← All changes | includes/class-settings.php +253 -11 3.0.0 → 3.0.2 View file →

		@@ -558,8 +558,34 @@
558	558
559	559	/**
560	560	* Deep merge arrays
561	561	*
	562	+ * Associative arrays are merged key by key, because that is what lets a
	563	+ * saved option keep working when a release adds a setting. Lists are
	564	+ * replaced whole, and that part is not cosmetic: merging a list key by key
	565	+ * means index by index, so a stored list shorter than the default came back
	566	+ * with the default's tail glued to it. Saving "administrator" alone into
	567	+ * enforced_roles (default administrator, editor) was read back as
	568	+ * administrator, editor, and unchecking every role was read back as the two
	569	+ * defaults, so three role pickers could not be narrowed at all. It is the
	570	+ * same bug merge_preset() was given its own merge for in 2.9.8; the fix
	571	+ * never reached this one or the one in the admin save.
	572	+ *
	573	+ * An empty saved list therefore means empty, not "fall back to the default".
	574	+ * That is the honest reading of what was saved, and the save path is what
	575	+ * makes sure a list only becomes empty when somebody emptied it: a list the
	576	+ * form did not carry is left alone rather than blanked.
	577	+ *
	578	+ * Which of the two happens is decided by the DEFAULT, never by what was
	579	+ * saved. Deciding by what was saved looks equivalent and is not: an empty
	580	+ * array is a list by any definition, so a section stored as array() would
	581	+ * have replaced a whole group of settings instead of merging into it, and
	582	+ * every key of that group would have come back missing. Found by the third
	583	+ * cross review of this release, measured on rest_api_security (7 keys to 0)
	584	+ * and on registration_approval (4 to 0, including its enabled flag).
	585	+ *
	586	+ * @since 3.0.1 Lists replace instead of merging index by index.
	587	+ *
562	588	* @param array $defaults Default values.
563	589	* @param array $saved Saved values.
564	590	* @return array Merged array.
565	591	*/
		@@ -564,17 +590,17 @@
564	590	* @return array Merged array.
565	591	*/
566	592	private function array_merge_deep( $defaults, $saved ) {
567	593	$result = $defaults;
568		-
	594	+
569	595	foreach ( $saved as $key => $value ) {
570		- if ( is_array( $value ) && isset( $result[ $key ] ) && is_array( $result[ $key ] ) ) {
	596	+ if ( is_array( $value ) && isset( $result[ $key ] ) && is_array( $result[ $key ] ) && ! self::is_list( $result[ $key ] ) ) {
571	597	$result[ $key ] = $this->array_merge_deep( $result[ $key ], $value );
572	598	} else {
573	599	$result[ $key ] = $value;
574	600	}
575	601	}
576		-
	602	+
577	603	return $result;
578	604	}
579	605
580	606	/**
		@@ -1407,8 +1433,55 @@
1407	1433	return $base;
1408	1434	}
1409	1435
1410	1436	/**
	1437	+ * A stored list, or the shipped one when it arrives empty
	1438	+ *
	1439	+ * For the four lists that have NO field on any screen: the allowed HTTP
	1440	+ * methods, the insecure usernames, the public REST endpoints and the roles
	1441	+ * of registration approval. Nobody can empty those from the interface, so
	1442	+ * an empty one is a leftover, and every version up to 3.0.0 produced them:
	1443	+ * saving any tab wrote array() over every list of that section whose key the
	1444	+ * form did not carry, which for these four was always. Reading the settings
	1445	+ * hid it by merging the shipped values on top, and 3.0.1 stops doing that,
	1446	+ * because a stored empty list is what makes unticking every role work.
	1447	+ *
	1448	+ * The migration in vigilante.php removes those keys once. This is the line
	1449	+ * of defence for every other route, including Under Attack, which
	1450	+ * photographs the raw option when it is switched on and puts it back whole
	1451	+ * when it expires, after the migration has already marked itself done.
	1452	+ *
	1453	+ * It goes through every reader of those four lists, the ones that enforce
	1454	+ * and the ones that only report, because a screen that says "no insecure
	1455	+ * user" while the check is blocking them is its own kind of wrong. The
	1456	+ * shipped value is read from get_default_options() rather than written out
	1457	+ * again here: a second copy of a list drifts from the first.
	1458	+ *
	1459	+ * @since 3.0.1
	1460	+ *
	1461	+ * @param mixed $value Stored value, as the caller already has it.
	1462	+ * @param string[] $path Path of the setting in the options array.
	1463	+ * @return array
	1464	+ */
	1465	+ public static function list_or_shipped( $value, $path ) {
	1466	+ if ( is_array( $value ) && array() !== $value ) {
	1467	+ return $value;
	1468	+ }
	1469	+
	1470	+ $instance = new self();
	1471	+ $shipped = $instance->get_default_options();
	1472	+
	1473	+ foreach ( (array) $path as $key ) {
	1474	+ if ( ! is_array( $shipped ) || ! array_key_exists( $key, $shipped ) ) {
	1475	+ return array();
	1476	+ }
	1477	+ $shipped = $shipped[ $key ];
	1478	+ }
	1479	+
	1480	+ return is_array( $shipped ) ? $shipped : array();
	1481	+ }
	1482	+
	1483	+ /**
1411	1484	* Whether an array is a plain list (0..n-1 keys)
1412	1485	*
1413	1486	* array_is_list() is PHP 8.1 and this plugin supports 7.4.
1414	1487	*
		@@ -1413,12 +1486,16 @@
1413	1486	* array_is_list() is PHP 8.1 and this plugin supports 7.4.
1414	1487	*
1415	1488	* @since 2.9.8
1416	1489	*
	1490	+ * Public since 3.0.1 because the admin save path needs the same answer: the
	1491	+ * two places that used to merge lists index by index have to agree on what
	1492	+ * a list is, or they disagree on a different subset of the settings.
	1493	+ *
1417	1494	* @param array $value Array to inspect.
1418	1495	* @return bool
1419	1496	*/
1420		- private static function is_list( $value ) {
	1497	+ public static function is_list( $value ) {
1421	1498	if ( array() === $value ) {
1422	1499	return true;
1423	1500	}
1424	1501
		@@ -1634,8 +1711,171 @@
1634	1711	);
1635	1712	}
1636	1713
1637	1714	/**
	1715	+ * The settings that hold a list of file paths, by section
	1716	+ *
	1717	+ * A path is read by what it is. sanitize_text_field() deletes every %XX octet
	1718	+ * and, when it finds one, collapses repeated spaces, so an exclusion written
	1719	+ * for a folder called foto%20x was saved as fotox and excluded nothing: the
	1720	+ * scan compares what is stored with the paths it finds, one by one (measured
	1721	+ * on 1 oct 2026 against 3.0.1). Every other list in the options is a list of
	1722	+ * addresses, names or extensions, where nothing meaningful is lost, and keeps
	1723	+ * its reader.
	1724	+ *
	1725	+ * @since 3.0.2
	1726	+ *
	1727	+ * @return array<string,string[]>
	1728	+ */
	1729	+ public static function path_list_keys() {
	1730	+ return array(
	1731	+ 'file_integrity' => array( 'excluded_paths' ),
	1732	+ );
	1733	+ }
	1734	+
	1735	+ /**
	1736	+ * One path as it was typed: invalid UTF-8 out, the ends trimmed, and nothing
	1737	+ * else touched. Invalid UTF-8 has to go because the option would not be
	1738	+ * written with it.
	1739	+ *
	1740	+ * A line that has tags (or a stray <) is dropped whole, not cut. A path has
	1741	+ * none, and wp_strip_all_tags() would cut it at the < and leave a shorter path
	1742	+ * than the one written, which excludes more than anyone asked: a folder
	1743	+ * called a<b would exclude a. Until 3.0.1 the < was kept as an entity, which
	1744	+ * matched nothing, and dropping the line has the same effect.
	1745	+ *
	1746	+ * A line with a line break inside is dropped too. The textarea is read line by
	1747	+ * line, so only an element of a list can have one (an export edited by hand),
	1748	+ * and the next save of the tab would show it as two lines and store two paths:
	1749	+ * a, a line break and wp-content would end up excluding all of wp-content.
	1750	+ * 3.0.1 turned the break into a space, which matched nothing, and dropping the
	1751	+ * line has the same effect (fourth cross review, 1 oct 2026).
	1752	+ *
	1753	+ * @since 3.0.2
	1754	+ *
	1755	+ * @param mixed $line Entry.
	1756	+ * @return string
	1757	+ */
	1758	+ public static function sanitize_path_line( $line ) {
	1759	+ if ( ! is_scalar( $line ) ) {
	1760	+ return '';
	1761	+ }
	1762	+
	1763	+ $line = trim( wp_check_invalid_utf8( (string) $line, true ) );
	1764	+
	1765	+ if ( false !== strpbrk( $line, "\r\n" ) ) {
	1766	+ return '';
	1767	+ }
	1768	+
	1769	+ return wp_strip_all_tags( $line ) === $line ? $line : '';
	1770	+ }
	1771	+
	1772	+ /**
	1773	+ * The text of a textarea of paths, one per line, each line read as one path.
	1774	+ *
	1775	+ * Line by line, because a stray < in one line would take the lines after it
	1776	+ * with it if the whole text went through wp_strip_all_tags().
	1777	+ *
	1778	+ * @since 3.0.2
	1779	+ *
	1780	+ * @param mixed $text Text.
	1781	+ * @return string
	1782	+ */
	1783	+ public static function sanitize_path_text( $text ) {
	1784	+ $lines = preg_split( '/\r\n|\r|\n/', (string) $text );
	1785	+
	1786	+ return implode( "\n", array_map( array( __CLASS__, 'sanitize_path_line' ), (array) $lines ) );
	1787	+ }
	1788	+
	1789	+ /**
	1790	+ * Take the lists of paths out of a settings tree before the generic sanitizer reads it
	1791	+ *
	1792	+ * Known limits (fourth cross review, 1 oct 2026), none reachable from the
	1793	+ * settings screen and all on the side of watching more: process_section_data()
	1794	+ * reads the entries of a list posted as an array (excluded_paths[]=) with
	1795	+ * sanitize_text_field() and applies sanitize_key() to the keys, so a key
	1796	+ * written with another spelling is not found here, and a form posted as an
	1797	+ * array instead of a string goes through a generic sanitizer. In those three
	1798	+ * the %XX are lost, as they were in 3.0.1.
	1799	+ *
	1800	+ * @since 3.0.2
	1801	+ *
	1802	+ * @param mixed $data Settings tree: section => key => value.
	1803	+ * @return array Only the path lists that are present, in the same shape, each already read as paths.
	1804	+ */
	1805	+ public static function take_path_lists( $data ) {
	1806	+ $taken = array();
	1807	+
	1808	+ if ( ! is_array( $data ) ) {
	1809	+ return $taken;
	1810	+ }
	1811	+
	1812	+ foreach ( self::path_list_keys() as $section => $keys ) {
	1813	+ if ( ! isset( $data[ $section ] ) || ! is_array( $data[ $section ] ) ) {
	1814	+ continue;
	1815	+ }
	1816	+
	1817	+ foreach ( $keys as $key ) {
	1818	+ if ( ! isset( $data[ $section ][ $key ] ) ) {
	1819	+ continue;
	1820	+ }
	1821	+
	1822	+ $value = $data[ $section ][ $key ];
	1823	+
	1824	+ if ( is_array( $value ) ) {
	1825	+ $taken[ $section ][ $key ] = array_map( array( __CLASS__, 'sanitize_path_line' ), array_values( array_filter( $value, 'is_scalar' ) ) );
	1826	+ } elseif ( is_scalar( $value ) ) {
	1827	+ $taken[ $section ][ $key ] = self::sanitize_path_text( $value );
	1828	+ }
	1829	+ }
	1830	+ }
	1831	+
	1832	+ return $taken;
	1833	+ }
	1834	+
	1835	+ /**
	1836	+ * Put back the lists of paths take_path_lists() took out, over what the generic sanitizer left
	1837	+ *
	1838	+ * @since 3.0.2
	1839	+ *
	1840	+ * @param mixed $data Sanitized settings tree.
	1841	+ * @param array $taken What take_path_lists() returned for the same tree.
	1842	+ * @return mixed The tree, with the path lists as they were read.
	1843	+ */
	1844	+ public static function restore_path_lists( $data, $taken ) {
	1845	+ if ( ! is_array( $data ) ) {
	1846	+ return $data;
	1847	+ }
	1848	+
	1849	+ foreach ( $taken as $section => $values ) {
	1850	+ if ( ! isset( $data[ $section ] ) || ! is_array( $data[ $section ] ) ) {
	1851	+ continue;
	1852	+ }
	1853	+
	1854	+ foreach ( $values as $key => $value ) {
	1855	+ $data[ $section ][ $key ] = $value;
	1856	+ }
	1857	+ }
	1858	+
	1859	+ return $data;
	1860	+ }
	1861	+
	1862	+ /**
	1863	+ * Whether a position in the options, as section.key, is a list of paths
	1864	+ *
	1865	+ * @since 3.0.2
	1866	+ *
	1867	+ * @param string $trail Section and key joined by a dot.
	1868	+ * @return bool
	1869	+ */
	1870	+ private static function is_path_list( $trail ) {
	1871	+ $parts = explode( '.', (string) $trail, 2 );
	1872	+ $paths = self::path_list_keys();
	1873	+
	1874	+ return 2 === count( $parts ) && isset( $paths[ $parts[0] ] ) && in_array( $parts[1], $paths[ $parts[0] ], true );
	1875	+ }
	1876	+
	1877	+ /**
1638	1878	* Validate options before saving
1639	1879	*
1640	1880	* @param array $input Raw input to validate.
1641	1881	* @return array Validated options.
		@@ -1658,9 +1898,9 @@
1658	1898	: false;
1659	1899	}
1660	1900	} elseif ( isset( $defaults[ $section ] ) ) {
1661	1901	// Validate other sections using generic validator
1662		- $validated[ $section ] = $this->validate_section( $data, $defaults[ $section ] );
	1902	+ $validated[ $section ] = $this->validate_section( $data, $defaults[ $section ], $section );
1663	1903
1664	1904	// The few keys that live outside get_default_options() on
1665	1905	// purpose (see apply_install_tweaks()) survive with their own
1666	1906	// validation, or an import would silently lose them and the
		@@ -1753,13 +1993,14 @@
1753	1993	* could merge any key it liked into vigilante_options (S7 of the 28 Aug
1754	1994	* 2026 audit). Lists are the exception, handled first: their entries are
1755	1995	* data, not keys.
1756	1996	*
1757		- * @param array $input Input values.
1758		- * @param array $defaults Default values.
	1997	+ * @param array $input Input values.
	1998	+ * @param array $defaults Default values.
	1999	+ * @param string $trail Where this is in the options, as section.key, so a list of paths is read as paths.
1759	2000	* @return array Validated values.
1760	2001	*/
1761		- private function validate_section( $input, $defaults ) {
	2002	+ private function validate_section( $input, $defaults, $trail = '' ) {
1762	2003	$validated = array();
1763	2004
1764	2005	if ( $this->is_list_default( $defaults ) ) {
1765	2006	if ( ! is_array( $input ) ) {
		@@ -1765,12 +2006,13 @@
1765	2006	if ( ! is_array( $input ) ) {
1766	2007	return array();
1767	2008	}
1768	2009
1769		- $list = array();
	2010	+ $is_paths = self::is_path_list( $trail );
	2011	+ $list = array();
1770	2012	foreach ( $input as $value ) {
1771	2013	if ( is_scalar( $value ) ) {
1772		- $list[] = sanitize_text_field( (string) $value );
	2014	+ $list[] = $is_paths ? self::sanitize_path_line( $value ) : sanitize_text_field( (string) $value );
1773	2015	} elseif ( is_array( $value ) ) {
1774	2016	$list[] = map_deep( $value, 'sanitize_text_field' );
1775	2017	}
1776	2018	}
		@@ -1791,9 +2033,9 @@
1791	2033	} elseif ( is_int( $default_value ) ) {
1792	2034	$validated[ $key ] = intval( $value );
1793	2035	} elseif ( is_array( $default_value ) ) {
1794	2036	if ( is_array( $value ) ) {
1795		- $validated[ $key ] = $this->validate_section( $value, $default_value );
	2037	+ $validated[ $key ] = $this->validate_section( $value, $default_value, '' === $trail ? (string) $key : $trail . '.' . $key );
1796	2038	} else {
1797	2039	$validated[ $key ] = $default_value;
1798	2040	}
1799	2041	} else {