← All changes | includes/class-settings.php +178 -10 3.0.1 → 3.0.4 View file →

		@@ -437,11 +437,14 @@
437	437	'auto_scan' => true,
438	438	'scan_frequency' => 'daily',
439	439	'notify_level' => 'suspicious_only',
440	440	'instant_alert' => false,
441		- 'excluded_paths' => array(
442		- 'wp-content/cache',
443		- ),
	441	+ // Empty for a new installation. It used to start with
	442	+ // wp-content/cache, from when nothing in the scan looked in
	443	+ // that folder anyway; the scan now searches it for hidden
	444	+ // code. A site that has the entry saved keeps it: what is in
	445	+ // this list is the site's own, and an update does not edit it.
	446	+ 'excluded_paths' => array(),
444	447	'excluded_extensions' => array(
445	448	// Translations (regenerated per-locale, never in checksums).
446	449	'.po', '.mo', '.pot',
447	450	// Binary images (cosmetic, not executable; often rewritten by image-optimizer plugins).
		@@ -1711,8 +1714,171 @@
1711	1714	);
1712	1715	}
1713	1716
1714	1717	/**
	1718	+ * The settings that hold a list of file paths, by section
	1719	+ *
	1720	+ * A path is read by what it is. sanitize_text_field() deletes every %XX octet
	1721	+ * and, when it finds one, collapses repeated spaces, so an exclusion written
	1722	+ * for a folder called foto%20x was saved as fotox and excluded nothing: the
	1723	+ * scan compares what is stored with the paths it finds, one by one (measured
	1724	+ * on 1 oct 2026 against 3.0.1). Every other list in the options is a list of
	1725	+ * addresses, names or extensions, where nothing meaningful is lost, and keeps
	1726	+ * its reader.
	1727	+ *
	1728	+ * @since 3.0.2
	1729	+ *
	1730	+ * @return array<string,string[]>
	1731	+ */
	1732	+ public static function path_list_keys() {
	1733	+ return array(
	1734	+ 'file_integrity' => array( 'excluded_paths' ),
	1735	+ );
	1736	+ }
	1737	+
	1738	+ /**
	1739	+ * One path as it was typed: invalid UTF-8 out, the ends trimmed, and nothing
	1740	+ * else touched. Invalid UTF-8 has to go because the option would not be
	1741	+ * written with it.
	1742	+ *
	1743	+ * A line that has tags (or a stray <) is dropped whole, not cut. A path has
	1744	+ * none, and wp_strip_all_tags() would cut it at the < and leave a shorter path
	1745	+ * than the one written, which excludes more than anyone asked: a folder
	1746	+ * called a<b would exclude a. Until 3.0.1 the < was kept as an entity, which
	1747	+ * matched nothing, and dropping the line has the same effect.
	1748	+ *
	1749	+ * A line with a line break inside is dropped too. The textarea is read line by
	1750	+ * line, so only an element of a list can have one (an export edited by hand),
	1751	+ * and the next save of the tab would show it as two lines and store two paths:
	1752	+ * a, a line break and wp-content would end up excluding all of wp-content.
	1753	+ * 3.0.1 turned the break into a space, which matched nothing, and dropping the
	1754	+ * line has the same effect (fourth cross review, 1 oct 2026).
	1755	+ *
	1756	+ * @since 3.0.2
	1757	+ *
	1758	+ * @param mixed $line Entry.
	1759	+ * @return string
	1760	+ */
	1761	+ public static function sanitize_path_line( $line ) {
	1762	+ if ( ! is_scalar( $line ) ) {
	1763	+ return '';
	1764	+ }
	1765	+
	1766	+ $line = trim( wp_check_invalid_utf8( (string) $line, true ) );
	1767	+
	1768	+ if ( false !== strpbrk( $line, "\r\n" ) ) {
	1769	+ return '';
	1770	+ }
	1771	+
	1772	+ return wp_strip_all_tags( $line ) === $line ? $line : '';
	1773	+ }
	1774	+
	1775	+ /**
	1776	+ * The text of a textarea of paths, one per line, each line read as one path.
	1777	+ *
	1778	+ * Line by line, because a stray < in one line would take the lines after it
	1779	+ * with it if the whole text went through wp_strip_all_tags().
	1780	+ *
	1781	+ * @since 3.0.2
	1782	+ *
	1783	+ * @param mixed $text Text.
	1784	+ * @return string
	1785	+ */
	1786	+ public static function sanitize_path_text( $text ) {
	1787	+ $lines = preg_split( '/\r\n|\r|\n/', (string) $text );
	1788	+
	1789	+ return implode( "\n", array_map( array( __CLASS__, 'sanitize_path_line' ), (array) $lines ) );
	1790	+ }
	1791	+
	1792	+ /**
	1793	+ * Take the lists of paths out of a settings tree before the generic sanitizer reads it
	1794	+ *
	1795	+ * Known limits (fourth cross review, 1 oct 2026), none reachable from the
	1796	+ * settings screen and all on the side of watching more: process_section_data()
	1797	+ * reads the entries of a list posted as an array (excluded_paths[]=) with
	1798	+ * sanitize_text_field() and applies sanitize_key() to the keys, so a key
	1799	+ * written with another spelling is not found here, and a form posted as an
	1800	+ * array instead of a string goes through a generic sanitizer. In those three
	1801	+ * the %XX are lost, as they were in 3.0.1.
	1802	+ *
	1803	+ * @since 3.0.2
	1804	+ *
	1805	+ * @param mixed $data Settings tree: section => key => value.
	1806	+ * @return array Only the path lists that are present, in the same shape, each already read as paths.
	1807	+ */
	1808	+ public static function take_path_lists( $data ) {
	1809	+ $taken = array();
	1810	+
	1811	+ if ( ! is_array( $data ) ) {
	1812	+ return $taken;
	1813	+ }
	1814	+
	1815	+ foreach ( self::path_list_keys() as $section => $keys ) {
	1816	+ if ( ! isset( $data[ $section ] ) || ! is_array( $data[ $section ] ) ) {
	1817	+ continue;
	1818	+ }
	1819	+
	1820	+ foreach ( $keys as $key ) {
	1821	+ if ( ! isset( $data[ $section ][ $key ] ) ) {
	1822	+ continue;
	1823	+ }
	1824	+
	1825	+ $value = $data[ $section ][ $key ];
	1826	+
	1827	+ if ( is_array( $value ) ) {
	1828	+ $taken[ $section ][ $key ] = array_map( array( __CLASS__, 'sanitize_path_line' ), array_values( array_filter( $value, 'is_scalar' ) ) );
	1829	+ } elseif ( is_scalar( $value ) ) {
	1830	+ $taken[ $section ][ $key ] = self::sanitize_path_text( $value );
	1831	+ }
	1832	+ }
	1833	+ }
	1834	+
	1835	+ return $taken;
	1836	+ }
	1837	+
	1838	+ /**
	1839	+ * Put back the lists of paths take_path_lists() took out, over what the generic sanitizer left
	1840	+ *
	1841	+ * @since 3.0.2
	1842	+ *
	1843	+ * @param mixed $data Sanitized settings tree.
	1844	+ * @param array $taken What take_path_lists() returned for the same tree.
	1845	+ * @return mixed The tree, with the path lists as they were read.
	1846	+ */
	1847	+ public static function restore_path_lists( $data, $taken ) {
	1848	+ if ( ! is_array( $data ) ) {
	1849	+ return $data;
	1850	+ }
	1851	+
	1852	+ foreach ( $taken as $section => $values ) {
	1853	+ if ( ! isset( $data[ $section ] ) || ! is_array( $data[ $section ] ) ) {
	1854	+ continue;
	1855	+ }
	1856	+
	1857	+ foreach ( $values as $key => $value ) {
	1858	+ $data[ $section ][ $key ] = $value;
	1859	+ }
	1860	+ }
	1861	+
	1862	+ return $data;
	1863	+ }
	1864	+
	1865	+ /**
	1866	+ * Whether a position in the options, as section.key, is a list of paths
	1867	+ *
	1868	+ * @since 3.0.2
	1869	+ *
	1870	+ * @param string $trail Section and key joined by a dot.
	1871	+ * @return bool
	1872	+ */
	1873	+ private static function is_path_list( $trail ) {
	1874	+ $parts = explode( '.', (string) $trail, 2 );
	1875	+ $paths = self::path_list_keys();
	1876	+
	1877	+ return 2 === count( $parts ) && isset( $paths[ $parts[0] ] ) && in_array( $parts[1], $paths[ $parts[0] ], true );
	1878	+ }
	1879	+
	1880	+ /**
1715	1881	* Validate options before saving
1716	1882	*
1717	1883	* @param array $input Raw input to validate.
1718	1884	* @return array Validated options.
		@@ -1735,9 +1901,9 @@
1735	1901	: false;
1736	1902	}
1737	1903	} elseif ( isset( $defaults[ $section ] ) ) {
1738	1904	// Validate other sections using generic validator
1739		- $validated[ $section ] = $this->validate_section( $data, $defaults[ $section ] );
	1905	+ $validated[ $section ] = $this->validate_section( $data, $defaults[ $section ], $section );
1740	1906
1741	1907	// The few keys that live outside get_default_options() on
1742	1908	// purpose (see apply_install_tweaks()) survive with their own
1743	1909	// validation, or an import would silently lose them and the
		@@ -1830,13 +1996,14 @@
1830	1996	* could merge any key it liked into vigilante_options (S7 of the 28 Aug
1831	1997	* 2026 audit). Lists are the exception, handled first: their entries are
1832	1998	* data, not keys.
1833	1999	*
1834		- * @param array $input Input values.
1835		- * @param array $defaults Default values.
	2000	+ * @param array $input Input values.
	2001	+ * @param array $defaults Default values.
	2002	+ * @param string $trail Where this is in the options, as section.key, so a list of paths is read as paths.
1836	2003	* @return array Validated values.
1837	2004	*/
1838		- private function validate_section( $input, $defaults ) {
	2005	+ private function validate_section( $input, $defaults, $trail = '' ) {
1839	2006	$validated = array();
1840	2007
1841	2008	if ( $this->is_list_default( $defaults ) ) {
1842	2009	if ( ! is_array( $input ) ) {
		@@ -1842,12 +2009,13 @@
1842	2009	if ( ! is_array( $input ) ) {
1843	2010	return array();
1844	2011	}
1845	2012
1846		- $list = array();
	2013	+ $is_paths = self::is_path_list( $trail );
	2014	+ $list = array();
1847	2015	foreach ( $input as $value ) {
1848	2016	if ( is_scalar( $value ) ) {
1849		- $list[] = sanitize_text_field( (string) $value );
	2017	+ $list[] = $is_paths ? self::sanitize_path_line( $value ) : sanitize_text_field( (string) $value );
1850	2018	} elseif ( is_array( $value ) ) {
1851	2019	$list[] = map_deep( $value, 'sanitize_text_field' );
1852	2020	}
1853	2021	}
		@@ -1868,9 +2036,9 @@
1868	2036	} elseif ( is_int( $default_value ) ) {
1869	2037	$validated[ $key ] = intval( $value );
1870	2038	} elseif ( is_array( $default_value ) ) {
1871	2039	if ( is_array( $value ) ) {
1872		- $validated[ $key ] = $this->validate_section( $value, $default_value );
	2040	+ $validated[ $key ] = $this->validate_section( $value, $default_value, '' === $trail ? (string) $key : $trail . '.' . $key );
1873	2041	} else {
1874	2042	$validated[ $key ] = $default_value;
1875	2043	}
1876	2044	} else {