← All changes | includes/class-settings.php +671 -26 2.11.7 → 3.0.2 View file →

		@@ -93,8 +93,14 @@
93	93	// Proxy / CDN: forwarded header to trust for the visitor IP.
94	94	// Empty = trust only REMOTE_ADDR (the real connection, unspoofable).
95	95	'trusted_proxy_header' => '',
96	96
	97	+ // Proxy / CDN: IPs or CIDR ranges the forwarded header is accepted
	98	+ // from. Empty = accept it only from your own network, and, for
	99	+ // CF-Connecting-IP, Cloudflare's own ranges. Since 2.11.9, so a
	100	+ // header cannot be forged by a visitor reaching the origin directly.
	101	+ 'trusted_proxies' => array(),
	102	+
97	103	// User-Agent management
98	104	'ua_whitelist' => array(),
99	105	'ua_blacklist' => array(),
100	106
		@@ -552,8 +558,34 @@
552	558
553	559	/**
554	560	* Deep merge arrays
555	561	*
	562	+ * Associative arrays are merged key by key, because that is what lets a
	563	+ * saved option keep working when a release adds a setting. Lists are
	564	+ * replaced whole, and that part is not cosmetic: merging a list key by key
	565	+ * means index by index, so a stored list shorter than the default came back
	566	+ * with the default's tail glued to it. Saving "administrator" alone into
	567	+ * enforced_roles (default administrator, editor) was read back as
	568	+ * administrator, editor, and unchecking every role was read back as the two
	569	+ * defaults, so three role pickers could not be narrowed at all. It is the
	570	+ * same bug merge_preset() was given its own merge for in 2.9.8; the fix
	571	+ * never reached this one or the one in the admin save.
	572	+ *
	573	+ * An empty saved list therefore means empty, not "fall back to the default".
	574	+ * That is the honest reading of what was saved, and the save path is what
	575	+ * makes sure a list only becomes empty when somebody emptied it: a list the
	576	+ * form did not carry is left alone rather than blanked.
	577	+ *
	578	+ * Which of the two happens is decided by the DEFAULT, never by what was
	579	+ * saved. Deciding by what was saved looks equivalent and is not: an empty
	580	+ * array is a list by any definition, so a section stored as array() would
	581	+ * have replaced a whole group of settings instead of merging into it, and
	582	+ * every key of that group would have come back missing. Found by the third
	583	+ * cross review of this release, measured on rest_api_security (7 keys to 0)
	584	+ * and on registration_approval (4 to 0, including its enabled flag).
	585	+ *
	586	+ * @since 3.0.1 Lists replace instead of merging index by index.
	587	+ *
556	588	* @param array $defaults Default values.
557	589	* @param array $saved Saved values.
558	590	* @return array Merged array.
559	591	*/
		@@ -558,17 +590,17 @@
558	590	* @return array Merged array.
559	591	*/
560	592	private function array_merge_deep( $defaults, $saved ) {
561	593	$result = $defaults;
562		-
	594	+
563	595	foreach ( $saved as $key => $value ) {
564		- if ( is_array( $value ) && isset( $result[ $key ] ) && is_array( $result[ $key ] ) ) {
	596	+ if ( is_array( $value ) && isset( $result[ $key ] ) && is_array( $result[ $key ] ) && ! self::is_list( $result[ $key ] ) ) {
565	597	$result[ $key ] = $this->array_merge_deep( $result[ $key ], $value );
566	598	} else {
567	599	$result[ $key ] = $value;
568	600	}
569	601	}
570		-
	602	+
571	603	return $result;
572	604	}
573	605
574	606	/**
		@@ -700,9 +732,12 @@
700	732	* @since 2.10.1
701	733	* @return bool
702	734	*/
703	735	public static function owns_shared_files() {
704		- return ! is_multisite() || is_main_site();
	736	+ // One wp-config.php and one root .htaccess per installation, even with
	737	+ // several networks in it: is_main_site() alone is true on the main site
	738	+ // of every network. Since 2.11.8, found by the audit of the network.
	739	+ return ! is_multisite() || ( is_main_site() && is_main_network() );
705	740	}
706	741
707	742	public static function can_write_shared_files() {
708	743	if ( ! is_multisite() ) {
		@@ -708,9 +743,11 @@
708	743	if ( ! is_multisite() ) {
709	744	return true;
710	745	}
711	746
712		- if ( ! is_main_site() ) {
	747	+ // See owns_shared_files(): the main site of a secondary network, and
	748	+ // its network administrator, do not own the installation's files.
	749	+ if ( ! is_main_site() || ! is_main_network() ) {
713	750	return false;
714	751	}
715	752
716	753	// WP-CLI with nobody logged in: there is no user to ask, and the site is
		@@ -779,8 +816,15 @@
779	816	* addresses that receive the alerts is another, and nobody presses a button
780	817	* called "restore defaults" expecting that. Both the Standard preset and the
781	818	* two reset buttons leave these alone.
782	819	*
	820	+ * Read from outside the plugin: the third-party network plugin Vigilante
	821	+ * Network Sync calls this from its 2.0.3 to decide what NOT to copy between
	822	+ * the sites of a network, so a key it does not know about is preserved per
	823	+ * site instead of overwritten. Adding keys here is safe and helps it;
	824	+ * renaming or removing the method, or changing the shape of what it returns,
	825	+ * silently changes what that plugin replicates across a whole network.
	826	+ *
783	827	* @since 2.9.8
784	828	*
785	829	* @return array<string,string[]>
786	830	*/
		@@ -785,9 +829,9 @@
785	829	* @return array<string,string[]>
786	830	*/
787	831	public static function get_user_data_keys() {
788	832	return array(
789		- 'firewall' => array( 'ip_whitelist', 'ip_blacklist', 'ua_whitelist', 'ua_blacklist', 'trusted_proxy_header' ),
	833	+ 'firewall' => array( 'ip_whitelist', 'ip_blacklist', 'ua_whitelist', 'ua_blacklist', 'trusted_proxy_header', 'trusted_proxies' ),
790	834	'login_security' => array( 'ip_whitelist', 'custom_login_url', 'two_factor' ),
791	835	'user_security' => array( 'insecure_usernames' ),
792	836	'file_integrity' => array( 'excluded_paths', 'excluded_extensions' ),
793	837	'email' => array( 'additional_recipients' ),
		@@ -831,12 +875,28 @@
831	875	* get_shared_file_settings() lists what does nothing but end up in a shared
832	876	* file. These do both: blocking bad bots and bad query strings, the visitor
833	877	* IP detection and the two whitelists run in PHP for the site that stores
834	878	* them, and on the main site of a network they are also what the .htaccess
835		- * rules of every site are generated from; the three module switches decide
836		- * whether the .htaccess blocks and the wp-config.php constants exist at all.
837		- * On a subsite they only act on that site, so they stay editable there.
	879	+ * rules of every site are generated from; the three writing module switches
	880	+ * (firewall, security_headers, wp_hardening) decide whether the .htaccess
	881	+ * blocks and the wp-config.php constants exist at all.
838	882	*
	883	+ * Since 2.11.8 it also locks what decides whether the shared files are
	884	+ * WATCHED, not built: the File Integrity module and its scan_critical_config
	885	+ * switch. On the main site the critical-file scan is the network's canary
	886	+ * for a change to wp-config.php or the root .htaccess, which only a network
	887	+ * administrator can approve, so a main-site administrator without network
	888	+ * rights must not be able to silence it by turning either one off. Closing
	889	+ * the ignore list and the clear-results button in 2.11.8 left these two as
	890	+ * the remaining routes; found by the audit of the admin surface.
	891	+ *
	892	+ * Since 3.0.0 the self-check has no setting at all, so there is nothing to lock: Vigilant's own
	893	+ * files are shared by every site, and on the main site the self-check is
	894	+ * the one that reports a change to them for the whole network.
	895	+ *
	896	+ * On a subsite all of them only act on that site, so they stay editable
	897	+ * there (get_locked_file_settings() adds this set only when owns_shared_files()).
	898	+ *
839	899	* Until 2.11.6 an administrator of the main site without network rights
840	900	* could change any of them, and the file-only ones too: the write to the
841	901	* file was refused at that moment, but the value stayed stored, and the
842	902	* refresh after the next update, or the next save by a network
		@@ -842,15 +902,283 @@
842	902	* refresh after the next update, or the next save by a network
843	903	* administrator, published it to the whole network.
844	904	*
845	905	* @since 2.11.6
	906	+ * @since 2.11.8 The file_integrity module and scan_critical_config.
846	907	*
847	908	* @return array<string,string[]>
848	909	*/
	910	+ /**
	911	+ * The two factor policy that governs this installation
	912	+ *
	913	+ * On a network the answer must not depend on which site the login happens to
	914	+ * arrive at, because the cookie WordPress issues does not: COOKIEHASH comes
	915	+ * from the network siteurl (wp-includes/default-constants.php) and
	916	+ * COOKIE_DOMAIN covers every host of the network
	917	+ * (wp-includes/ms-default-constants.php). Until 2.11.10 the settings, the
	918	+ * enforced roles and the TOTP table were all read per site, so somebody
	919	+ * holding the password of an administrator protected by 2FA on the main site
	920	+ * posted the login to a subsite where that account has no role, was never
	921	+ * asked for a code, and came out with a session valid across the network.
	922	+ * Measured on the Multisite install on 12 sep 2026 (user_requires_2fa true on
	923	+ * the main site, false on demo2 for the same account) and found by the
	924	+ * file-by-file review of 2.11.10.
	925	+ *
	926	+ * So the policy of the main site governs the whole network. On a single site
	927	+ * this is the site's own configuration and nothing changes.
	928	+ *
	929	+ * @since 2.11.10
	930	+ *
	931	+ * @return array The two_factor section that applies.
	932	+ */
	933	+ public static function two_factor_policy() {
	934	+ $options = is_multisite()
	935	+ ? get_blog_option( get_main_site_id(), self::OPTION_NAME, array() )
	936	+ : get_option( self::OPTION_NAME, array() );
	937	+
	938	+ if ( ! is_array( $options ) ) {
	939	+ return array();
	940	+ }
	941	+
	942	+ $login = isset( $options['login_security'] ) && is_array( $options['login_security'] )
	943	+ ? $options['login_security']
	944	+ : array();
	945	+
	946	+ return ( isset( $login['two_factor'] ) && is_array( $login['two_factor'] ) ) ? $login['two_factor'] : array();
	947	+ }
	948	+
	949	+ /**
	950	+ * Whether two factor is required for this account, anywhere in the network
	951	+ *
	952	+ * Union, and deliberately so. Reading the policy only from the main site,
	953	+ * which is what this release did at first, would have switched two factor off
	954	+ * for every network that has it configured per subsite, which until now was
	955	+ * the only way it could be configured at all: a silent downgrade of the very
	956	+ * protection being fixed. Found by the cross review of 2.11.10. So the
	957	+ * question is asked of every site the account belongs to, plus the main site,
	958	+ * each with its own enforced roles and exclusions, and one yes is enough.
	959	+ *
	960	+ * That also closes the bypass: the settings, the roles and the enrolment used
	961	+ * to be read from whichever site the login arrived at, while the cookie
	962	+ * WordPress issues is valid across the whole network (COOKIEHASH comes from
	963	+ * the network siteurl and COOKIE_DOMAIN covers every host of it), so an
	964	+ * account protected on one site could log in through another and come out
	965	+ * with a session valid everywhere.
	966	+ *
	967	+ * @since 2.11.10
	968	+ *
	969	+ * @param WP_User $user User being authenticated.
	970	+ * @return bool
	971	+ */
	972	+ public static function two_factor_required_for( $user ) {
	973	+ return array() !== self::two_factor_demands_for( $user );
	974	+ }
	975	+
	976	+ /**
	977	+ * Which second factor methods this account is asked for, across the network
	978	+ *
	979	+ * Empty when nothing asks. On a network there can be more than one, because
	980	+ * each site keeps its own settings and the requirement is the union of them.
	981	+ *
	982	+ * @since 2.11.10
	983	+ *
	984	+ * @param WP_User $user User being authenticated.
	985	+ * @return string[] Methods asked for, without repeats.
	986	+ */
	987	+ public static function two_factor_methods_for( $user ) {
	988	+ $methods = array();
	989	+
	990	+ foreach ( self::two_factor_demands_for( $user ) as $settings ) {
	991	+ $method = isset( $settings['method'] ) ? (string) $settings['method'] : 'email';
	992	+
	993	+ // A method this version does not know is read as the default rather
	994	+ // than left to fall through. Registering nothing at all is how the
	995	+ // second factor of a whole network went quiet in silence: a saved
	996	+ // value of '' (which validate_section() lets through on an import,
	997	+ // since only the tab has an allowlist) matched neither class, so no
	998	+ // filter was registered anywhere while every screen still said two
	999	+ // factor was on. Found by the third cross review of 2.11.10.
	1000	+ $methods[] = in_array( $method, array( 'email', 'totp' ), true ) ? $method : 'email';
	1001	+ }
	1002	+
	1003	+ return array_values( array_unique( $methods ) );
	1004	+ }
	1005	+
	1006	+ /**
	1007	+ * Which of the two second factor classes handles this login
	1008	+ *
	1009	+ * The method cannot be read from one site's settings, and reading it from the
	1010	+ * main site was the hole the third cross review of 2.11.10 found: with the
	1011	+ * main site on totp and a subsite asking for a code by email, the class that
	1012	+ * registered was TOTP, the account had no enrolment, and the "not set up yet"
	1013	+ * branch let the login through. In 2.11.9 that same login was asked for its
	1014	+ * emailed code. So the question is asked per account, not per site.
	1015	+ *
	1016	+ * The order is what keeps it closed at both ends:
	1017	+ *
	1018	+ * 1. An enrolment already made wins while some site asking for a second
	1019	+ * factor asks for an authenticator app. It is the strongest factor the
	1020	+ * account has and it is ready to use, wherever in the network it was set
	1021	+ * up.
	1022	+ * 2. Otherwise, if any site asking for a second factor asks for email, email
	1023	+ * handles it. Email needs no enrolment, so it can never fall into the
	1024	+ * branch that lets a login through for lack of one.
	1025	+ * 3. Only when every site asking wants an authenticator app does TOTP handle
	1026	+ * it, which is the case the grace period was written for.
	1027	+ *
	1028	+ * The condition on the first step came in 2.11.11. Without it an enrolment
	1029	+ * left from a time when the site asked for an app outranked the method the
	1030	+ * site asks for now: a single site set to email asked those accounts for an
	1031	+ * authenticator code, which 2.11.9 never did and which locks out whoever
	1032	+ * removed the app after the switch. Dropping that enrolment opens nothing,
	1033	+ * because the account then goes to email, which needs no enrolment.
	1034	+ *
	1035	+ * @since 2.11.10
	1036	+ * @since 2.11.11 An enrolment only wins while an authenticator app is asked for.
	1037	+ *
	1038	+ * @param WP_User $user User being authenticated.
	1039	+ * @param bool $enrolled Whether the account has a TOTP enrolment anywhere.
	1040	+ * @return string 'email', 'totp', or '' when nothing asks.
	1041	+ */
	1042	+ public static function two_factor_handler_for( $user, $enrolled ) {
	1043	+ $methods = self::two_factor_methods_for( $user );
	1044	+
	1045	+ if ( ! $methods ) {
	1046	+ return '';
	1047	+ }
	1048	+
	1049	+ if ( $enrolled && in_array( 'totp', $methods, true ) ) {
	1050	+ return 'totp';
	1051	+ }
	1052	+
	1053	+ return in_array( 'email', $methods, true ) ? 'email' : 'totp';
	1054	+ }
	1055	+
	1056	+ /**
	1057	+ * The two factor settings of every site that asks this account for one
	1058	+ *
	1059	+ * @since 2.11.10
	1060	+ *
	1061	+ * @param WP_User $user User being authenticated.
	1062	+ * @return array[] The two_factor section of each site that asks.
	1063	+ */
	1064	+ private static function two_factor_demands_for( $user ) {
	1065	+ if ( empty( $user->ID ) ) {
	1066	+ return array();
	1067	+ }
	1068	+
	1069	+ if ( ! is_multisite() ) {
	1070	+ $roles = ( isset( $user->roles ) && is_array( $user->roles ) ) ? $user->roles : array();
	1071	+ $policy = self::two_factor_policy();
	1072	+
	1073	+ return self::two_factor_site_requires( $policy, $user, $roles ) ? array( $policy ) : array();
	1074	+ }
	1075	+
	1076	+ $demands = array();
	1077	+ $blog_ids = array( (int) get_main_site_id() );
	1078	+
	1079	+ /*
	1080	+ * A super administrator is a member of almost no site (measured on the
	1081	+ * Multisite install: of three sites, the network owner belongs to one),
	1082	+ * yet can log in through any of them and the cookie is valid everywhere.
	1083	+ * Asking only the sites they belong to left the account with the most
	1084	+ * power in the network outside the policy, which is the bypass upside
	1085	+ * down. So for them every site of the network is consulted. There are
	1086	+ * few super administrators. It does not only run at login, though, which
	1087	+ * this note claimed until 2.11.11: the dashboard hooks of the TOTP class
	1088	+ * ask it on every admin screen of every site of a network, at least once
	1089	+ * per hook.
	1090	+ */
	1091	+ if ( is_super_admin( $user->ID ) ) {
	1092	+ $blog_ids = array_merge( $blog_ids, get_sites( array( 'fields' => 'ids', 'number' => 200 ) ) );
	1093	+ }
	1094	+
	1095	+ foreach ( get_blogs_of_user( $user->ID ) as $blog ) {
	1096	+ if ( ! empty( $blog->userblog_id ) ) {
	1097	+ $blog_ids[] = (int) $blog->userblog_id;
	1098	+ }
	1099	+ }
	1100	+
	1101	+ foreach ( array_unique( $blog_ids ) as $blog_id ) {
	1102	+ $options = get_blog_option( $blog_id, self::OPTION_NAME, array() );
	1103	+
	1104	+ if ( ! is_array( $options ) || empty( $options['login_security']['two_factor'] ) ) {
	1105	+ continue;
	1106	+ }
	1107	+
	1108	+ /*
	1109	+ * A site whose Login Security module is off asks for nothing, and
	1110	+ * reading only the sub-setting made it ask anyway: a subsite that had
	1111	+ * switched the whole module off, leaving an orphan two_factor.enabled
	1112	+ * behind, imposed a second factor on every account of the network,
	1113	+ * with no screen anywhere explaining why. It is the two-level toggle
	1114	+ * trap of this plugin read upside down. Found by the third cross
	1115	+ * review of 2.11.10.
	1116	+ */
	1117	+ if ( empty( $options['modules']['login_security'] ) ) {
	1118	+ continue;
	1119	+ }
	1120	+
	1121	+ $elsewhere = new WP_User( $user->ID );
	1122	+ $elsewhere->for_site( $blog_id );
	1123	+
	1124	+ // A super administrator can hold no role row anywhere, and is judged
	1125	+ // as an administrator so the strictest policy of the network reaches
	1126	+ // the account with the most power in it.
	1127	+ $roles = ( isset( $elsewhere->roles ) && is_array( $elsewhere->roles ) && $elsewhere->roles )
	1128	+ ? $elsewhere->roles
	1129	+ : ( is_super_admin( $user->ID ) ? array( 'administrator' ) : array() );
	1130	+
	1131	+ if ( self::two_factor_site_requires( $options['login_security']['two_factor'], $user, $roles ) ) {
	1132	+ $demands[] = $options['login_security']['two_factor'];
	1133	+ }
	1134	+ }
	1135	+
	1136	+ return $demands;
	1137	+ }
	1138	+
	1139	+ /**
	1140	+ * Whether one site's two factor settings cover this account
	1141	+ *
	1142	+ * @since 2.11.10
	1143	+ *
	1144	+ * @param array $settings The two_factor section of one site.
	1145	+ * @param WP_User $user User being authenticated.
	1146	+ * @param string[] $roles Roles the account holds on that site.
	1147	+ * @return bool
	1148	+ */
	1149	+ private static function two_factor_site_requires( $settings, $user, $roles ) {
	1150	+ if ( ! is_array( $settings ) || empty( $settings['enabled'] ) ) {
	1151	+ return false;
	1152	+ }
	1153	+
	1154	+ $excluded = isset( $settings['excluded_users'] ) ? array_map( 'absint', (array) $settings['excluded_users'] ) : array();
	1155	+
	1156	+ if ( in_array( (int) $user->ID, $excluded, true ) ) {
	1157	+ return false;
	1158	+ }
	1159	+
	1160	+ $enforced = isset( $settings['enforced_roles'] ) ? (array) $settings['enforced_roles'] : array( 'administrator', 'editor' );
	1161	+
	1162	+ return (bool) array_intersect( (array) $roles, $enforced );
	1163	+ }
	1164	+
	1165	+ /**
	1166	+ * Settings that only a network administrator may change on the main site
	1167	+ *
	1168	+ * @return array<string,string[]>
	1169	+ */
849	1170	public static function get_main_site_file_settings() {
850	1171	return array(
851		- 'modules' => array( 'firewall', 'security_headers', 'wp_hardening' ),
852		- 'firewall' => array( 'block_bad_bots', 'block_bad_query_strings', 'trusted_proxy_header', 'ip_whitelist', 'ua_whitelist' ),
	1172	+ 'modules' => array( 'firewall', 'security_headers', 'wp_hardening', 'file_integrity' ),
	1173	+ // trusted_proxies goes with trusted_proxy_header, and leaving it out
	1174	+ // was a hole: the header decides which address the firewall of the
	1175	+ // whole installation acts on, and this list decides which peers may
	1176	+ // set that header. An administrator of the main site without network
	1177	+ // rights who could edit only this half turned every visitor into a
	1178	+ // trusted proxy. Found by the file-by-file review of 2.11.10.
	1179	+ 'firewall' => array( 'block_bad_bots', 'block_bad_query_strings', 'trusted_proxy_header', 'trusted_proxies', 'ip_whitelist', 'ua_whitelist' ),
	1180	+ 'file_integrity' => array( 'scan_critical_config' ),
853	1181	);
854	1182	}
855	1183
856	1184	/**
		@@ -900,13 +1228,29 @@
900	1228	*/
901	1229	public static function keep_locked_file_settings( $options, $stored ) {
902	1230	$options = is_array( $options ) ? $options : array();
903	1231	$stored = is_array( $stored ) ? $stored : array();
	1232	+ $locked = self::get_locked_file_settings();
904	1233
905		- foreach ( self::get_locked_file_settings() as $section => $keys ) {
	1234	+ if ( ! $locked ) {
	1235	+ return $options;
	1236	+ }
	1237	+
	1238	+ /*
	1239	+ * A key that was never stored takes its default, which is what it was
	1240	+ * worth before. Until 2.11.8 it was dropped instead, and the sanitize
	1241	+ * callback of the option filled it in again, but validate_options()
	1242	+ * fills a missing module switch with false, not with its default.
	1243	+ */
	1244	+ $instance = new self();
	1245	+ $defaults = $instance->get_default_options();
	1246	+
	1247	+ foreach ( $locked as $section => $keys ) {
906	1248	if ( true === $keys ) {
907	1249	if ( array_key_exists( $section, $stored ) ) {
908	1250	$options[ $section ] = $stored[ $section ];
	1251	+ } elseif ( isset( $defaults[ $section ] ) ) {
	1252	+ $options[ $section ] = $defaults[ $section ];
909	1253	} else {
910	1254	unset( $options[ $section ] );
911	1255	}
912	1256	continue;
		@@ -911,19 +1255,27 @@
911	1255	}
912	1256	continue;
913	1257	}
914	1258
915		- $stored_section = ( isset( $stored[ $section ] ) && is_array( $stored[ $section ] ) ) ? $stored[ $section ] : array();
	1259	+ $stored_section = ( isset( $stored[ $section ] ) && is_array( $stored[ $section ] ) ) ? $stored[ $section ] : array();
	1260	+ $default_section = ( isset( $defaults[ $section ] ) && is_array( $defaults[ $section ] ) ) ? $defaults[ $section ] : array();
916	1261
917	1262	foreach ( $keys as $key ) {
918	1263	if ( array_key_exists( $key, $stored_section ) ) {
919		- if ( ! isset( $options[ $section ] ) || ! is_array( $options[ $section ] ) ) {
920		- $options[ $section ] = array();
	1264	+ $value = $stored_section[ $key ];
	1265	+ } elseif ( array_key_exists( $key, $default_section ) ) {
	1266	+ $value = $default_section[ $key ];
	1267	+ } else {
	1268	+ if ( isset( $options[ $section ] ) && is_array( $options[ $section ] ) ) {
	1269	+ unset( $options[ $section ][ $key ] );
921	1270	}
922		- $options[ $section ][ $key ] = $stored_section[ $key ];
923		- } elseif ( isset( $options[ $section ] ) && is_array( $options[ $section ] ) ) {
924		- unset( $options[ $section ][ $key ] );
	1271	+ continue;
925	1272	}
	1273	+
	1274	+ if ( ! isset( $options[ $section ] ) || ! is_array( $options[ $section ] ) ) {
	1275	+ $options[ $section ] = array();
	1276	+ }
	1277	+ $options[ $section ][ $key ] = $value;
926	1278	}
927	1279	}
928	1280
929	1281	return $options;
		@@ -929,8 +1281,65 @@
929	1281	return $options;
930	1282	}
931	1283
932	1284	/**
	1285	+ * Take a lock kept as a row of the options table, or report that another request holds it
	1286	+ *
	1287	+ * add_option() cannot be a lock: it runs INSERT ... ON DUPLICATE KEY UPDATE
	1288	+ * (wp-includes/option.php:1142 in WP 7.1), so two requests that both find
	1289	+ * the option missing both "create" it and both believe they hold it. INSERT
	1290	+ * IGNORE creates the row for exactly one of them, which is what core does in
	1291	+ * WP_Upgrader::create_lock() (wp-admin/includes/class-wp-upgrader.php:1065).
	1292	+ * A lock older than the timeout counts as abandoned, by a fatal error between
	1293	+ * taking and releasing it, and only one request takes it over.
	1294	+ *
	1295	+ * @since 2.11.8
	1296	+ *
	1297	+ * @param string $name Option name of the lock, in the current site's table.
	1298	+ * @param int $timeout Seconds after which a held lock counts as abandoned.
	1299	+ * @return bool True if this request now holds the lock.
	1300	+ */
	1301	+ public static function acquire_option_lock( $name, $timeout ) {
	1302	+ global $wpdb;
	1303	+
	1304	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- an atomic lock needs INSERT IGNORE, which the options API does not offer; same query as WP_Upgrader::create_lock().
	1305	+ if ( $wpdb->query( $wpdb->prepare( "INSERT IGNORE INTO {$wpdb->options} ( option_name, option_value, autoload ) VALUES ( %s, %s, 'no' )", $name, (string) time() ) ) ) {
	1306	+ wp_cache_delete( $name, 'options' );
	1307	+ return true;
	1308	+ }
	1309	+
	1310	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- the lock row as stored right now, not a cached copy.
	1311	+ $held = $wpdb->get_var( $wpdb->prepare( "SELECT option_value FROM {$wpdb->options} WHERE option_name = %s", $name ) );
	1312	+
	1313	+ if ( null === $held || ( time() - (int) $held ) < $timeout ) {
	1314	+ return false;
	1315	+ }
	1316	+
	1317	+ // Abandoned: the delete only matches the value that was read, and only one
	1318	+ // request wins the insert that follows.
	1319	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- removes an abandoned lock row.
	1320	+ $wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->options} WHERE option_name = %s AND option_value = %s", $name, $held ) );
	1321	+
	1322	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- same atomic insert as above.
	1323	+ return (bool) $wpdb->query( $wpdb->prepare( "INSERT IGNORE INTO {$wpdb->options} ( option_name, option_value, autoload ) VALUES ( %s, %s, 'no' )", $name, (string) time() ) );
	1324	+ }
	1325	+
	1326	+ /**
	1327	+ * Release a lock taken with acquire_option_lock()
	1328	+ *
	1329	+ * @since 2.11.8
	1330	+ *
	1331	+ * @param string $name Option name of the lock.
	1332	+ */
	1333	+ public static function release_option_lock( $name ) {
	1334	+ global $wpdb;
	1335	+
	1336	+ // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching -- removes the row acquire_option_lock() inserted.
	1337	+ $wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->options} WHERE option_name = %s", $name ) );
	1338	+ wp_cache_delete( $name, 'options' );
	1339	+ }
	1340	+
	1341	+ /**
933	1342	* Put a configuration back to the defaults without deleting what the owner typed
934	1343	*
935	1344	* @since 2.9.8
936	1345	*
		@@ -1024,8 +1433,55 @@
1024	1433	return $base;
1025	1434	}
1026	1435
1027	1436	/**
	1437	+ * A stored list, or the shipped one when it arrives empty
	1438	+ *
	1439	+ * For the four lists that have NO field on any screen: the allowed HTTP
	1440	+ * methods, the insecure usernames, the public REST endpoints and the roles
	1441	+ * of registration approval. Nobody can empty those from the interface, so
	1442	+ * an empty one is a leftover, and every version up to 3.0.0 produced them:
	1443	+ * saving any tab wrote array() over every list of that section whose key the
	1444	+ * form did not carry, which for these four was always. Reading the settings
	1445	+ * hid it by merging the shipped values on top, and 3.0.1 stops doing that,
	1446	+ * because a stored empty list is what makes unticking every role work.
	1447	+ *
	1448	+ * The migration in vigilante.php removes those keys once. This is the line
	1449	+ * of defence for every other route, including Under Attack, which
	1450	+ * photographs the raw option when it is switched on and puts it back whole
	1451	+ * when it expires, after the migration has already marked itself done.
	1452	+ *
	1453	+ * It goes through every reader of those four lists, the ones that enforce
	1454	+ * and the ones that only report, because a screen that says "no insecure
	1455	+ * user" while the check is blocking them is its own kind of wrong. The
	1456	+ * shipped value is read from get_default_options() rather than written out
	1457	+ * again here: a second copy of a list drifts from the first.
	1458	+ *
	1459	+ * @since 3.0.1
	1460	+ *
	1461	+ * @param mixed $value Stored value, as the caller already has it.
	1462	+ * @param string[] $path Path of the setting in the options array.
	1463	+ * @return array
	1464	+ */
	1465	+ public static function list_or_shipped( $value, $path ) {
	1466	+ if ( is_array( $value ) && array() !== $value ) {
	1467	+ return $value;
	1468	+ }
	1469	+
	1470	+ $instance = new self();
	1471	+ $shipped = $instance->get_default_options();
	1472	+
	1473	+ foreach ( (array) $path as $key ) {
	1474	+ if ( ! is_array( $shipped ) || ! array_key_exists( $key, $shipped ) ) {
	1475	+ return array();
	1476	+ }
	1477	+ $shipped = $shipped[ $key ];
	1478	+ }
	1479	+
	1480	+ return is_array( $shipped ) ? $shipped : array();
	1481	+ }
	1482	+
	1483	+ /**
1028	1484	* Whether an array is a plain list (0..n-1 keys)
1029	1485	*
1030	1486	* array_is_list() is PHP 8.1 and this plugin supports 7.4.
1031	1487	*
		@@ -1030,12 +1486,16 @@
1030	1486	* array_is_list() is PHP 8.1 and this plugin supports 7.4.
1031	1487	*
1032	1488	* @since 2.9.8
1033	1489	*
	1490	+ * Public since 3.0.1 because the admin save path needs the same answer: the
	1491	+ * two places that used to merge lists index by index have to agree on what
	1492	+ * a list is, or they disagree on a different subset of the settings.
	1493	+ *
1034	1494	* @param array $value Array to inspect.
1035	1495	* @return bool
1036	1496	*/
1037		- private static function is_list( $value ) {
	1497	+ public static function is_list( $value ) {
1038	1498	if ( array() === $value ) {
1039	1499	return true;
1040	1500	}
1041	1501
		@@ -1251,8 +1711,171 @@
1251	1711	);
1252	1712	}
1253	1713
1254	1714	/**
	1715	+ * The settings that hold a list of file paths, by section
	1716	+ *
	1717	+ * A path is read by what it is. sanitize_text_field() deletes every %XX octet
	1718	+ * and, when it finds one, collapses repeated spaces, so an exclusion written
	1719	+ * for a folder called foto%20x was saved as fotox and excluded nothing: the
	1720	+ * scan compares what is stored with the paths it finds, one by one (measured
	1721	+ * on 1 oct 2026 against 3.0.1). Every other list in the options is a list of
	1722	+ * addresses, names or extensions, where nothing meaningful is lost, and keeps
	1723	+ * its reader.
	1724	+ *
	1725	+ * @since 3.0.2
	1726	+ *
	1727	+ * @return array<string,string[]>
	1728	+ */
	1729	+ public static function path_list_keys() {
	1730	+ return array(
	1731	+ 'file_integrity' => array( 'excluded_paths' ),
	1732	+ );
	1733	+ }
	1734	+
	1735	+ /**
	1736	+ * One path as it was typed: invalid UTF-8 out, the ends trimmed, and nothing
	1737	+ * else touched. Invalid UTF-8 has to go because the option would not be
	1738	+ * written with it.
	1739	+ *
	1740	+ * A line that has tags (or a stray <) is dropped whole, not cut. A path has
	1741	+ * none, and wp_strip_all_tags() would cut it at the < and leave a shorter path
	1742	+ * than the one written, which excludes more than anyone asked: a folder
	1743	+ * called a<b would exclude a. Until 3.0.1 the < was kept as an entity, which
	1744	+ * matched nothing, and dropping the line has the same effect.
	1745	+ *
	1746	+ * A line with a line break inside is dropped too. The textarea is read line by
	1747	+ * line, so only an element of a list can have one (an export edited by hand),
	1748	+ * and the next save of the tab would show it as two lines and store two paths:
	1749	+ * a, a line break and wp-content would end up excluding all of wp-content.
	1750	+ * 3.0.1 turned the break into a space, which matched nothing, and dropping the
	1751	+ * line has the same effect (fourth cross review, 1 oct 2026).
	1752	+ *
	1753	+ * @since 3.0.2
	1754	+ *
	1755	+ * @param mixed $line Entry.
	1756	+ * @return string
	1757	+ */
	1758	+ public static function sanitize_path_line( $line ) {
	1759	+ if ( ! is_scalar( $line ) ) {
	1760	+ return '';
	1761	+ }
	1762	+
	1763	+ $line = trim( wp_check_invalid_utf8( (string) $line, true ) );
	1764	+
	1765	+ if ( false !== strpbrk( $line, "\r\n" ) ) {
	1766	+ return '';
	1767	+ }
	1768	+
	1769	+ return wp_strip_all_tags( $line ) === $line ? $line : '';
	1770	+ }
	1771	+
	1772	+ /**
	1773	+ * The text of a textarea of paths, one per line, each line read as one path.
	1774	+ *
	1775	+ * Line by line, because a stray < in one line would take the lines after it
	1776	+ * with it if the whole text went through wp_strip_all_tags().
	1777	+ *
	1778	+ * @since 3.0.2
	1779	+ *
	1780	+ * @param mixed $text Text.
	1781	+ * @return string
	1782	+ */
	1783	+ public static function sanitize_path_text( $text ) {
	1784	+ $lines = preg_split( '/\r\n|\r|\n/', (string) $text );
	1785	+
	1786	+ return implode( "\n", array_map( array( __CLASS__, 'sanitize_path_line' ), (array) $lines ) );
	1787	+ }
	1788	+
	1789	+ /**
	1790	+ * Take the lists of paths out of a settings tree before the generic sanitizer reads it
	1791	+ *
	1792	+ * Known limits (fourth cross review, 1 oct 2026), none reachable from the
	1793	+ * settings screen and all on the side of watching more: process_section_data()
	1794	+ * reads the entries of a list posted as an array (excluded_paths[]=) with
	1795	+ * sanitize_text_field() and applies sanitize_key() to the keys, so a key
	1796	+ * written with another spelling is not found here, and a form posted as an
	1797	+ * array instead of a string goes through a generic sanitizer. In those three
	1798	+ * the %XX are lost, as they were in 3.0.1.
	1799	+ *
	1800	+ * @since 3.0.2
	1801	+ *
	1802	+ * @param mixed $data Settings tree: section => key => value.
	1803	+ * @return array Only the path lists that are present, in the same shape, each already read as paths.
	1804	+ */
	1805	+ public static function take_path_lists( $data ) {
	1806	+ $taken = array();
	1807	+
	1808	+ if ( ! is_array( $data ) ) {
	1809	+ return $taken;
	1810	+ }
	1811	+
	1812	+ foreach ( self::path_list_keys() as $section => $keys ) {
	1813	+ if ( ! isset( $data[ $section ] ) || ! is_array( $data[ $section ] ) ) {
	1814	+ continue;
	1815	+ }
	1816	+
	1817	+ foreach ( $keys as $key ) {
	1818	+ if ( ! isset( $data[ $section ][ $key ] ) ) {
	1819	+ continue;
	1820	+ }
	1821	+
	1822	+ $value = $data[ $section ][ $key ];
	1823	+
	1824	+ if ( is_array( $value ) ) {
	1825	+ $taken[ $section ][ $key ] = array_map( array( __CLASS__, 'sanitize_path_line' ), array_values( array_filter( $value, 'is_scalar' ) ) );
	1826	+ } elseif ( is_scalar( $value ) ) {
	1827	+ $taken[ $section ][ $key ] = self::sanitize_path_text( $value );
	1828	+ }
	1829	+ }
	1830	+ }
	1831	+
	1832	+ return $taken;
	1833	+ }
	1834	+
	1835	+ /**
	1836	+ * Put back the lists of paths take_path_lists() took out, over what the generic sanitizer left
	1837	+ *
	1838	+ * @since 3.0.2
	1839	+ *
	1840	+ * @param mixed $data Sanitized settings tree.
	1841	+ * @param array $taken What take_path_lists() returned for the same tree.
	1842	+ * @return mixed The tree, with the path lists as they were read.
	1843	+ */
	1844	+ public static function restore_path_lists( $data, $taken ) {
	1845	+ if ( ! is_array( $data ) ) {
	1846	+ return $data;
	1847	+ }
	1848	+
	1849	+ foreach ( $taken as $section => $values ) {
	1850	+ if ( ! isset( $data[ $section ] ) || ! is_array( $data[ $section ] ) ) {
	1851	+ continue;
	1852	+ }
	1853	+
	1854	+ foreach ( $values as $key => $value ) {
	1855	+ $data[ $section ][ $key ] = $value;
	1856	+ }
	1857	+ }
	1858	+
	1859	+ return $data;
	1860	+ }
	1861	+
	1862	+ /**
	1863	+ * Whether a position in the options, as section.key, is a list of paths
	1864	+ *
	1865	+ * @since 3.0.2
	1866	+ *
	1867	+ * @param string $trail Section and key joined by a dot.
	1868	+ * @return bool
	1869	+ */
	1870	+ private static function is_path_list( $trail ) {
	1871	+ $parts = explode( '.', (string) $trail, 2 );
	1872	+ $paths = self::path_list_keys();
	1873	+
	1874	+ return 2 === count( $parts ) && isset( $paths[ $parts[0] ] ) && in_array( $parts[1], $paths[ $parts[0] ], true );
	1875	+ }
	1876	+
	1877	+ /**
1255	1878	* Validate options before saving
1256	1879	*
1257	1880	* @param array $input Raw input to validate.
1258	1881	* @return array Validated options.
		@@ -1275,9 +1898,9 @@
1275	1898	: false;
1276	1899	}
1277	1900	} elseif ( isset( $defaults[ $section ] ) ) {
1278	1901	// Validate other sections using generic validator
1279		- $validated[ $section ] = $this->validate_section( $data, $defaults[ $section ] );
	1902	+ $validated[ $section ] = $this->validate_section( $data, $defaults[ $section ], $section );
1280	1903
1281	1904	// The few keys that live outside get_default_options() on
1282	1905	// purpose (see apply_install_tweaks()) survive with their own
1283	1906	// validation, or an import would silently lose them and the
		@@ -1294,8 +1917,28 @@
1294	1917	}
1295	1918	}
1296	1919	}
1297	1920
	1921	+ /*
	1922	+ * The lock on the settings the shared files are built from is NOT applied
	1923	+ * here, and that is a decision, not an oversight. The second cross review
	1924	+ * of 2.11.10 raised that register_setting( 'vigilante_options', ... )
	1925	+ * declares this as its sanitize callback with no lock in it, so anything
	1926	+ * reaching options.php with that option group would write the whole
	1927	+ * option. The chain does not close: the plugin prints no settings_fields()
	1928	+ * for that group anywhere, so the nonce it would need is not obtainable,
	1929	+ * and the five places that do save (saving a tab, importing, a preset,
	1930	+ * restoring the defaults, resetting a section) all apply
	1931	+ * keep_locked_file_settings() themselves.
	1932	+ *
	1933	+ * Putting it here instead would be worse than the door it closes. A
	1934	+ * register_setting() callback runs on EVERY update_option() of this
	1935	+ * option, so it would also lock the writes with no user behind them: the
	1936	+ * expiry of Under Attack restoring what it hardened, WP-CLI and cron.
	1937	+ * Those are already covered by matriz-red-ajustes-compartidos.sh, which
	1938	+ * is where such a change would show up as a row that stopped passing.
	1939	+ */
	1940	+
1298	1941	return apply_filters( 'vigilante_validate_options', $validated, $input );
1299	1942	}
1300	1943
1301	1944	/**
		@@ -1350,13 +1993,14 @@
1350	1993	* could merge any key it liked into vigilante_options (S7 of the 28 Aug
1351	1994	* 2026 audit). Lists are the exception, handled first: their entries are
1352	1995	* data, not keys.
1353	1996	*
1354		- * @param array $input Input values.
1355		- * @param array $defaults Default values.
	1997	+ * @param array $input Input values.
	1998	+ * @param array $defaults Default values.
	1999	+ * @param string $trail Where this is in the options, as section.key, so a list of paths is read as paths.
1356	2000	* @return array Validated values.
1357	2001	*/
1358		- private function validate_section( $input, $defaults ) {
	2002	+ private function validate_section( $input, $defaults, $trail = '' ) {
1359	2003	$validated = array();
1360	2004
1361	2005	if ( $this->is_list_default( $defaults ) ) {
1362	2006	if ( ! is_array( $input ) ) {
		@@ -1362,12 +2006,13 @@
1362	2006	if ( ! is_array( $input ) ) {
1363	2007	return array();
1364	2008	}
1365	2009
1366		- $list = array();
	2010	+ $is_paths = self::is_path_list( $trail );
	2011	+ $list = array();
1367	2012	foreach ( $input as $value ) {
1368	2013	if ( is_scalar( $value ) ) {
1369		- $list[] = sanitize_text_field( (string) $value );
	2014	+ $list[] = $is_paths ? self::sanitize_path_line( $value ) : sanitize_text_field( (string) $value );
1370	2015	} elseif ( is_array( $value ) ) {
1371	2016	$list[] = map_deep( $value, 'sanitize_text_field' );
1372	2017	}
1373	2018	}
		@@ -1388,9 +2033,9 @@
1388	2033	} elseif ( is_int( $default_value ) ) {
1389	2034	$validated[ $key ] = intval( $value );
1390	2035	} elseif ( is_array( $default_value ) ) {
1391	2036	if ( is_array( $value ) ) {
1392		- $validated[ $key ] = $this->validate_section( $value, $default_value );
	2037	+ $validated[ $key ] = $this->validate_section( $value, $default_value, '' === $trail ? (string) $key : $trail . '.' . $key );
1393	2038	} else {
1394	2039	$validated[ $key ] = $default_value;
1395	2040	}
1396	2041	} else {