way to reach | |
| 340 | + * that state is the old activation seed. A site that genuinely chose OpenAI | |
| 341 | + * has a key and is left alone, as is any site on another provider. | |
| 342 | + * | |
| 343 | + * Version-gated so it runs once and never fights a user who later clears | |
| 344 | + * their key but keeps the provider selected. | |
| 345 | + * | |
| 346 | + * @since 2.1.3 | |
| 347 | + * | |
| 348 | + * @return void | |
| 349 | + */ | |
| 350 | + public static function retire_seeded_ai_provider(): void { | |
| 351 | + if (get_option(self::PROVIDER_MIGRATION_OPTION) === self::PROVIDER_MIGRATION_VERSION) { | |
| 352 | + self::promote_migration_marker_to_autoload(); | |
| 353 | + return; | |
| 354 | + } | |
| 355 | + | |
| 356 | + // Record first: a site that somehow fails the checks below must not | |
| 357 | + // re-test on every request for the rest of its life. Autoloaded on | |
| 358 | + // purpose — it is a short write-once flag that is read on every admin | |
| 359 | + // request, which is exactly what autoload is for; storing it | |
| 360 | + // non-autoloaded bought a dedicated query per request instead (#588). | |
| 361 | + update_option(self::PROVIDER_MIGRATION_OPTION, self::PROVIDER_MIGRATION_VERSION, true); | |
| 362 | + | |
| 363 | + if (get_option('thinkrank_ai_provider', null) !== 'openai') { | |
| 364 | + return; | |
| 365 | + } | |
| 366 | + | |
| 367 | + // Read the stored option directly rather than through Settings::get(). | |
| 368 | + // Only emptiness matters here, and get() adds two things this decision | |
| 369 | + // must not depend on: a per-instance cache that may already be primed, | |
| 370 | + // and decryption that can yield '' for a key that is genuinely present. | |
| 371 | + // The raw option is non-empty whenever a key exists, encrypted or not. | |
| 372 | + if ('' !== (string) get_option('thinkrank_openai_api_key', '')) { | |
| 373 | + // A real choice, backed by a key. Leave it. | |
| 374 | + return; | |
| 375 | + } | |
| 376 | + | |
| 377 | + // Write through the shared instance, not a throwaway one: set() refreshes | |
| 378 | + // only the cache of the object it is called on, so a private instance | |
| 379 | + // would leave the registered component serving the old value for the | |
| 380 | + // rest of this request — including to the admin page it localizes. | |
| 381 | + self::instance()->set('ai_provider', self::AI_PROVIDER_NONE); | |
| 382 | + } | |
| 383 | + | |
| 384 | + /** | |
| 385 | + * Move a legacy migration marker into the autoloaded set. | |
| 386 | + * | |
| 387 | + * Sites that ran the migration on 2.1.3 wrote the marker with | |
| 388 | + * `autoload = false`, and the version gate above returns before the write | |
| 389 | + * that would correct it — so those installs keep paying a dedicated query | |
| 390 | + * to read a one-byte flag on every admin request, which is the cost #588 | |
| 391 | + * was about. Promote it once. | |
| 392 | + * | |
| 393 | + * Free to test: alloptions is loaded from the object cache once per request | |
| 394 | + * regardless, and an autoloaded marker is in it, so the steady state after | |
| 395 | + * the promotion is a cache lookup and nothing else. wp_set_option_autoload() | |
| 396 | + * arrived in WP 6.4 and the plugin supports 6.0, hence the guard. | |
| 397 | + * | |
| 398 | + * @since 2.2.0 | |
| 399 | + * | |
| 400 | + * @return void | |
| 401 | + */ | |
| 402 | + private static function promote_migration_marker_to_autoload(): void { | |
| 403 | + if (!function_exists('wp_set_option_autoload') || !function_exists('wp_load_alloptions')) { | |
| 404 | + return; | |
| 405 | + } | |
| 406 | + | |
| 407 | + if (array_key_exists(self::PROVIDER_MIGRATION_OPTION, wp_load_alloptions())) { | |
| 408 | + return; | |
| 409 | + } | |
| 410 | + | |
| 411 | + wp_set_option_autoload(self::PROVIDER_MIGRATION_OPTION, true); | |
| 412 | + } | |
| 413 | + | |
| 414 | + /** | |
| 278 | 415 | * Register WordPress settings |
| 279 | 416 | * |
| 280 | 417 | * @return void |
| 281 | 418 | */ |
| @@ -286,8 +423,47 @@ | ||
| 286 | 423 | ]); |
| 287 | 424 | } |
| 288 | 425 | |
| 289 | 426 | /** |
| 427 | + * Warm the option cache for a batch of setting keys in one query. | |
| 428 | + * | |
| 429 | + * Every `thinkrank_*` option is autoload=off, so WordPress cannot serve | |
| 430 | + * them from `alloptions` and each get() below is its own round-trip. A | |
| 431 | + * caller that reads a known list of keys should prime it first: on a | |
| 432 | + * ~1ms managed-hosting round-trip, sixteen of those on an anonymous | |
| 433 | + * pageview is ~16ms spent on values the page may not use (#393). | |
| 434 | + * | |
| 435 | + * get() memoizes within the request, so only the first read of each key | |
| 436 | + * ever reaches the database — this is what collapses those first reads. | |
| 437 | + * Keys already memoized are left out of the batch. | |
| 438 | + * | |
| 439 | + * wp_prime_option_caches() is WP 6.4+; the plugin supports 6.0, so an | |
| 440 | + * older site simply keeps the previous behaviour. | |
| 441 | + * | |
| 442 | + * @since 2.1.0 | |
| 443 | + * | |
| 444 | + * @param string[] $keys Setting keys, without the `thinkrank_` prefix. | |
| 445 | + * @return void | |
| 446 | + */ | |
| 447 | + public function prime(array $keys): void { | |
| 448 | + if (!function_exists('wp_prime_option_caches')) { | |
| 449 | + return; | |
| 450 | + } | |
| 451 | + | |
| 452 | + $unread = []; | |
| 453 | + | |
| 454 | + foreach ($keys as $key) { | |
| 455 | + if (!isset($this->cache[$key])) { | |
| 456 | + $unread[] = 'thinkrank_' . $key; | |
| 457 | + } | |
| 458 | + } | |
| 459 | + | |
| 460 | + if (!empty($unread)) { | |
| 461 | + wp_prime_option_caches($unread); | |
| 462 | + } | |
| 463 | + } | |
| 464 | + | |
| 465 | + /** | |
| 290 | 466 | * Get setting value |
| 291 | 467 | * |
| 292 | 468 | * @param string $key Setting key |
| 293 | 469 | * @param mixed $fallback Default value |
| @@ -329,10 +505,20 @@ | ||
| 329 | 505 | $value = $fallback ?? $this->defaults[$key]; |
| 330 | 506 | } |
| 331 | 507 | } |
| 332 | 508 | } else { |
| 333 | - // Non-boolean settings: use default if not found | |
| 334 | - if (null === $value || '' === $value) { | |
| 509 | + // Non-boolean settings: use default if not found. | |
| 510 | + // | |
| 511 | + // get_option() above is called with a null default, so null means | |
| 512 | + // "no row" while '' means a value was deliberately stored. For most | |
| 513 | + // keys we collapse the two — an empty string is treated as unset so | |
| 514 | + // the documented default applies. Keys in EMPTY_IS_A_VALUE opt out: | |
| 515 | + // there, clearing the field is a real choice the consumer honours, | |
| 516 | + // and folding it back into the default made the save look like it | |
| 517 | + // silently failed (#316). | |
| 518 | + $empty_is_unset = !in_array($key, self::EMPTY_IS_A_VALUE, true); | |
| 519 | + | |
| 520 | + if (null === $value || ($empty_is_unset && '' === $value)) { | |
| 335 | 521 | $value = $fallback ?? ($this->defaults[$key] ?? null); |
| 336 | 522 | } |
| 337 | 523 | } |
| 338 | 524 | |
| @@ -355,10 +541,14 @@ | ||
| 355 | 541 | if (!array_key_exists($key, $this->defaults)) { |
| 356 | 542 | return false; |
| 357 | 543 | } |
| 358 | 544 | |
| 545 | + // Apply the declared per-key sanitizer before anything is stored. This | |
| 546 | + // is the path essentially every caller takes, so skipping it left the | |
| 547 | + // whole sanitize_setting() switch unreachable — max_tokens, | |
| 548 | + // cache_duration and temperature persisted whatever string arrived. | |
| 549 | + $value = $this->sanitize_setting($key, $value); | |
| 359 | 550 | |
| 360 | - | |
| 361 | 551 | // Encrypt if needed |
| 362 | 552 | $encrypted_value = $this->maybe_encrypt($key, $value); |
| 363 | 553 | |
| 364 | 554 | // Save to WordPress options or user meta |
| @@ -439,8 +629,23 @@ | ||
| 439 | 629 | return $result; |
| 440 | 630 | } |
| 441 | 631 | |
| 442 | 632 | /** |
| 633 | + * Setting keys whose values are encrypted at rest. | |
| 634 | + * | |
| 635 | + * Exposed so callers that must never emit a credential — the data exporter | |
| 636 | + * in particular — can filter against the same list this class encrypts | |
| 637 | + * with, instead of keeping a copy that silently drifts when a key is added. | |
| 638 | + * | |
| 639 | + * @since 2.2.0 | |
| 640 | + * | |
| 641 | + * @return string[] Setting keys. | |
| 642 | + */ | |
| 643 | + public function get_encrypted_keys(): array { | |
| 644 | + return $this->encrypted_keys; | |
| 645 | + } | |
| 646 | + | |
| 647 | + /** | |
| 443 | 648 | * Get all settings (optimized with bulk caching) |
| 444 | 649 | * |
| 445 | 650 | * @param int $user_id User ID (0 for global) |
| 446 | 651 | * @return array All settings |
| @@ -507,8 +712,44 @@ | ||
| 507 | 712 | return $sanitized; |
| 508 | 713 | } |
| 509 | 714 | |
| 510 | 715 | /** |
| 716 | + * Sanitize a nested array, preserving its shape. | |
| 717 | + * | |
| 718 | + * Scalars keep their type (an int threshold stays an int); strings are | |
| 719 | + * text-sanitized; objects are dropped, since no setting stores one. | |
| 720 | + * | |
| 721 | + * @since 2.2.0 | |
| 722 | + * @param array $value Array to sanitize. | |
| 723 | + * @param int $depth Current recursion depth. | |
| 724 | + * @return array | |
| 725 | + */ | |
| 726 | + private function sanitize_array_recursive(array $value, int $depth = 0): array { | |
| 727 | + // Settings are configuration, not arbitrary payloads; a cap keeps a | |
| 728 | + // malformed deep structure from recursing without bound. | |
| 729 | + if ($depth > 10) { | |
| 730 | + return []; | |
| 731 | + } | |
| 732 | + | |
| 733 | + $sanitized = []; | |
| 734 | + foreach ($value as $item_key => $item) { | |
| 735 | + $key = is_string($item_key) ? sanitize_key($item_key) : $item_key; | |
| 736 | + | |
| 737 | + if (is_array($item)) { | |
| 738 | + $sanitized[$key] = $this->sanitize_array_recursive($item, $depth + 1); | |
| 739 | + } elseif (is_object($item)) { | |
| 740 | + continue; | |
| 741 | + } elseif (is_bool($item) || is_int($item) || is_float($item)) { | |
| 742 | + $sanitized[$key] = $item; | |
| 743 | + } else { | |
| 744 | + $sanitized[$key] = sanitize_text_field((string) $item); | |
| 745 | + } | |
| 746 | + } | |
| 747 | + | |
| 748 | + return $sanitized; | |
| 749 | + } | |
| 750 | + | |
| 751 | + /** | |
| 511 | 752 | * Sanitize individual setting |
| 512 | 753 | * |
| 513 | 754 | * @param string $key Setting key |
| 514 | 755 | * @param mixed $value Setting value |
| @@ -533,10 +774,17 @@ | ||
| 533 | 774 | case 'openrouter_api_key': |
| 534 | 775 | return sanitize_text_field($value); |
| 535 | 776 | |
| 536 | 777 | case 'ai_provider': |
| 537 | - return sanitize_key($value); | |
| 778 | + // sanitize_key() maps '' to '', which is AI_PROVIDER_NONE — the | |
| 779 | + // deliberate "no provider chosen" state, so it must survive here | |
| 780 | + // rather than being folded back into the default (#572). | |
| 781 | + $provider = sanitize_key($value); | |
| 538 | 782 | |
| 783 | + return in_array($provider, self::selectable_ai_providers(), true) | |
| 784 | + ? $provider | |
| 785 | + : $this->defaults['ai_provider']; | |
| 786 | + | |
| 539 | 787 | case 'openai_model': |
| 540 | 788 | case 'claude_model': |
| 541 | 789 | case 'gemini_model': |
| 542 | 790 | case 'openrouter_model': |
| @@ -573,8 +821,17 @@ | ||
| 573 | 821 | foreach ($value as $threshold_key => $threshold_value) { |
| 574 | 822 | if (is_array($threshold_value)) { |
| 575 | 823 | continue; |
| 576 | 824 | } |
| 825 | + if (is_bool($threshold_value)) { | |
| 826 | + // Keep booleans as booleans. is_numeric() is false for | |
| 827 | + // one, so it used to fall to the string arm and a true | |
| 828 | + // came back as "1" — invisible while this ran only on | |
| 829 | + // the register_setting() path, now that set() routes | |
| 830 | + // every write through here it is a type change on save. | |
| 831 | + $thresholds[sanitize_key($threshold_key)] = $threshold_value; | |
| 832 | + continue; | |
| 833 | + } | |
| 577 | 834 | $thresholds[sanitize_key($threshold_key)] = is_numeric($threshold_value) |
| 578 | 835 | ? $threshold_value + 0 |
| 579 | 836 | : sanitize_text_field((string) $threshold_value); |
| 580 | 837 | } |
| @@ -586,9 +843,12 @@ | ||
| 586 | 843 | return sanitize_text_field($value); |
| 587 | 844 | |
| 588 | 845 | case 'robots_txt_content': |
| 589 | 846 | // Multi-line content — sanitize_text_field() collapses newlines |
| 590 | - // and would flatten the whole file onto a single line. | |
| 847 | + // and would flatten the whole file onto a single line. set() | |
| 848 | + // routes every write through here, so a caller that chose | |
| 849 | + // sanitize_textarea_field() itself is otherwise silently | |
| 850 | + // overridden by the default: arm below (#587). | |
| 591 | 851 | return sanitize_textarea_field($value); |
| 592 | 852 | |
| 593 | 853 | default: |
| 594 | 854 | if (is_bool($value)) { |
| @@ -595,19 +855,14 @@ | ||
| 595 | 855 | return (bool) $value; |
| 596 | 856 | } elseif (is_string($value)) { |
| 597 | 857 | return sanitize_text_field($value); |
| 598 | 858 | } elseif (is_array($value)) { |
| 599 | - // Flat list/map of scalars; nested members are dropped rather | |
| 600 | - // than passed to a string sanitizer that would fatal on them. | |
| 601 | - $sanitized = []; | |
| 602 | - foreach ($value as $item_key => $item) { | |
| 603 | - if (is_array($item) || is_object($item)) { | |
| 604 | - continue; | |
| 605 | - } | |
| 606 | - $sanitized[is_string($item_key) ? sanitize_key($item_key) : $item_key] = | |
| 607 | - sanitize_text_field((string) $item); | |
| 608 | - } | |
| 609 | - return $sanitized; | |
| 859 | + // Recurse rather than drop. Skipping nested members was | |
| 860 | + // harmless while this ran only on the register_setting() | |
| 861 | + // path, but set() now routes every write through here, and | |
| 862 | + // structured settings (lists of maps) were being silently | |
| 863 | + // emptied on save. | |
| 864 | + return $this->sanitize_array_recursive($value); | |
| 610 | 865 | } |
| 611 | 866 | return $value; |
| 612 | 867 | } |
| 613 | 868 | } |
| @@ -629,25 +884,12 @@ | ||
| 629 | 884 | private function maybe_encrypt(string $key, $value) { |
| 630 | 885 | if (!in_array($key, $this->encrypted_keys, true) || !is_string($value) || '' === $value) { |
| 631 | 886 | return $value; |
| 632 | 887 | } |
| 633 | - if (!function_exists('sodium_crypto_secretbox')) { | |
| 634 | - return $value; // sodium unavailable — store as-is | |
| 635 | - } | |
| 636 | 888 | |
| 637 | - $enc_key = $this->encryption_key(); | |
| 638 | - if ('' === $enc_key) { | |
| 639 | - return $value; | |
| 640 | - } | |
| 641 | - | |
| 642 | - try { | |
| 643 | - $nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES); | |
| 644 | - $cipher = sodium_crypto_secretbox($value, $nonce, $enc_key); | |
| 645 | - // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- transport encoding for a sodium ciphertext, not obfuscation. | |
| 646 | - return self::ENC_PREFIX . base64_encode($nonce . $cipher); | |
| 647 | - } catch (\Exception $e) { | |
| 648 | - return $value; | |
| 649 | - } | |
| 889 | + // Same scheme, same key, same prefix — it just lives in Secret_At_Rest | |
| 890 | + // now so the MCP pairing token can use it too (#396). | |
| 891 | + return Secret_At_Rest::encrypt($value); | |
| 650 | 892 | } |
| 651 | 893 | |
| 652 | 894 | /** |
| 653 | 895 | * Decrypt a value previously encrypted by maybe_encrypt. Values without the |
| @@ -660,28 +902,12 @@ | ||
| 660 | 902 | private function maybe_decrypt(string $key, $value) { |
| 661 | 903 | if (!is_string($value) || strncmp($value, self::ENC_PREFIX, strlen(self::ENC_PREFIX)) !== 0) { |
| 662 | 904 | return $value; // legacy plaintext or non-string |
| 663 | 905 | } |
| 664 | - if (!function_exists('sodium_crypto_secretbox_open')) { | |
| 665 | - return $value; | |
| 666 | - } | |
| 667 | 906 | |
| 668 | - $enc_key = $this->encryption_key(); | |
| 669 | - if ('' === $enc_key) { | |
| 670 | - return $value; | |
| 671 | - } | |
| 907 | + $plain = Secret_At_Rest::decrypt($value); | |
| 672 | 908 | |
| 673 | - // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- decodes our own ciphertext envelope; strict mode is on. | |
| 674 | - $decoded = base64_decode(substr($value, strlen(self::ENC_PREFIX)), true); | |
| 675 | - if (false === $decoded || strlen($decoded) <= SODIUM_CRYPTO_SECRETBOX_NONCEBYTES) { | |
| 676 | - return $value; | |
| 677 | - } | |
| 678 | - | |
| 679 | - $nonce = substr($decoded, 0, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES); | |
| 680 | - $cipher = substr($decoded, SODIUM_CRYPTO_SECRETBOX_NONCEBYTES); | |
| 681 | - $plain = sodium_crypto_secretbox_open($cipher, $nonce, $enc_key); | |
| 682 | - | |
| 683 | - if (false === $plain) { | |
| 909 | + if ('' === $plain) { | |
| 684 | 910 | // We reach here only when sodium is available and a key was |
| 685 | 911 | // derivable, so this is a genuine failure: the auth salt changed |
| 686 | 912 | // (config rotated, or the site was migrated without wp-config) or |
| 687 | 913 | // the row is corrupt. The value is unrecoverable either way. |
| @@ -693,20 +919,6 @@ | ||
| 693 | 919 | return ''; |
| 694 | 920 | } |
| 695 | 921 | |
| 696 | 922 | return $plain; |
| 697 | - } | |
| 698 | - | |
| 699 | - /** | |
| 700 | - * Derive a 32-byte encryption key from the site's auth salt. | |
| 701 | - * | |
| 702 | - * @return string Raw 32-byte key, or '' if salts are unavailable. | |
| 703 | - */ | |
| 704 | - private function encryption_key(): string { | |
| 705 | - if (!function_exists('wp_salt')) { | |
| 706 | - return ''; | |
| 707 | - } | |
| 708 | - // 32 raw bytes from a site-specific secret — SHA-256 output length | |
| 709 | - // matches SODIUM_CRYPTO_SECRETBOX_KEYBYTES. | |
| 710 | - return hash('sha256', 'thinkrank-settings|' . wp_salt('auth'), true); | |
| 711 | 923 | } |
| 712 | 924 | } |
