PluginProbe
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN / 1.2.0
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN v1.2.0
1.3.2 1.3.1 1.3.0 1.2.4 trunk 1.0.0 1.0.1 1.0.2 1.0.3 1.0.4 1.0.5 1.0.6 1.0.7 1.0.8 1.0.9 1.1.0 1.1.1 1.1.2 1.1.3 1.1.4 1.1.5 1.1.6 1.1.7 1.1.8 1.2.0 All 28 releases
xspeed / includes / class-migration.php

class-migration.php in xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN 1.2.0, at includes/class-migration.php

1,470 lines 60.6 KB
No matching file
Up and down to move Enter to open Esc to close
Raw Download Zip
1 <?php
2 /**
3 * Migration — read settings from other popular caching plugins and
4 * translate them into xSpeed equivalents.
5 *
6 * Each source plugin has its own importer that returns a single
7 * normalized patch shape:
8 *
9 * array<string,array> // module-slug → settings patch
10 *
11 * which feeds straight into update_option('xspeed_module_<slug>')
12 * via the same write path the Recommendations module uses.
13 *
14 * Importers are pure: detect() reads the options table, returns
15 * what it found (or null if the source plugin's options aren't
16 * present). plan() turns that raw read into the patch. apply()
17 * writes it. preview() returns plan() without writing — used by
18 * the React panel for the "what would import" diff view.
19 *
20 * Adding a new source = adding a private detect_*() + plan_*()
21 * pair, then wiring them in `sources()`.
22 *
23 * @package XSpeed
24 */
25
26 declare(strict_types=1);
27
28 namespace XSpeed;
29
30 defined( 'ABSPATH' ) || exit;
31
32 final class Migration {
33
34 /**
35 * Public list of source plugins with metadata for the UI:
36 * [ id => [ label, detect_cb, plan_cb ] ]
37 */
38 public static function sources(): array {
39 return array(
40 'wp-rocket' => array(
41 'label' => 'WP Rocket',
42 'detect' => array( __CLASS__, 'detect_wp_rocket' ),
43 'plan' => array( __CLASS__, 'plan_wp_rocket' ),
44 ),
45 'w3-total-cache' => array(
46 'label' => 'W3 Total Cache',
47 'detect' => array( __CLASS__, 'detect_w3tc' ),
48 'plan' => array( __CLASS__, 'plan_w3tc' ),
49 ),
50 'wp-super-cache' => array(
51 'label' => 'WP Super Cache',
52 'detect' => array( __CLASS__, 'detect_wpsc' ),
53 'plan' => array( __CLASS__, 'plan_wpsc' ),
54 ),
55 'litespeed-cache' => array(
56 'label' => 'LiteSpeed Cache',
57 'detect' => array( __CLASS__, 'detect_litespeed' ),
58 'plan' => array( __CLASS__, 'plan_litespeed' ),
59 ),
60 );
61 }
62
63 /** Site option holding the list of source ids already imported. */
64 private const IMPORTED_OPTION = 'xspeed_migration_imported';
65
66 /**
67 * Source id → plugin file. The ONE home for this map.
68 *
69 * Public because MigrationModule needs the same mapping to deactivate a
70 * source, and it used to keep a private copy. The two were identical, but
71 * a drift would have been silent and destructive: this map drives the
72 * `active` flag that decides whether the panel shows its confirmation, and
73 * the module's copy drove the actual deactivation. Diverge them and
74 * status() reports active:false, the panel skips the confirm, and the
75 * plugin is deactivated anyway — a genuinely silent deactivation, one edit
76 * away. (#189)
77 */
78 public const PLUGIN_FILE = array(
79 'wp-rocket' => 'wp-rocket/wp-rocket.php',
80 'w3-total-cache' => 'w3-total-cache/w3-total-cache.php',
81 'wp-super-cache' => 'wp-super-cache/wp-cache.php',
82 'litespeed-cache' => 'litespeed-cache/litespeed-cache.php',
83 );
84
85 /** The plugin file for a source id, or '' when the id is unknown. */
86 public static function plugin_file( string $source ): string {
87 return self::PLUGIN_FILE[ $source ] ?? '';
88 }
89
90 /**
91 * Site option recording a source that was imported but LEFT RUNNING.
92 *
93 * Holds `{ id, label }` for the last such import, or is absent. Not a
94 * history — the risk is "a second page cache is live right now", which is
95 * a single present-tense fact, not a log. (#189 AC4)
96 */
97 private const ACTIVE_SOURCE_OPTION = 'xspeed_migration_source_active';
98
99 /**
100 * Remember that an import finished with the source plugin still on, so the
101 * warning can outlive the import screen.
102 *
103 * Self-clearing rather than sticky: it stores only while the plugin is
104 * genuinely still active, and drops the record as soon as it is not. A
105 * user who deactivates the old plugin by hand from the Plugins screen
106 * never told us — so a stored flag we only cleared on OUR own deactivation
107 * path would nag forever about a plugin that is already off.
108 *
109 * @param string $source Source id.
110 * @param string $label Human label for the source.
111 */
112 public static function remember_active_source( string $source, string $label ): void {
113 $file = self::plugin_file( $source );
114 if ( '' === $file ) {
115 return;
116 }
117
118 require_once ABSPATH . 'wp-admin/includes/plugin.php';
119 if ( ! is_plugin_active( $file ) ) {
120 self::forget_active_source( $source );
121 return;
122 }
123
124 update_option(
125 self::ACTIVE_SOURCE_OPTION,
126 array(
127 'id' => $source,
128 'label' => '' !== $label ? $label : $source,
129 )
130 );
131 }
132
133 /** Drop the record — the source is off, or was never on. */
134 public static function forget_active_source( string $source = '' ): void {
135 if ( '' !== $source ) {
136 $stored = get_option( self::ACTIVE_SOURCE_OPTION, array() );
137 if ( is_array( $stored ) && ( $stored['id'] ?? '' ) !== $source ) {
138 return;
139 }
140 }
141 delete_option( self::ACTIVE_SOURCE_OPTION );
142 }
143
144 /**
145 * The imported-but-still-running source, or null.
146 *
147 * Re-checks the plugin's live state on every read, so the warning
148 * disappears by itself the moment the user deactivates the plugin —
149 * whether they did it through us or from the Plugins screen.
150 *
151 * @return array{id:string,label:string}|null
152 */
153 public static function pending_source(): ?array {
154 $stored = get_option( self::ACTIVE_SOURCE_OPTION, array() );
155 if ( ! is_array( $stored ) || empty( $stored['id'] ) ) {
156 return null;
157 }
158
159 $file = self::plugin_file( (string) $stored['id'] );
160 if ( '' === $file ) {
161 return null;
162 }
163
164 require_once ABSPATH . 'wp-admin/includes/plugin.php';
165 if ( ! is_plugin_active( $file ) ) {
166 // Resolved itself — stop warning, and stop re-checking.
167 delete_option( self::ACTIVE_SOURCE_OPTION );
168 return null;
169 }
170
171 return array(
172 'id' => (string) $stored['id'],
173 'label' => (string) ( $stored['label'] ?? $stored['id'] ),
174 );
175 }
176
177 /** Record a source as imported (idempotent). */
178 public static function mark_imported( string $id ): void {
179 $done = (array) get_option( self::IMPORTED_OPTION, array() );
180 if ( ! in_array( $id, $done, true ) ) {
181 $done[] = $id;
182 update_option( self::IMPORTED_OPTION, array_values( $done ) );
183 }
184 }
185
186 /**
187 * For each source, return { id, label, detected, value_count, mapped_count,
188 * imported, active }.
189 * - `detected` true when the source plugin's settings are present.
190 * - `value_count` raw number of keys in the source's own config — NOT
191 * how many we import; kept for diagnostics only.
192 * - `mapped_count` how many settings the importer ACTUALLY writes into
193 * xSpeed (the honest number to show users).
194 * - `imported` true once this source has been imported (so the panel
195 * shows it as done, not as a fresh Import target).
196 * - `active` whether the source plugin is still active.
197 */
198 public static function status(): array {
199 $imported = (array) get_option( self::IMPORTED_OPTION, array() );
200 if ( ! function_exists( 'is_plugin_active' ) ) {
201 require_once ABSPATH . 'wp-admin/includes/plugin.php';
202 }
203 $out = array();
204 foreach ( self::sources() as $id => $spec ) {
205 $raw = call_user_func( $spec['detect'] );
206 $detected = is_array( $raw );
207 $mapped = 0;
208 if ( $detected ) {
209 $patch = call_user_func( $spec['plan'], $raw );
210 if ( is_array( $patch ) ) {
211 $mapped = self::count_meaningful( $patch );
212 }
213 }
214 $file = self::PLUGIN_FILE[ $id ] ?? '';
215 $out[] = array(
216 'id' => $id,
217 'label' => $spec['label'],
218 'detected' => $detected,
219 'value_count' => $detected ? count( $raw ) : 0,
220 'mapped_count' => $mapped,
221 'imported' => in_array( $id, $imported, true ),
222 'active' => '' !== $file && is_plugin_active( $file ),
223 );
224 }
225 return $out;
226 }
227
228 /**
229 * Count the settings in a plan patch that will MEANINGFULLY change the
230 * config — i.e. the ones actually enabled / non-empty in the source.
231 *
232 * A `plan_*` patch always emits every mapped field, including the ones the
233 * source has turned OFF (`false`) or left empty. Counting those inflated
234 * the "settings available to migrate" number — a source with 2 settings on
235 * still reported ~12 because the importer listed every false mapping.
236 * Disabled (`false`) booleans and empty arrays/strings/zeros contribute
237 * nothing on import, so they're excluded from the count. (FBS-82449)
238 *
239 * @param array<string,mixed> $patch Plan patch (module slug => values).
240 * @return int Number of enabled / non-empty settings.
241 */
242 private static function count_meaningful( array $patch ): int {
243 $count = 0;
244 foreach ( $patch as $vals ) {
245 if ( is_array( $vals ) ) {
246 $count += count( self::meaningful_values( $vals ) );
247 }
248 }
249 return $count;
250 }
251
252 /**
253 * Filter one module's plan values down to the ones that meaningfully change
254 * the config: enabled (`true`) booleans, non-empty arrays, and non-empty
255 * scalars. Disabled toggles, empty lists, and zero/empty scalars are
256 * dropped — they represent "nothing to import" for that setting. Shared by
257 * the count (status) and the write (apply) so both agree. (FBS-82449)
258 *
259 * @param array<string,mixed> $values One module's mapped values.
260 * @return array<string,mixed> Only the meaningful entries.
261 */
262 private static function meaningful_values( array $values ): array {
263 $out = array();
264 foreach ( $values as $key => $value ) {
265 if ( is_bool( $value ) ) {
266 if ( $value ) {
267 $out[ $key ] = $value; // Only an enabled toggle imports.
268 }
269 } elseif ( is_array( $value ) ) {
270 if ( ! empty( $value ) ) {
271 $out[ $key ] = $value; // Non-empty list (e.g. excluded_urls).
272 }
273 } elseif ( '' !== $value && null !== $value && 0 !== $value && '0' !== $value ) {
274 $out[ $key ] = $value; // Non-empty scalar (e.g. cache_expiry).
275 }
276 // NOTE: a scalar 0 is deliberately dropped — for the numeric
277 // settings we import (cache_expiry, timeouts, db index) it means
278 // "unset" in every source, and emitting it would put a
279 // meaningless value in the plan the user is asked to confirm.
280 // The trap: this also swallows a legitimate 0 from a TRI-STATE
281 // key. WP Super Cache's `wp_cache_not_logged_in` is 0/1/2, where
282 // 0 means "cache everyone" — a real choice. read_wpsc_config_file()
283 // already preserves it as an int, but any future mapping of that
284 // key must bypass this helper or the user's choice is discarded
285 // silently. (#222 F4)
286 }
287 return $out;
288 }
289
290 /**
291 * Convert a source plugin's seconds-based lifetime to xSpeed's
292 * hour-granular `cache_expiry`, rounding to nearest within our 1–720
293 * bounds. See the call site for why flooring was wrong. (#218)
294 */
295 private static function seconds_to_hours( int $seconds ): int {
296 if ( $seconds <= 0 ) {
297 return 24;
298 }
299 return (int) max( 1, min( 720, (int) round( $seconds / 3600 ) ) );
300 }
301
302 /**
303 * Map a source plugin's preload interval (seconds) onto xSpeed's
304 * schedule enum. Anything under a day rounds to `hourly` — our finest
305 * grain — rather than being dropped for not matching exactly. (#218)
306 */
307 private static function seconds_to_schedule( int $seconds ): string {
308 if ( $seconds <= 0 ) {
309 return 'manual';
310 }
311 // Literal seconds rather than WEEK_IN_SECONDS / DAY_IN_SECONDS: this
312 // planner is a pure function and is unit-tested without a WP bootstrap.
313 if ( $seconds >= 604800 ) {
314 return 'weekly';
315 }
316 if ( $seconds >= 86400 ) {
317 return 'daily';
318 }
319 return 'hourly';
320 }
321
322 /**
323 * Human-readable notes about values this import cannot carry across
324 * exactly, for the preview panel. Empty when everything maps cleanly.
325 *
326 * A silent lossy conversion is the thing the user cannot audit: a
327 * 15-minute page-cache lifetime arriving as 1 hour looks deliberate.
328 * (#218)
329 *
330 * @param string $source_id Source plugin id.
331 * @param array $raw Source plugin's own config.
332 * @return string[] One note per lossy conversion.
333 */
334 public static function preview_notes( string $source_id, array $raw ): array {
335 $notes = array();
336
337 if ( 'w3-total-cache' === $source_id && isset( $raw['pgcache.lifetime'] ) ) {
338 $seconds = (int) $raw['pgcache.lifetime'];
339 $hours = self::seconds_to_hours( $seconds );
340 if ( $seconds > 0 && $seconds !== $hours * 3600 ) {
341 $notes[] = sprintf(
342 /* translators: 1: source lifetime in seconds, 2: imported lifetime in hours. */
343 __( 'Page cache lifetime %1$ds cannot be expressed in whole hours — importing as %2$dh.', 'xspeed' ),
344 $seconds,
345 $hours
346 );
347 }
348 }
349
350 // A value we deliberately DROP needs saying too. Rounding a lifetime
351 // was announced while a skipped secret was not, and skipping is the
352 // more consequential of the two: the object cache silently fails to
353 // connect afterwards and nothing on screen explains why. Only fires
354 // when the source really has a secret we cannot read — an empty
355 // password is not a loss. (#218 F3)
356 if ( 'w3-total-cache' === $source_id ) {
357 foreach ( array(
358 'objectcache.redis.password' => __( 'Redis password', 'xspeed' ),
359 'dbcache.redis.password' => __( 'Database-cache Redis password', 'xspeed' ),
360 'pgcache.redis.password' => __( 'Page-cache Redis password', 'xspeed' ),
361 ) as $key => $label ) {
362 if ( empty( $raw[ $key ] ) || ! is_string( $raw[ $key ] ) ) {
363 continue;
364 }
365 if ( null !== self::decrypt_w3tc_secret( $raw[ $key ] ) ) {
366 continue; // readable — it will be imported.
367 }
368 $notes[] = sprintf(
369 /* translators: %s: human label for the secret that could not be read. */
370 __( '%s is encrypted and could not be read — it will not be imported. Enter it again in xSpeed after importing.', 'xspeed' ),
371 $label
372 );
373 }
374 }
375
376
377 // A TLS endpoint imports its host and port, but NOT its transport:
378 // xSpeed has no TLS option in the object-cache schema and
379 // Redis_Client::connect() only ever builds "tcp://{$host}:{$port}".
380 // Keeping the scheme in the host made that failure silent AND
381 // unconditional — `tcp://tls://cache.internal:6380` fails to resolve
382 // the literal host "tls" — so the scheme is stripped and the loss is
383 // announced instead, the same way an unreadable secret is. The import
384 // then connects wherever plain TCP is also open, and says so where it
385 // cannot. (#224)
386 if ( 'w3-total-cache' === $source_id ) {
387 foreach ( array( 'redis', 'memcached' ) as $engine ) {
388 $servers = $raw[ 'objectcache.' . $engine . '.servers' ] ?? null;
389 if ( empty( $servers ) || ! is_array( $servers ) ) {
390 continue;
391 }
392 $first = (string) ( $servers[0] ?? '' );
393 if ( ! preg_match( '#^([a-z][a-z0-9+.-]*)://#i', $first, $m ) ) {
394 continue;
395 }
396 $notes[] = sprintf(
397 /* translators: 1: endpoint scheme, e.g. tls. 2: the endpoint as configured in the source plugin. */
398 __( 'Object-cache endpoint %2$s uses %1$s, which xSpeed does not support — importing the host and port only. The cache will connect only if the server also accepts a plain connection.', 'xspeed' ),
399 strtoupper( $m[1] ),
400 $first
401 );
402 }
403 }
404 return $notes;
405 }
406
407 /**
408 * Map a source plugin's "separate mobile cache" flag onto the cache patch
409 * WITHOUT enabling xSpeed's mobile_separate. The xSpeed static-file fast
410 * path is device-blind, so mobile_separate=ON disables it — and a source
411 * site that had the flag on very often serves identical HTML to every
412 * device (it was on by habit). Rather than silently kill the fast path on
413 * import, we keep mobile_separate off and, when the source had it on, set
414 * `mobile_separate_review` so the dashboard can prompt the user to turn it
415 * back on only if their site really differs per device.
416 * (FBS-83144 / FBS-83145)
417 *
418 * @param array $patch The plan patch (modified by reference).
419 * @param bool $source_on Whether the source plugin had mobile-separate on.
420 */
421 private static function map_mobile_separate( array &$patch, bool $source_on ): void {
422 if ( ! isset( $patch['cache'] ) || ! is_array( $patch['cache'] ) ) {
423 $patch['cache'] = array();
424 }
425 // Never import as ON; leave the fast path intact.
426 $patch['cache']['mobile_separate'] = false;
427 if ( $source_on ) {
428 $patch['cache']['mobile_separate_review'] = true;
429 }
430 }
431
432 /**
433 * Return the patch that `apply()` would write, without writing.
434 */
435 public static function preview( string $source_id ): ?array {
436 $full = self::preview_with_notes( $source_id );
437
438 return null === $full ? null : $full['patch'];
439 }
440
441 /**
442 * The preview plan together with the notes that explain it.
443 *
444 * preview_notes() exists to tell the user when a source value could not
445 * be carried over exactly — e.g. a 15-minute W3TC lifetime that xSpeed
446 * can only express in whole hours. It was written but never called, so
447 * the panel showed the rounded number as plain fact and the user had no
448 * way to know their setting had changed. Returning both from one detect
449 * pass keeps them in lockstep. (#224 F2)
450 *
451 * @param string $source_id Source plugin id.
452 * @return array{patch:array,notes:string[]}|null Null when undetected.
453 */
454 public static function preview_with_notes( string $source_id ): ?array {
455 $src = self::sources()[ $source_id ] ?? null;
456 if ( null === $src ) {
457 return null;
458 }
459 $raw = call_user_func( $src['detect'] );
460 if ( ! is_array( $raw ) ) {
461 return null;
462 }
463
464 return array(
465 'patch' => call_user_func( $src['plan'], $raw ),
466 'notes' => self::preview_notes( $source_id, $raw ),
467 );
468 }
469
470 /**
471 * Read source settings + write the translated patch. Returns the
472 * per-module write results, same shape as Recommendations::apply.
473 */
474 public static function apply( string $source_id ): array {
475 $patch = self::preview( $source_id );
476 if ( null === $patch ) {
477 return array();
478 }
479 $results = array();
480 foreach ( $patch as $slug => $values ) {
481 if ( ! is_string( $slug ) || ! is_array( $values ) ) {
482 continue;
483 }
484 // Import only the settings that are actually enabled / non-empty in
485 // the source. A plan patch emits every mapped field including the
486 // ones the source turned OFF; merging those `false`/empty values
487 // would silently DISABLE settings the user already had on in xSpeed.
488 // Migration is additive — it never clobbers existing config with a
489 // source's disabled value. (FBS-82449)
490 $meaningful = self::meaningful_values( $values );
491 if ( empty( $meaningful ) ) {
492 continue;
493 }
494
495 // The page-cache switch is NOT a module setting. It lives in the
496 // `xspeed_options` blob, and turning it on means installing the
497 // drop-in, setting WP_CACHE and installing the rewrite — work only
498 // Cache::toggle() does. Writing it to xspeed_module_cache['enabled']
499 // put it in a key that is not in CacheModule::settings_schema() and
500 // that nothing reads, so every importer's `cache.enabled` was a
501 // dead destination: the import reported success and the site came
502 // out of it with caching still off. (#219)
503 $applied_enable = null;
504 if ( 'cache' === $slug && array_key_exists( 'enabled', $meaningful ) ) {
505 $applied_enable = (bool) $meaningful['enabled'];
506 unset( $meaningful['enabled'] );
507 }
508
509 // Union list values with what is already in EFFECT rather than
510 // overwriting them.
511 //
512 // A source's exclusion list is what IT needed; ours covers cases it
513 // handled with separate settings we don't read (W3TC has
514 // pgcache.cache.feed, pgcache.reject.request_head, …). Assigning
515 // the mapped array straight over ours dropped every xSpeed-specific
516 // safety rule — /wp-json/, /xmlrpc.php, ~wp-.*\.php, /feed/ and
517 // ~sitemap(_index)?\.xml among them — and feeds and sitemaps
518 // started being served from the page cache.
519 //
520 // Merge against Settings_Manager::get(), not the raw option: module
521 // defaults live in the SCHEMA, so on a fresh install the stored
522 // option is empty and a union with it would still lose all of them.
523 // The class comment above already promised migration is additive;
524 // before this that only held for scalars. (#218)
525 $effective = (array) Settings_Manager::get( $slug );
526 foreach ( $meaningful as $key => $value ) {
527 if ( ! is_array( $value ) ) {
528 continue;
529 }
530 $existing = $effective[ $key ] ?? array();
531 if ( ! is_array( $existing ) || empty( $existing ) ) {
532 continue;
533 }
534 $meaningful[ $key ] = array_values( array_unique( array_merge( $existing, $value ) ) );
535 }
536
537 // Write through Settings_Manager::update(), not a raw
538 // update_option().
539 //
540 // The raw write skipped everything that makes a settings write
541 // safe: schema coercion, per-field range/type validation, secret
542 // encryption at rest, `_version` maintenance, and log_changes() —
543 // so imported values landed unvalidated and no per-module change
544 // ever reached the activity log, only the single "Imported
545 // settings from…" line. It also means a bad value from a source
546 // plugin could be stored where the UI could never have set it.
547 //
548 // update() returns the module's public view, which is also the
549 // honest success signal: it reflects what is actually stored,
550 // where update_option()'s return value conflates "no change
551 // needed" with "write failed". (#218)
552 $stored = Settings_Manager::update( $slug, $meaningful );
553
554 // Did the intent land? Not "is the stored value identical" — for a
555 // list we deliberately UNION with the existing rules, so the stored
556 // array is legitimately bigger than what we passed in. Assert each
557 // imported value is PRESENT instead, which is what "applied" means
558 // and what a lossy or rejected write would fail.
559 //
560 // Secrets come back masked in the public view, so they are taken on
561 // trust rather than compared against plaintext.
562 $ok = ! empty( $stored );
563 foreach ( $meaningful as $key => $value ) {
564 if ( ! array_key_exists( $key, $stored ) ) {
565 // A key the module deliberately owns elsewhere (cache.enabled
566 // lives in xspeed_options and is applied via Cache::toggle)
567 // is not a failed write.
568 continue;
569 }
570 if ( is_string( $stored[ $key ] ) && Settings_Manager::is_masked_secret( $stored[ $key ] ) ) {
571 continue;
572 }
573 if ( is_array( $value ) ) {
574 if ( array_diff( $value, (array) $stored[ $key ] ) ) {
575 $ok = false;
576 break;
577 }
578 continue;
579 }
580 if ( $stored[ $key ] != $value ) { // phpcs:ignore WordPress.PHP.StrictComparisons.LooseComparison -- values round-trip through the DB and schema coercion, so a stored "1" must still count as an applied true.
581 $ok = false;
582 break;
583 }
584 }
585
586 $applied = array_keys( $meaningful );
587
588 if ( null !== $applied_enable ) {
589 $state = Cache::toggle( $applied_enable );
590 Settings::update( array( 'cache_enabled' => $state['enabled'] ) );
591 $applied[] = 'enabled';
592 // Enabling is only real if the drop-in actually landed; a
593 // read-only wp-content would otherwise be reported as success.
594 if ( $applied_enable && empty( $state['dropin_installed'] ) ) {
595 $ok = false;
596 }
597 }
598
599 if ( empty( $applied ) ) {
600 continue;
601 }
602
603 $results[ $slug ] = array(
604 'ok' => $ok,
605 'applied' => $applied,
606 );
607
608 // Importing an object-cache backend has to actually turn it on.
609 //
610 // Writing `backend = redis` only records an intention: the drop-in
611 // is what makes WordPress use it. Migration never installed one,
612 // and on a LiteSpeed/W3TC source it also deactivates the source
613 // plugin, which REMOVES that plugin's drop-in — so a site with a
614 // working Redis object cache came out of a "successful" import with
615 // no persistent object cache at all, and nothing said so.
616 //
617 // Object_Cache::enable() tests the connection before writing
618 // anything, so an unreachable server degrades to a reported
619 // failure rather than a broken drop-in. (#218 / #217)
620 if ( 'object-cache' === $slug && $ok && ! empty( $meaningful['backend'] ) ) {
621 $results[ $slug ] = self::enable_object_cache( $results[ $slug ] );
622 }
623 }
624 if ( self::completed_successfully( $results ) ) {
625 self::mark_imported( $source_id );
626 }
627 return $results;
628 }
629
630 /**
631 * Whether an apply result represents a complete, retry-free import.
632 *
633 * A non-empty applied list proves only that a group was attempted. The
634 * source must stay actionable when any attempted group reports failure.
635 *
636 * @param array $results Per-module apply results.
637 */
638 public static function completed_successfully( array $results ): bool {
639 if ( empty( $results ) ) {
640 return false;
641 }
642
643 $applied = false;
644 foreach ( $results as $result ) {
645 if ( ! is_array( $result ) || empty( $result['ok'] ) ) {
646 return false;
647 }
648 if ( ! empty( $result['applied'] ) ) {
649 $applied = true;
650 }
651 }
652
653 return $applied;
654 }
655
656 /**
657 * Install the object-cache drop-in for a just-imported backend, and fold
658 * the outcome into that module's result row.
659 *
660 * A failure here is reported, never silent: the import has already told
661 * the user their object cache came across.
662 *
663 * @param array $result The module's result row so far.
664 * @return array The row, with ok/message reflecting the drop-in install.
665 */
666 private static function enable_object_cache( array $result ): array {
667 if ( ! class_exists( __NAMESPACE__ . '\\Object_Cache' ) ) {
668 return $result;
669 }
670
671 $opts = (array) Settings_Manager::get( 'object-cache' );
672 $state = Object_Cache::enable( $opts );
673
674 $result['ok'] = ! empty( $state['ok'] );
675 $result['object_cache_ready'] = ! empty( $state['ok'] );
676 if ( empty( $state['ok'] ) ) {
677 // Surfaced by the panel instead of a green "imported" message.
678 $result['message'] = (string) ( $state['message'] ?? 'Could not enable the object cache.' );
679 }
680
681 return $result;
682 }
683
684 // ─────────────────────────── WP Rocket ───────────────────────────
685
686 public static function detect_wp_rocket(): ?array {
687 $opt = get_option( 'wp_rocket_settings', null );
688 return is_array( $opt ) ? $opt : null;
689 }
690
691 /**
692 * Translate WP Rocket's `wp_rocket_settings` array into our module
693 * settings. Only safe-to-port booleans + counts; behaviorally
694 * different toggles (Critical CSS, RUCSS) skip — Pro handles those.
695 *
696 * @param array $r raw wp_rocket_settings.
697 */
698 public static function plan_wp_rocket( array $r ): array {
699 $patch = array();
700 // Page caching.
701 // WP Rocket has no master on/off switch — installing and activating it
702 // IS enabling page caching, so a detected settings blob means the
703 // source site was caching. `cache_logged_user` is NOT that switch: it
704 // controls whether LOGGED-IN users get cached pages. Reading it as the
705 // master meant the most ordinary WP Rocket configuration of all —
706 // caching on, but not for logged-in users (`cache_logged_user = 0`) —
707 // imported as caching OFF, the exact inverse of the user's intent. The
708 // `! isset` fallback then made a missing key mean ON, so the result was
709 // right only by accident. (#222 F2)
710 $patch['cache'] = array(
711 'enabled' => true,
712 // The Cache module's TTL setting is `cache_expiry` (hours), NOT
713 // `expiry_hours` — the latter is a dead key nothing reads, so the
714 // imported lifetime was silently dropped. Clamp to the same 1–720h
715 // range the Cache schema + LiteSpeed importer use. (FBS-83144)
716 'cache_expiry' => isset( $r['purge_cron_interval'] ) ? max( 1, min( 720, (int) ( (int) $r['purge_cron_interval'] / 3600 ) ) ) : 24,
717 );
718 // Excluded URLs / cookies — both are arrays of strings in WP Rocket.
719 if ( ! empty( $r['cache_reject_uri'] ) && is_array( $r['cache_reject_uri'] ) ) {
720 $patch['cache']['excluded_urls'] = array_values( array_filter( array_map( 'strval', $r['cache_reject_uri'] ) ) );
721 }
722 if ( ! empty( $r['cache_reject_cookies'] ) && is_array( $r['cache_reject_cookies'] ) ) {
723 $patch['cache']['excluded_cookies'] = array_values( array_filter( array_map( 'strval', $r['cache_reject_cookies'] ) ) );
724 }
725
726 // Minify.
727 $patch['minify'] = array(
728 'minify_html' => ! empty( $r['minify_html'] ),
729 'minify_css' => ! empty( $r['minify_css'] ),
730 'minify_js' => ! empty( $r['minify_js'] ),
731 'combine_css' => ! empty( $r['minify_concatenate_css'] ),
732 'combine_js' => ! empty( $r['minify_concatenate_js'] ),
733 'defer_js' => ! empty( $r['defer_all_js'] ),
734 );
735
736 // Lazy load.
737 $patch['lazy'] = array(
738 'lazy_images' => ! empty( $r['lazyload'] ),
739 'lazy_iframes' => ! empty( $r['lazyload_iframes'] ),
740 'lazy_videos' => ! empty( $r['lazyload_youtube'] ),
741 );
742
743 // Separate Mobile Cache — do NOT import this as ON. WP Rocket's
744 // "separate cache files for mobile" is frequently left on by habit even
745 // when the site serves identical HTML to every device, and xSpeed's
746 // static-file fast path is device-blind — enabling mobile_separate
747 // DISABLES it, silently dropping the site from HIT (nginx) to HIT (php).
748 // Instead, keep the fast path (mobile_separate stays false) and flag it
749 // for review so the dashboard can prompt the user to re-enable it only
750 // if their site really differs per device. (FBS-83144 / FBS-83145)
751 self::map_mobile_separate( $patch, ! empty( $r['do_caching_mobile_files'] ) );
752
753 // Preloader.
754 if ( ! empty( $r['manual_preload'] ) || ! empty( $r['sitemap_preload'] ) ) {
755 $patch['preloader'] = array(
756 'enabled' => true,
757 'schedule' => 'daily',
758 );
759 if ( ! empty( $r['sitemap_preload_url'] ) && is_array( $r['sitemap_preload_url'] ) ) {
760 $patch['preloader']['sitemap_urls'] = array_values( array_filter( array_map( 'strval', $r['sitemap_preload_url'] ) ) );
761 }
762 }
763
764 // CDN — WP Rocket stores CDN hosts in cdn_cnames (array).
765 if ( ! empty( $r['cdn'] ) && ! empty( $r['cdn_cnames'] ) && is_array( $r['cdn_cnames'] ) ) {
766 $first = (string) ( $r['cdn_cnames'][0] ?? '' );
767 if ( '' !== $first ) {
768 $patch['cdn'] = array(
769 'enabled' => true,
770 'cdn_url' => $first,
771 );
772 }
773 }
774
775 return $patch;
776 }
777
778 // ─────────────────────────── W3 Total Cache ──────────────────────
779
780 public static function detect_w3tc(): ?array {
781 // W3 Total Cache does NOT store its config in the options table — it
782 // writes a PHP file at wp-content/w3tc-config/master.php whose body
783 // is a short PHP guard followed by a JSON blob of dotted-key settings
784 // (pgcache.enabled, minify.html.enable, …). Reading w3tc_config /
785 // w3tc_master_settings options always returned null, so detection
786 // failed on every install. Read + parse the config file instead.
787 $cfg = self::read_w3tc_config_file();
788 if ( is_array( $cfg ) && ! empty( $cfg ) ) {
789 return $cfg;
790 }
791 // Defensive fallback for any build that did persist an options blob.
792 $opt = get_option( 'w3tc_config', null );
793 if ( ! is_array( $opt ) ) {
794 $opt = get_option( 'w3tc_master_settings', null );
795 }
796 return is_array( $opt ) ? $opt : null;
797 }
798
799 /**
800 * Parse W3TC's master config file into a flat dotted-key array.
801 * Format: a short PHP guard (a php-open, exit, php-close) immediately
802 * followed by a JSON object. We strip everything up to and including the
803 * PHP closing tag, then JSON-decode the remainder.
804 *
805 * @return array|null parsed config, or null if the file is missing/unreadable.
806 */
807 private static function read_w3tc_config_file(): ?array {
808 if ( ! defined( 'WP_CONTENT_DIR' ) ) {
809 return null;
810 }
811 $path = WP_CONTENT_DIR . '/w3tc-config/master.php';
812 if ( ! is_readable( $path ) ) {
813 return null;
814 }
815 $raw = file_get_contents( $path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- reading another plugin's local config file; WP_Filesystem is overkill for a one-shot read.
816 if ( false === $raw || '' === $raw ) {
817 return null;
818 }
819 // Drop the leading PHP guard and decode the JSON tail. The pattern
820 // matches up to the first PHP closing tag; built from a char-code so
821 // no literal close tag appears in this source file.
822 $close_tag = '?' . '>';
823 $json = preg_replace( '/^.*?' . preg_quote( $close_tag, '/' ) . '/s', '', $raw );
824 $cfg = json_decode( trim( (string) $json ), true );
825 return is_array( $cfg ) ? $cfg : null;
826 }
827
828 public static function plan_w3tc( array $r ): array {
829 $patch = array();
830 $patch['cache'] = array(
831 'enabled' => ! empty( $r['pgcache.enabled'] ),
832 // Cache module reads `cache_expiry` (hours), not the dead
833 // `expiry_hours` key — see plan_wp_rocket. (FBS-83144)
834 // W3TC stores this in SECONDS and sub-hour values are common (900 /
835 // 1800 are its own defaults). Integer division floored those to 0
836 // and max(1, …) then bumped them to a full hour, so a 5-minute
837 // lifetime silently became 12x longer. xSpeed's cache_expiry is
838 // hour-granular, so the closest honest answer is to round to
839 // nearest and keep the 1-hour floor for anything under 30 minutes.
840 // preview_notes() tells the user when the source value could not be
841 // represented exactly. (#218)
842 'cache_expiry' => isset( $r['pgcache.lifetime'] ) ? self::seconds_to_hours( (int) $r['pgcache.lifetime'] ) : 24,
843 );
844 $w3_list = static function ( $key ) use ( $r ): array {
845 $v = $r[ $key ] ?? null;
846 return is_array( $v ) ? array_values( array_filter( array_map( 'strval', $v ) ) ) : array();
847 };
848
849 foreach ( array(
850 'pgcache.reject.uri' => 'excluded_urls',
851 'pgcache.reject.cookie' => 'excluded_cookies',
852 'pgcache.reject.ua' => 'bypass_user_agents',
853 ) as $src => $dest ) {
854 $vals = $w3_list( $src );
855 if ( $vals ) {
856 $patch['cache'][ $dest ] = $vals;
857 }
858 }
859
860 // `pgcache.accept.qs` is deliberately NOT imported. W3TC ships ~100
861 // tracking parameters in it by default, so importing it wholesale
862 // would bury the user's own additions under a stock list — and
863 // apply() unions lists, which would make that permanent. Our own
864 // ignored_query_params default already covers the same ground.
865 // (#218)
866
867 self::map_mobile_separate( $patch, ! empty( $r['mobile.enabled'] ) );
868
869 // W3TC's minify "method" encodes BOTH operations in one value:
870 // 'minify' | 'combine' | 'both'. Combining is on for the latter two.
871 $method_combines = static function ( $key ) use ( $r ): bool {
872 $m = isset( $r[ $key ] ) ? (string) $r[ $key ] : '';
873 return 'combine' === $m || 'both' === $m;
874 };
875
876 // The master switch gates every child mapping.
877 //
878 // W3TC keeps its child defaults POPULATED while `minify.enabled` is
879 // off — `minify.css.enable`, `minify.js.enable` and the method fields
880 // all read as truthy on a site that has minification deliberately
881 // switched off. Reading the children alone therefore imported Minify
882 // CSS/JS and Combine CSS/JS as ON for a user who had turned the whole
883 // feature off, which can change front-end output and introduce the
884 // exact CSS/JS regressions migration is supposed to avoid.
885 //
886 // Every other W3TC block here already gates this way — pgcache on
887 // `pgcache.enabled`, lazy load on `lazyload.enabled`, browser cache on
888 // `browsercache.enabled`, object cache on `objectcache.enabled`.
889 // Minify was the one that did not. (#218)
890 $minify_on = ! empty( $r['minify.enabled'] );
891
892 $patch['minify'] = array(
893 'minify_html' => $minify_on && ! empty( $r['minify.html.enable'] ),
894 'minify_css' => $minify_on && ! empty( $r['minify.css.enable'] ),
895 'minify_js' => $minify_on && ! empty( $r['minify.js.enable'] ),
896 // There is no `minify.css.combine`; CSS combining lives in the
897 // method. JS splits its combine flag across three placements, and
898 // any one of them means the user wanted combining.
899 'combine_css' => $minify_on && $method_combines( 'minify.css.method' ),
900 'combine_js' => $minify_on && (
901 $method_combines( 'minify.js.method' )
902 || ! empty( $r['minify.js.combine.header'] )
903 || ! empty( $r['minify.js.combine.body'] )
904 || ! empty( $r['minify.js.combine.footer'] )
905 ),
906 );
907
908 // ── Lazy load ────────────────────────────────────────────────────
909 if ( ! empty( $r['lazyload.enabled'] ) ) {
910 $patch['lazy'] = array( 'lazy_images' => true );
911 $excluded = $w3_list( 'lazyload.exclude' );
912 if ( $excluded ) {
913 $patch['lazy']['excluded_images'] = $excluded;
914 }
915 }
916
917 // ── Browser cache + compression ──────────────────────────────────
918 if ( ! empty( $r['browsercache.enabled'] ) ) {
919 $patch['browser-cache'] = array( 'enabled' => true );
920 foreach ( array(
921 'browsercache.cssjs.lifetime' => 'asset_ttl',
922 'browsercache.html.lifetime' => 'html_ttl',
923 ) as $src => $dest ) {
924 if ( ! empty( $r[ $src ] ) ) {
925 $patch['browser-cache'][ $dest ] = (int) $r[ $src ];
926 }
927 }
928 // W3TC has a compression toggle per content type; xSpeed has one
929 // switch, so any of them being on means the user wanted GZIP.
930 if ( ! empty( $r['browsercache.html.compression'] ) || ! empty( $r['browsercache.cssjs.compression'] ) || ! empty( $r['browsercache.other.compression'] ) ) {
931 $patch['gzip'] = array( 'gzip_enabled' => true );
932 }
933 }
934
935 // ── Preloader (W3TC calls it "cache priming") ────────────────────
936 if ( ! empty( $r['pgcache.prime.enabled'] ) ) {
937 $patch['preloader'] = array( 'enabled' => true );
938 if ( ! empty( $r['pgcache.prime.sitemap'] ) ) {
939 $patch['preloader']['sitemap_url'] = (string) $r['pgcache.prime.sitemap'];
940 }
941 if ( ! empty( $r['pgcache.prime.interval'] ) ) {
942 $patch['preloader']['schedule'] = self::seconds_to_schedule( (int) $r['pgcache.prime.interval'] );
943 }
944 if ( ! empty( $r['pgcache.prime.post.update.enabled'] ) ) {
945 $patch['preloader']['warm_on_publish'] = true;
946 }
947 }
948
949 // ── Bloat ────────────────────────────────────────────────────────
950 if ( ! empty( $r['jquerymigrate.disabled'] ) ) {
951 $patch['bloat'] = array( 'strip_jquery_migrate' => true );
952 }
953
954 if ( ! empty( $r['objectcache.enabled'] ) && ! empty( $r['objectcache.engine'] ) ) {
955 $is_memcached = 'memcached' === $r['objectcache.engine'];
956 $engine = $is_memcached ? 'memcached' : 'redis';
957
958 $patch['object-cache'] = array( 'backend' => $engine );
959
960 // W3TC namespaces these by engine — `objectcache.redis.servers` /
961 // `objectcache.memcached.servers`. There is no bare
962 // `objectcache.servers`, so the host/port branch here could never
963 // run for a W3TC source: a site with Redis on a non-default host or
964 // port silently fell back to 127.0.0.1:6379. (#218)
965 $servers = $r[ 'objectcache.' . $engine . '.servers' ] ?? null;
966 if ( ! empty( $servers ) && is_array( $servers ) ) {
967 $first = (string) ( $servers[0] ?? '' );
968
969 // A scheme says HOW to connect, not WHERE. Left in place it
970 // becomes the hostname: Redis_Client::connect() builds
971 // "tcp://{$host}:{$port}", so `tls://redis.example` produces
972 // `tcp://tls://redis.example:6380` and resolution fails on the
973 // literal host "tls". The same string is also written into the
974 // drop-in's WP_REDIS_HOST, so the imported object cache could
975 // never connect. A managed Redis on TLS is the common case.
976 // Bracketed IPv6 is left alone — stream_socket_client() wants
977 // the brackets. (#224)
978 $first = (string) preg_replace( '#^[a-z][a-z0-9+.-]*://#i', '', $first );
979 $separator = strrpos( $first, ':' );
980 if ( false !== $separator ) {
981 $host = substr( $first, 0, $separator );
982 $port = substr( $first, $separator + 1 );
983 $patch['object-cache'][ $engine . '_host' ] = $host;
984 $patch['object-cache'][ $engine . '_port' ] = (int) $port;
985 }
986 }
987
988 // Everything else that has a destination in ObjectCacheModule and
989 // was previously dropped. A non-zero Redis DB index matters most:
990 // the connection would succeed while pointing at the wrong dataset.
991 $copy = $is_memcached
992 ? array( 'objectcache.memcached.persistent' => 'persistent' )
993 : array(
994 'objectcache.redis.dbid' => 'redis_database',
995 'objectcache.redis.password' => 'redis_password',
996 'objectcache.redis.persistent' => 'persistent',
997 'objectcache.redis.timeout' => 'connection_timeout',
998 );
999 $numeric_dests = array( 'redis_database', 'connection_timeout' );
1000 foreach ( $copy as $src => $dest ) {
1001 if ( ! isset( $r[ $src ] ) || '' === $r[ $src ] ) {
1002 continue;
1003 }
1004 // W3TC stores an unset timeout / db index as 0, which carries no
1005 // intent — emitting it would put a meaningless value in the plan
1006 // preview the user is asked to confirm. Only the numeric fields
1007 // get that treatment: casting a password to int would read
1008 // "s3cret" as 0 and silently drop it.
1009 $is_numeric_dest = in_array( $dest, $numeric_dests, true );
1010 if ( $is_numeric_dest && 0 === (int) $r[ $src ] ) {
1011 continue;
1012 }
1013 // W3 Total Cache 2.8+ encrypts secrets in its config file
1014 // (Util_Crypto, `enc:v1:` prefix). Copying the ciphertext
1015 // through would hand Redis a password that can never
1016 // authenticate — and it is exactly the password-protected
1017 // sources this mapping exists to serve. Decrypt with W3TC's
1018 // own helper; if that is unavailable (no crypto key, plugin
1019 // files already gone), SKIP the field rather than import an
1020 // unusable value: a missing password is something the user
1021 // can fix in one edit, a silently wrong one is not. (#224 F1)
1022 if ( 'redis_password' === $dest ) {
1023 $secret = self::decrypt_w3tc_secret( (string) $r[ $src ] );
1024 if ( null === $secret ) {
1025 continue;
1026 }
1027 $patch['object-cache'][ $dest ] = $secret;
1028 continue;
1029 }
1030 $patch['object-cache'][ $dest ] = $is_numeric_dest
1031 ? (int) $r[ $src ]
1032 : $r[ $src ];
1033 }
1034 // W3TC's Cache_Redis only ever calls auth( $password ) — it has no
1035 // ACL username support — so a W3TC source never carries one and we
1036 // must not invent a redis_user here.
1037 }
1038
1039 return $patch;
1040 }
1041
1042 /**
1043 * Resolve a W3 Total Cache secret to plaintext.
1044 *
1045 * W3TC 2.8+ stores secrets encrypted with its own `Util_Crypto`, marked
1046 * by an `enc:v1:` prefix. A plaintext value (older W3TC, or a config
1047 * written before encryption landed) is returned unchanged.
1048 *
1049 * Returns null when the value is encrypted but cannot be decrypted —
1050 * W3TC's classes are not loadable, or its crypto key is gone. Callers
1051 * MUST treat null as "skip this field", never as an empty password:
1052 * importing the ciphertext guarantees an auth failure, and importing an
1053 * empty string would silently drop a password the source really had.
1054 *
1055 * @param string $value Raw value from the W3TC config.
1056 * @return string|null Plaintext, or null when it cannot be resolved.
1057 */
1058 private static function decrypt_w3tc_secret( string $value ): ?string {
1059 if ( 0 !== strpos( $value, 'enc:' ) ) {
1060 return $value;
1061 }
1062
1063 if ( ! class_exists( '\\W3TC\\Util_Crypto' ) ) {
1064 return null;
1065 }
1066
1067 // W3TC's method is envelope_decrypt(), NOT decrypt(). Guarding on the
1068 // wrong name meant method_exists() was false on every install, the
1069 // helper returned null before it ever ran, and the password was
1070 // silently dropped from every import — the exact users the decrypt
1071 // support was written for. Verified against W3TC 2.10.5:
1072 //
1073 // ::decrypt() MISSING
1074 // ::envelope_decrypt() EXISTS
1075 // ::is_envelope() EXISTS
1076 //
1077 // Kept as a list so an older/newer W3TC that renames it again
1078 // degrades to "skip the field" rather than to a fatal. (#218 F1)
1079 $method = null;
1080 foreach ( array( 'envelope_decrypt', 'decrypt' ) as $candidate ) {
1081 if ( method_exists( '\\W3TC\\Util_Crypto', $candidate ) ) {
1082 $method = $candidate;
1083 break;
1084 }
1085 }
1086 if ( null === $method ) {
1087 return null;
1088 }
1089
1090 try {
1091 $plain = \W3TC\Util_Crypto::$method( $value );
1092 } catch ( \Throwable $e ) {
1093 return null;
1094 }
1095
1096 // A failed decrypt can come back as false/null/'' or as the
1097 // untouched ciphertext depending on the failure mode. None of those
1098 // are a usable password.
1099 if ( ! is_string( $plain ) || '' === $plain || 0 === strpos( $plain, 'enc:' ) ) {
1100 return null;
1101 }
1102
1103 return $plain;
1104 }
1105
1106 // ─────────────────────────── WP Super Cache ──────────────────────
1107
1108 public static function detect_wpsc(): ?array {
1109 // WP Super Cache stores its settings as PHP globals in
1110 // wp-content/wp-cache-config.php (NOT the options table — the old
1111 // get_option('wp_cache_enabled') reads always returned null). Parse
1112 // the config file for the globals plan_wpsc() needs. If the file
1113 // doesn't exist yet (plugin active but never configured), fall back
1114 // to a minimal "active" marker so the source still appears in the UI
1115 // and a default import is possible.
1116 $cfg = self::read_wpsc_config_file();
1117 if ( is_array( $cfg ) && ! empty( $cfg ) ) {
1118 return $cfg;
1119 }
1120 if ( self::plugin_active( 'wp-super-cache/wp-cache.php' ) ) {
1121 // Active but unconfigured — expose the on/off intent only.
1122 return array( 'cache_enabled' => defined( 'WPCACHEHOME' ) );
1123 }
1124 return null;
1125 }
1126
1127 /**
1128 * Parse the WP Super Cache config file for the globals we map. The file
1129 * is plain PHP assigning `$wp_cache_* = …;` lines; we extract them with a
1130 * regex rather than including the file (including it would define
1131 * constants / run code in our request).
1132 *
1133 * @return array|null name => value for the recognised globals, or null.
1134 */
1135 private static function read_wpsc_config_file(): ?array {
1136 if ( ! defined( 'WP_CONTENT_DIR' ) ) {
1137 return null;
1138 }
1139 $path = WP_CONTENT_DIR . '/wp-cache-config.php';
1140 if ( ! is_readable( $path ) ) {
1141 return null;
1142 }
1143 $raw = file_get_contents( $path ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- one-shot read of another plugin's config file.
1144 if ( false === $raw || '' === $raw ) {
1145 return null;
1146 }
1147 $out = array();
1148
1149 // `$cache_enabled` is the master switch and `$super_cache_enabled`
1150 // selects mod_rewrite mode. WP Super Cache does NOT define
1151 // `$wp_cache_enabled` — reading that name meant the on/off intent was
1152 // never populated, plan_wpsc() computed `enabled => false`, and
1153 // meaningful_values() then dropped the false boolean entirely. A site
1154 // actively serving cached HTML migrated to caching OFF, silently. (#219)
1155 $keys = array( 'cache_enabled', 'super_cache_enabled', 'wp_cache_mod_rewrite', 'wp_cache_mobile_enabled', 'wp_cache_make_known_anon' );
1156 foreach ( $keys as $key ) {
1157 // Match `$key = 1;` / `$key = '1';` / `$key = true;` etc.
1158 if ( preg_match( '/\$' . preg_quote( $key, '/' ) . '\s*=\s*([^;]+);/', $raw, $m ) ) {
1159 $val = trim( $m[1], " \t'\"" );
1160 $out[ $key ] = in_array( strtolower( $val ), array( '1', 'true' ), true );
1161 }
1162 }
1163
1164 // Tri-state, so it cannot go through the boolean cast above:
1165 // 0 = cache everyone, 1 = skip visitors carrying any cookie,
1166 // 2 = skip logged-in visitors (WPSC's own recommended setting).
1167 // Casting collapsed 2 to false — the exact inverse of the user's
1168 // intent — which is harmless only while nothing maps the key. (#219)
1169 if ( preg_match( '/\$wp_cache_not_logged_in\s*=\s*([^;]+);/', $raw, $m ) ) {
1170 $out['wp_cache_not_logged_in'] = (int) trim( $m[1], " \t'\"" );
1171 }
1172
1173 return ! empty( $out ) ? $out : null;
1174 }
1175
1176 /** Thin wrapper so detection works before admin plugin.php is loaded. */
1177 private static function plugin_active( string $plugin ): bool {
1178 $active = (array) get_option( 'active_plugins', array() );
1179 if ( in_array( $plugin, $active, true ) ) {
1180 return true;
1181 }
1182 // Network-activated (multisite).
1183 $network = (array) get_site_option( 'active_sitewide_plugins', array() );
1184 return isset( $network[ $plugin ] );
1185 }
1186
1187 public static function plan_wpsc( array $r ): array {
1188 $plan = array(
1189 'cache' => array(
1190 // Either flag means WP Super Cache was serving: `cache_enabled`
1191 // is the master switch, `super_cache_enabled` only picks
1192 // mod_rewrite over PHP delivery.
1193 'enabled' => ! empty( $r['cache_enabled'] ) || ! empty( $r['super_cache_enabled'] ),
1194 ),
1195 );
1196 // See plan_wp_rocket: never import Separate Mobile Cache as ON — it
1197 // disables the device-blind static fast path. Flag for review instead.
1198 self::map_mobile_separate( $plan, ! empty( $r['wp_cache_mobile_enabled'] ) );
1199 return $plan;
1200 }
1201
1202 // ─────────────────────────── LiteSpeed Cache ─────────────────────
1203
1204 /**
1205 * Read LiteSpeed Cache settings into a flat `name => value` array keyed
1206 * by LiteSpeed's dotted setting names (cache, cache-mobile, optm-*,
1207 * media-*, object-*, cdn-*, …) — the shape plan_litespeed() expects.
1208 *
1209 * Storage has changed across LiteSpeed versions:
1210 * - v4+ (current): ONE option PER setting, named `litespeed.conf.<name>`
1211 * (e.g. litespeed.conf.cache, litespeed.conf.cache-mobile). There is
1212 * NO single `litespeed.conf` blob — reading that key returns null,
1213 * which is why detection used to fail on every modern install.
1214 * - v3 and earlier: a single serialized array under `litespeed.conf`
1215 * (or the legacy `litespeed-cache-conf`).
1216 * We handle all three: try the per-option family first (the common case
1217 * today), then fall back to the legacy single-blob options.
1218 *
1219 * @return array|null raw conf (name => value), or null when absent.
1220 */
1221 public static function detect_litespeed(): ?array {
1222 global $wpdb;
1223
1224 // v4+: individual `litespeed.conf.<name>` options. Pull them all and
1225 // strip the prefix so keys match what plan_litespeed() reads.
1226 // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- one-time settings-import scan of another plugin's option rows by name prefix; no WP API bulk-reads by option_name LIKE, and caching a single migration-time read is pointless.
1227 $rows = $wpdb->get_results(
1228 "SELECT option_name, option_value FROM {$wpdb->options} WHERE option_name LIKE 'litespeed.conf.%'",
1229 ARRAY_A
1230 );
1231 if ( ! empty( $rows ) ) {
1232 $conf = array();
1233 foreach ( $rows as $row ) {
1234 $name = substr( (string) $row['option_name'], strlen( 'litespeed.conf.' ) );
1235 if ( '' === $name || '_version' === $name ) {
1236 continue;
1237 }
1238 $conf[ $name ] = self::decode_litespeed_value( (string) $row['option_value'] );
1239 }
1240 if ( ! empty( $conf ) ) {
1241 return $conf;
1242 }
1243 }
1244
1245 // v3 / legacy: a single serialized array.
1246 $opt = get_option( 'litespeed.conf', null );
1247 if ( ! is_array( $opt ) ) {
1248 $opt = get_option( 'litespeed-cache-conf', null );
1249 }
1250 return is_array( $opt ) && ! empty( $opt ) ? $opt : null;
1251 }
1252
1253 /**
1254 * Decode one `litespeed.conf.*` option value.
1255 *
1256 * LiteSpeed v4+ stores its list settings as JSON strings, not
1257 * PHP-serialized arrays, so maybe_unserialize() hands the JSON straight
1258 * back as a string. plan_litespeed()'s $list() helper then splits it on
1259 * newlines — which JSON has none of — producing a ONE-element array
1260 * holding the entire blob. Every exclusion rule imported that way is
1261 * dead: the list no longer matches anything, so cart, checkout and
1262 * account pages become publicly cacheable while the import reports
1263 * success. (#217)
1264 *
1265 * Try JSON first for anything shaped like it, and fall back to
1266 * maybe_unserialize() so v3 / legacy installs keep working.
1267 */
1268 private static function decode_litespeed_value( string $raw ) {
1269 $trimmed = trim( $raw );
1270 if ( '' !== $trimmed && ( '[' === $trimmed[0] || '{' === $trimmed[0] ) ) {
1271 $decoded = json_decode( $trimmed, true );
1272 if ( JSON_ERROR_NONE === json_last_error() && is_array( $decoded ) ) {
1273 return $decoded;
1274 }
1275 }
1276 return maybe_unserialize( $raw );
1277 }
1278
1279 /**
1280 * Translate LiteSpeed's `litespeed.conf` into xSpeed module patches.
1281 * LiteSpeed uses dotted keys; values are mostly bool-ish (1/0/'1').
1282 * We map only the settings that have a clean xSpeed equivalent and
1283 * leave the rest untouched so nothing is silently mis-imported.
1284 *
1285 * @param array $r raw litespeed.conf.
1286 */
1287 public static function plan_litespeed( array $r ): array {
1288 $on = static function ( $key ) use ( $r ): bool {
1289 return isset( $r[ $key ] ) && ! empty( $r[ $key ] );
1290 };
1291 // LiteSpeed list fields are stored as either a newline-delimited
1292 // string or an array. Normalize to a clean string[] either way.
1293 $list = static function ( $key ) use ( $r ): array {
1294 $v = $r[ $key ] ?? null;
1295 if ( is_string( $v ) ) {
1296 $v = preg_split( '/\r\n|\r|\n/', $v );
1297 }
1298 if ( ! is_array( $v ) ) {
1299 return array();
1300 }
1301 return array_values( array_filter( array_map( 'trim', array_map( 'strval', $v ) ) ) );
1302 };
1303 // LiteSpeed writes a regex rule bare (`^/secret-.*`); xSpeed marks one
1304 // with a leading `~` (see CacheModule's own `~wp-.*\.php` default) and
1305 // treats anything else as a literal/glob. Imported unchanged, a
1306 // LiteSpeed regex became a literal that matches nothing — the same
1307 // silent loss of protection as the JSON bug above, just narrower. Only
1308 // rules carrying an unmistakable regex metacharacter are converted, so
1309 // a plain path like `/cart` stays the literal it already is. (#217)
1310 $to_xspeed_pattern = static function ( string $rule ): string {
1311 if ( '' === $rule || '~' === $rule[0] ) {
1312 return $rule;
1313 }
1314 return preg_match( '/[\^$|]|\.\*|\.\+|\[.+\]|\\\\[dwsb]/', $rule ) ? '~' . $rule : $rule;
1315 };
1316 $set_list = static function ( array &$dest, string $dest_key, array $vals ) use ( $to_xspeed_pattern ): void {
1317 if ( in_array( $dest_key, array( 'excluded_urls', 'excluded_patterns' ), true ) ) {
1318 $vals = array_map( $to_xspeed_pattern, $vals );
1319 }
1320 if ( $vals ) {
1321 $dest[ $dest_key ] = $vals;
1322 }
1323 };
1324
1325 $patch = array();
1326
1327 // ── Page cache ────────────────────────────────────────────────
1328 $patch['cache'] = array(
1329 'enabled' => $on( 'cache' ) || $on( 'cache-priv' ),
1330 );
1331 // See plan_wp_rocket: never import Separate Mobile Cache as ON — it
1332 // disables the device-blind static fast path. Flag for review instead.
1333 self::map_mobile_separate( $patch, $on( 'cache-mobile' ) );
1334 // TTL: LiteSpeed stores cache-ttl_pub in seconds → xSpeed wants hours.
1335 if ( isset( $r['cache-ttl_pub'] ) && (int) $r['cache-ttl_pub'] > 0 ) {
1336 $patch['cache']['cache_expiry'] = max( 1, min( 720, (int) ( (int) $r['cache-ttl_pub'] / 3600 ) ) );
1337 }
1338 // Excluded URIs / cookies / user-agents / dropped query strings.
1339 $set_list( $patch['cache'], 'excluded_urls', $list( 'cache-exc' ) );
1340 $set_list( $patch['cache'], 'excluded_cookies', $list( 'cache-exc_cookies' ) );
1341 // `cache-exc_useragents`, plural — LiteSpeed's O_CACHE_EXC_USERAGENTS.
1342 // The singular spelling matched nothing, so the list always imported
1343 // empty, and an empty field looks "not configured" rather than lost. (#217)
1344 $set_list( $patch['cache'], 'bypass_user_agents', $list( 'cache-exc_useragents' ) );
1345 // LiteSpeed "drop query string" list ≈ xSpeed ignored_query_params.
1346 $set_list( $patch['cache'], 'ignored_query_params', $list( 'cache-drop_qs' ) );
1347
1348 // ── Minify / optimization ─────────────────────────────────────
1349 $patch['minify'] = array(
1350 'minify_html' => $on( 'optm-html_min' ),
1351 'minify_css' => $on( 'optm-css_min' ),
1352 'minify_js' => $on( 'optm-js_min' ),
1353 'combine_css' => $on( 'optm-css_comb' ),
1354 'combine_js' => $on( 'optm-js_comb' ),
1355 // optm-js_defer is a THREE-WAY switch, not a boolean:
1356 // 0 = OFF, 1 = Deferred, 2 = Delayed (LiteSpeed's own UI labels,
1357 // tpl/page_optm/settings_js.tpl.php). The modes replace each other,
1358 // so 2 must set delay_js INSTEAD of defer_js — the old mapping set
1359 // both, turning one LiteSpeed choice into two xSpeed transforms
1360 // that fight each other. (#217)
1361 'defer_js' => isset( $r['optm-js_defer'] ) && 1 === (int) $r['optm-js_defer'],
1362 'delay_js' => isset( $r['optm-js_defer'] ) && 2 === (int) $r['optm-js_defer'],
1363 // Async/“load CSS asynchronously” — LiteSpeed CCSS async.
1364 'async_css' => $on( 'optm-css_async' ),
1365 // Remove query strings from static resources.
1366 'remove_query_strings' => $on( 'optm-qs_rm' ),
1367 );
1368 // Defer/delay exclusion list — merge LiteSpeed's JS defer + delay
1369 // exclude lists into xSpeed's single defer_js_excluded.
1370 // `optm-js_delay_exc` does not exist in LiteSpeed. Its delay list is
1371 // optm-js_delay_inc (O_OPTM_JS_DELAY_INC) — an INCLUDE list naming the
1372 // scripts to delay, which is xSpeed's delay_js_targets, not an
1373 // exclusion. Merging it into defer_js_excluded would have inverted the
1374 // user's intent, so it maps to its own destination below. (#217)
1375 $defer_exc = $list( 'optm-js_defer_exc' );
1376 $set_list( $patch['minify'], 'defer_js_excluded', $defer_exc );
1377 $set_list( $patch['minify'], 'delay_js_targets', $list( 'optm-js_delay_inc' ) );
1378
1379 // ── Lazy load (media) ─────────────────────────────────────────
1380 $patch['lazy'] = array(
1381 'lazy_images' => $on( 'media-lazy' ),
1382 'lazy_iframes' => $on( 'media-iframe_lazy' ),
1383 // LiteSpeed has no separate HTML5-video lazy toggle; mirror the
1384 // image setting so video preload follows the same intent.
1385 'lazy_videos' => $on( 'media-lazy' ),
1386 // "Add Missing Sizes" → add_missing_dimensions (anti-CLS).
1387 'add_missing_dimensions' => $on( 'media-add_missing_sizes' ),
1388 );
1389 $set_list( $patch['lazy'], 'excluded_images', $list( 'media-lazy_exc' ) );
1390
1391 // ── Fonts ─────────────────────────────────────────────────────
1392 // LiteSpeed "Font Display Optimization" (optm-localize_style /
1393 // optm-css_font_display) → xSpeed font-display: swap.
1394 if ( $on( 'optm-css_font_display' ) || $on( 'optm-localize' ) ) {
1395 $patch['fonts'] = array( 'font_display_swap' => true );
1396 }
1397
1398 // ── Disable bloat ─────────────────────────────────────────────
1399 // Only map the one LiteSpeed "remove" toggle with a clean xSpeed
1400 // equivalent: removing the emoji + oEmbed scripts ≈ disable_oembed.
1401 // (LiteSpeed's optm-emoji_rm strips the wp-emoji + wp-embed pair.)
1402 // jQuery-migrate / dashicons / XML-RPC / RSS / REST aren't
1403 // LiteSpeed-managed, so we don't guess at them.
1404 if ( $on( 'optm-emoji_rm' ) ) {
1405 $patch['bloat'] = array( 'disable_oembed' => true );
1406 }
1407
1408 // ── Browser cache (LiteSpeed: cache-browser) ──────────────────
1409 if ( $on( 'cache-browser' ) ) {
1410 $patch['browser-cache'] = array( 'enabled' => true );
1411 if ( isset( $r['cache-ttl_browser'] ) && (int) $r['cache-ttl_browser'] > 0 ) {
1412 $patch['browser-cache']['asset_ttl'] = (int) $r['cache-ttl_browser'];
1413 }
1414 }
1415
1416 // ── Object cache ──────────────────────────────────────────────
1417 if ( $on( 'object' ) ) {
1418 $kind = isset( $r['object-kind'] ) && (int) $r['object-kind'] === 1 ? 'redis' : 'memcached';
1419 $patch['object-cache'] = array( 'backend' => $kind );
1420 if ( ! empty( $r['object-host'] ) ) {
1421 $host_key = 'redis' === $kind ? 'redis_host' : 'memcached_host';
1422 $patch['object-cache'][ $host_key ] = (string) $r['object-host'];
1423 }
1424 if ( ! empty( $r['object-port'] ) ) {
1425 $port_key = 'redis' === $kind ? 'redis_port' : 'memcached_port';
1426 $patch['object-cache'][ $port_key ] = (int) $r['object-port'];
1427 }
1428 if ( 'redis' === $kind && isset( $r['object-db_id'] ) ) {
1429 $patch['object-cache']['redis_database'] = max( 0, min( 15, (int) $r['object-db_id'] ) );
1430 }
1431 if ( ! empty( $r['object-pswd'] ) && 'redis' === $kind ) {
1432 $patch['object-cache']['redis_password'] = (string) $r['object-pswd'];
1433 }
1434 if ( ! empty( $r['object-global_groups'] ) || ! empty( $r['object-persistent'] ) ) {
1435 $patch['object-cache']['persistent'] = $on( 'object-persistent' );
1436 }
1437 }
1438
1439 // ── Image conversion (Pro Images module) ──────────────────────
1440 // LiteSpeed media-webp / next-gen image generation → xSpeed Images.
1441 if ( $on( 'img_optm-webp' ) || $on( 'media-webp' ) || $on( 'img_optm-auto' ) ) {
1442 $patch['images'] = array(
1443 'webp' => $on( 'img_optm-webp' ) || $on( 'media-webp' ),
1444 'avif' => $on( 'img_optm-avif' ),
1445 );
1446 }
1447
1448 // ── CDN ───────────────────────────────────────────────────────
1449 if ( $on( 'cdn' ) ) {
1450 $cdn_url = '';
1451 if ( ! empty( $r['cdn-mapping'] ) && is_array( $r['cdn-mapping'] ) ) {
1452 $first = $r['cdn-mapping'][0] ?? array();
1453 // LiteSpeed cdn-mapping rows use the 'url' sub-key (array form)
1454 // or a bare URL string (legacy).
1455 $cdn_url = is_array( $first ) ? (string) ( $first['url'] ?? ( $first['cdn_url'] ?? '' ) ) : (string) $first;
1456 }
1457 if ( '' !== $cdn_url ) {
1458 $patch['cdn'] = array(
1459 'enabled' => true,
1460 'cdn_url' => $cdn_url,
1461 );
1462 // LiteSpeed's O_CDN_EXC is `cdn-exc`, not `cdn-exclude`. (#217)
1463 $set_list( $patch['cdn'], 'excluded_patterns', $list( 'cdn-exc' ) );
1464 }
1465 }
1466
1467 return $patch;
1468 }
1469 }
1470