← All changes | includes/modules/Cdn/CdnModule.php +310 -15 1.0.3 → 1.3.2 View file →

		@@ -11,8 +11,10 @@
11	11	declare(strict_types=1);
12	12
13	13	namespace XSpeed\Modules\Cdn;
14	14
	15	+defined( 'ABSPATH' ) || exit;
	16	+
15	17	use XSpeed\Cdn_Rewriter;
16	18	use XSpeed\Module;
17	19
18	20	final class CdnModule extends Module {
		@@ -22,11 +24,11 @@
22	24	public const VERSION = '1.0.0';
23	25
24	26	public function ui_metadata(): array {
25	27	return array(
26		- 'label' => 'CDN',
	28	+ 'label' => __( 'CDN', 'xspeed' ),
27	29	'icon' => 'Globe',
28		- 'description' => 'Serve static assets (images, fonts, CSS, JS) from a pull-zone CDN host like BunnyCDN, KeyCDN, or your own.',
	30	+ 'description' => __( 'Serve static assets (images, fonts, CSS, JS) from a pull-zone CDN host like BunnyCDN, KeyCDN, or your own.', 'xspeed' ),
29	31	);
30	32	}
31	33
32	34	public function settings_schema(): array {
		@@ -33,30 +35,33 @@
33	35	return array(
34	36	'enabled' => array(
35	37	'type' => 'bool',
36	38	'default' => false,
37		- 'label' => 'Enable CDN',
38		- 'description' => 'Rewrite static asset URLs to the CDN hostname below. Your CDN must be a pull-zone configured to fetch from this site.',
	39	+ 'label' => __( 'Enable CDN', 'xspeed' ),
	40	+ 'description' => __( 'Rewrite static asset URLs to the CDN hostname below. Your CDN must be a pull-zone configured to fetch from this site.', 'xspeed' ),
39	41	),
40	42	'cdn_url' => array(
41	43	'type' => 'string',
42	44	'default' => '',
43		- 'label' => 'CDN URL',
44		- 'description' => 'CDN hostname, e.g. cdn.example.com. https:// and trailing slashes are stripped automatically.',
	45	+ 'label' => __( 'CDN URL', 'xspeed' ),
	46	+ 'description' => __( 'CDN hostname, e.g. cdn.example.com. https:// and trailing slashes are stripped automatically.', 'xspeed' ),
	47	+ 'dependsOn' => array( 'field' => 'enabled' ),
45	48	),
46	49	'included_extensions' => array(
47	50	'type' => 'list',
48	51	'default' => Cdn_Rewriter::DEFAULT_EXTENSIONS,
49	52	'item_type' => 'string',
50		- 'label' => 'Included File Extensions',
51		- 'description' => 'Only URLs ending in these extensions are rewritten. Defaults cover images, fonts, CSS, JS, and common media.',
	53	+ 'label' => __( 'Included File Extensions', 'xspeed' ),
	54	+ 'description' => __( 'Only URLs ending in these extensions are rewritten. Defaults cover images, fonts, CSS, JS, and common media.', 'xspeed' ),
	55	+ 'dependsOn' => array( 'field' => 'enabled' ),
52	56	),
53	57	'excluded_patterns' => array(
54	58	'type' => 'list',
55	59	'default' => array(),
56	60	'item_type' => 'string',
57		- 'label' => 'Excluded Patterns',
58		- 'description' => 'Glob patterns matched against the URL path. Matching URLs stay on the origin. Examples: /wp-admin/*, *.pdf, /private/*',
	61	+ 'label' => __( 'Excluded Patterns', 'xspeed' ),
	62	+ 'description' => __( 'Glob patterns matched against the URL path. Matching URLs stay on the origin. Examples: /wp-admin/*, *.pdf, /private/*', 'xspeed' ),
	63	+ 'dependsOn' => array( 'field' => 'enabled' ),
59	64	),
60	65	);
61	66	}
62	67
		@@ -71,27 +76,316 @@
71	76	);
72	77	}
73	78
74	79	public function boot(): void {
	80	+ /*
	81	+ * Deferred to `init`. This module reads its own settings to decide
	82	+ * what to hook, and reading settings builds settings_schema(), whose
	83	+ * labels are declared through __(). boot() runs on `plugins_loaded`,
	84	+ * before `after_setup_theme` — the point WordPress 6.7+ treats as the
	85	+ * earliest safe moment to translate — so doing that here fires
	86	+ * _load_textdomain_just_in_time on every request AND resolves the
	87	+ * labels against a domain that is not loaded yet.
	88	+ *
	89	+ * Everything below hooks actions that fire after `init`, so running
	90	+ * one hook later is equivalent.
	91	+ */
	92	+ add_action( 'init', array( $this, 'boot_on_init' ) );
	93	+ }
	94	+
	95	+ /**
	96	+ * The real boot body — see boot() for why it runs on `init`.
	97	+ */
	98	+ public function boot_on_init(): void {
75	99	// Always-on: normalize cdn_url on save (admin context too).
76	100	add_filter( 'pre_update_option_xspeed_module_cdn', array( $this, 'normalize_on_save' ), 10, 1 );
77	101
	102	+ // CDN URLs are baked into cached HTML, so a settings change that
	103	+ // isn't followed by a purge is invisible: the user edits the CDN
	104	+ // host, reloads, sees the old host still served from cache, and
	105	+ // concludes the feature is broken. Also keeps the font-CORS rules
	106	+ // in .htaccess in step with the enabled flag.
	107	+ add_action( 'update_option_xspeed_module_cdn', array( $this, 'on_settings_change' ), 10, 0 );
	108	+
78	109	if ( is_admin() || ( defined( 'DOING_AJAX' ) && DOING_AJAX ) || ( defined( 'DOING_CRON' ) && DOING_CRON ) || ( defined( 'REST_REQUEST' ) && REST_REQUEST ) ) {
79	110	return;
80	111	}
	112	+
	113	+ // Rewriting asset hosts under a builder editor sends the editor's own
	114	+ // scripts to the CDN, where the copy can be stale or absent. (#281)
	115	+ if ( \XSpeed\Builder_Editor::is_active() ) {
	116	+ return;
	117	+ }
81	118	$opts = $this->get_settings();
82	119	if ( empty( $opts['enabled'] ) || empty( $opts['cdn_url'] ) ) {
83	120	return;
84	121	}
85	122	Cdn_Rewriter::reset_state();
86		- // Late filter — same convention as Lazy_Loader. Runs after
87		- // shortcodes / blocks / embeds finish injecting tags.
88		- add_filter( 'the_content', array( Cdn_Rewriter::class, 'process_html' ), 1000 );
89		- add_filter( 'post_thumbnail_html', array( Cdn_Rewriter::class, 'process_html' ), 1000 );
90		- add_filter( 'widget_text_content', array( Cdn_Rewriter::class, 'process_html' ), 1000 );
	123	+
	124	+ // Attachment URLs still go through their own filter: media-library
	125	+ // URLs are frequently consumed as PHP strings (feeds, oEmbed, REST
	126	+ // echoes) rather than emitted into the page HTML we rewrite below.
91	127	add_filter( 'wp_get_attachment_url', array( $this, 'rewrite_attachment_url' ), 1000 );
	128	+
	129	+ // Preconnect to the CDN host. Every asset on the page now resolves
	130	+ // there, so paying the DNS + TLS handshake once up front rather than
	131	+ // on first asset request is worth the one tag.
	132	+ add_filter( 'wp_resource_hints', array( $this, 'add_preconnect' ), 10, 2 );
	133	+
	134	+ // Whole-page pass.
	135	+ //
	136	+ // This module used to hook only the_content, post_thumbnail_html and
	137	+ // widget_text_content — four filters that between them can never
	138	+ // contain a stylesheet, a script or a font. So `css`, `js` and the
	139	+ // five font extensions shipped ticked by default and rewrote nothing:
	140	+ // a user enabled the CDN, saw them enabled, and found zero requests
	141	+ // in their pull zone.
	142	+ //
	143	+ // Enqueued assets can't be reached with those filters at all, and
	144	+ // hooking style_loader_src/script_loader_src would still miss inline
	145	+ // url(), hardcoded theme-template images and third-party echo output.
	146	+ // One pass over the finished page catches every category at once.
	147	+ //
	148	+ // It also fixes the srcset split: core builds srcset from
	149	+ // wp_get_upload_dir() and never calls wp_get_attachment_url(), so a
	150	+ // theme image previously got a CDN `src` and an origin `srcset` in
	151	+ // the same tag.
	152	+ //
	153	+ // Cost: on the cache-write path this runs once per MISS and the CDN
	154	+ // URLs bake into the stored HTML, so cache HITs pay nothing. This is
	155	+ // what Powered Cache, Breeze and SpeedyCache all do. The trade-off is
	156	+ // that turning the CDN off needs a cache purge — handled by
	157	+ // purge_on_change() below.
	158	+ add_filter(
	159	+ 'xspeed_cache_final_html',
	160	+ static function ( $html ) {
	161	+ if ( ! self::should_rewrite_request() ) {
	162	+ return $html;
	163	+ }
	164	+ return Cdn_Rewriter::process_html( (string) $html );
	165	+ },
	166	+ // After Resource Hints (10) so any preload/preconnect tag it
	167	+ // injects gets its URL rewritten too.
	168	+ 20,
	169	+ 1
	170	+ );
	171	+
	172	+ // Cache-off path: the filter above never fires, so buffer the page
	173	+ // ourselves. Guarded so we never double-buffer when the cache engine
	174	+ // is running.
	175	+ if ( ! $this->cache_enabled() ) {
	176	+ add_action(
	177	+ 'template_redirect',
	178	+ static function () {
	179	+ if ( self::$buffering || ! self::should_rewrite_request() ) {
	180	+ return;
	181	+ }
	182	+ self::$buffering = true;
	183	+ ob_start(
	184	+ static function ( $buffer ) {
	185	+ if ( strlen( (string) $buffer ) < 255 ) {
	186	+ return $buffer;
	187	+ }
	188	+ return Cdn_Rewriter::process_html( (string) $buffer );
	189	+ }
	190	+ );
	191	+ },
	192	+ 9
	193	+ );
	194	+ }
92	195	}
93	196
	197	+ /**
	198	+ * Guard against opening our buffer twice on one request.
	199	+ *
	200	+ * @var bool
	201	+ */
	202	+ private static $buffering = false;
	203	+
	204	+ /**
	205	+ * Should this request have its asset URLs rewritten at all?
	206	+ *
	207	+ * The module's original bail set covered admin / AJAX / cron / REST only.
	208	+ * These four are the remaining request types where a CDN URL is either
	209	+ * wrong or actively unhelpful:
	210	+ *
	211	+ * - Previews render unsaved content for one logged-in author; pointing
	212	+ * their assets at a pull zone caches a draft at the edge.
	213	+ * - robots.txt and trackbacks are not HTML and have no assets.
	214	+ * - Non-GET requests are form posts and API calls, never a page whose
	215	+ * asset URLs matter.
	216	+ */
	217	+ public static function should_rewrite_request(): bool {
	218	+ $method = isset( $_SERVER['REQUEST_METHOD'] )
	219	+ ? strtoupper( sanitize_text_field( wp_unslash( $_SERVER['REQUEST_METHOD'] ) ) )
	220	+ : 'GET';
	221	+ if ( 'GET' !== $method && 'HEAD' !== $method ) {
	222	+ return false;
	223	+ }
	224	+ if ( function_exists( 'is_preview' ) && is_preview() ) {
	225	+ return false;
	226	+ }
	227	+ if ( function_exists( 'is_robots' ) && is_robots() ) {
	228	+ return false;
	229	+ }
	230	+ if ( function_exists( 'is_trackback' ) && is_trackback() ) {
	231	+ return false;
	232	+ }
	233	+ if ( function_exists( 'is_feed' ) && is_feed() ) {
	234	+ return false;
	235	+ }
	236	+
	237	+ /**
	238	+ * Final say on whether to rewrite asset URLs for this request.
	239	+ *
	240	+ * @param bool $should Whether to rewrite.
	241	+ */
	242	+ return (bool) apply_filters( 'xspeed_cdn_should_rewrite', true );
	243	+ }
	244	+
	245	+ /**
	246	+ * Is the page cache on? When it is, Cache::finalize_buffer() runs and our
	247	+ * xspeed_cache_final_html filter fires — so we must NOT also ob_start().
	248	+ */
	249	+ private function cache_enabled(): bool {
	250	+ $legacy = \XSpeed\Settings_Manager::get( 'legacy' );
	251	+ if ( is_array( $legacy ) && ! empty( $legacy['cache_enabled'] ) ) {
	252	+ return true;
	253	+ }
	254	+ $opts = get_option( 'xspeed_options' );
	255	+ return is_array( $opts ) && ! empty( $opts['cache_enabled'] );
	256	+ }
	257	+
	258	+ /**
	259	+ * Settings changed — purge the page cache and re-sync the font-CORS
	260	+ * rules in .htaccess.
	261	+ */
	262	+ public function on_settings_change(): void {
	263	+ $this->sync_font_cors();
	264	+ if ( class_exists( '\\XSpeed\\Cache' ) ) {
	265	+ \XSpeed\Cache::purge_all( 'cdn settings change' );
	266	+ // purge_all() only reaches what we wrote. The attachment-URL
	267	+ // filter below runs DURING render, so a page builder that caches
	268	+ // rendered output has already stored the old host — Elementor
	269	+ // keeps it in `_elementor_element_cache` for 24 h and in
	270	+ // `uploads/elementor/css/post-<id>.css` with no expiry at all.
	271	+ // Without this, turning the CDN OFF keeps serving the dead host
	272	+ // (images 404 once the pull zone lapses) and turning it ON leaves
	273	+ // the LCP hero on the origin — both for a day or more, both after
	274	+ // a purge the user watched succeed.
	275	+ \XSpeed\Cache::purge_render_caches( 'cdn settings change' );
	276	+ }
	277	+ }
	278	+
	279	+ /**
	280	+ * Write (or remove) the Apache/LiteSpeed font-CORS block.
	281	+ *
	282	+ * nginx hosts get the same directives through nginx_directives() and the
	283	+ * unified server-block snippet instead — we can't write their config.
	284	+ */
	285	+ public function sync_font_cors(): void {
	286	+ if ( ! class_exists( '\\XSpeed\\Server' ) || ! \XSpeed\Server::supports_htaccess() ) {
	287	+ return;
	288	+ }
	289	+ if ( ! function_exists( 'insert_with_markers' ) ) {
	290	+ require_once ABSPATH . 'wp-admin/includes/misc.php';
	291	+ }
	292	+ if ( ! function_exists( 'insert_with_markers' ) ) {
	293	+ return;
	294	+ }
	295	+
	296	+ $opts = $this->get_settings();
	297	+ $active = ! empty( $opts['enabled'] ) && ! empty( $opts['cdn_url'] );
	298	+
	299	+ $rules = $active
	300	+ ? array(
	301	+ '<IfModule mod_headers.c>',
	302	+ ' # Allow the CDN to pull webfonts cross-origin.',
	303	+ ' <FilesMatch "\\.(woff2?|ttf|otf|eot)$">',
	304	+ ' Header always set Access-Control-Allow-Origin "*"',
	305	+ ' </FilesMatch>',
	306	+ '</IfModule>',
	307	+ )
	308	+ : array();
	309	+
	310	+ // ABSPATH rather than get_home_path(): that function lives in
	311	+ // wp-admin/includes/file.php, which is not loaded on a REST, CLI or
	312	+ // cron request — and because this class is namespaced, the
	313	+ // unqualified call resolved to XSpeed\Modules\Cdn\get_home_path()
	314	+ // and fatalled on every real save, including disabling the module.
	315	+ // This mirrors class-gzip.php, and the file_exists() guard it brings
	316	+ // also stops insert_with_markers() creating a stray .htaccess at the
	317	+ // WP root on a subdirectory install.
	318	+ $htaccess = ABSPATH . '.htaccess';
	319	+ if ( ! file_exists( $htaccess ) ) {
	320	+ // Nothing to amend, and nothing to clean up.
	321	+ if ( empty( $rules ) ) {
	322	+ return;
	323	+ }
	324	+ if ( ! is_writable( ABSPATH ) ) {
	325	+ return;
	326	+ }
	327	+ }
	328	+
	329	+ insert_with_markers( $htaccess, 'xSpeed CDN', $rules );
	330	+ }
	331	+
	332	+ /**
	333	+ * Font CORS for the origin.
	334	+ *
	335	+ * We ship the five font extensions enabled by default, and now that CSS
	336	+ * actually reaches the CDN, `@font-face` inside those stylesheets
	337	+ * resolves against the CDN host too. A font fetched cross-origin is a
	338	+ * CORS request: without `Access-Control-Allow-Origin` on the ORIGIN
	339	+ * response, the CDN caches a response the browser then refuses, and every
	340	+ * webfont silently falls back to a system face.
	341	+ *
	342	+ * This was latent before — nothing reached the CDN, so nothing broke.
	343	+ * Fixing the rewrite without this would turn a dead setting into a live
	344	+ * regression, which is why it ships in the same change.
	345	+ *
	346	+ * @return string|null nginx directives, or null when the CDN is off.
	347	+ */
	348	+ public function nginx_directives(): ?string {
	349	+ $opts = $this->get_settings();
	350	+ if ( empty( $opts['enabled'] ) || empty( $opts['cdn_url'] ) ) {
	351	+ return null;
	352	+ }
	353	+ return "# Allow the CDN to pull webfonts cross-origin.\n"
	354	+ . "location ~* \\.(woff2?|ttf|otf|eot)$ {\n"
	355	+ . " add_header Access-Control-Allow-Origin \"*\" always;\n"
	356	+ . "}";
	357	+ }
	358	+
	359	+ /**
	360	+ * Emit a preconnect hint for the CDN host.
	361	+ *
	362	+ * @param array $hints URLs for this relation type.
	363	+ * @param string $relation_type One of dns-prefetch / preconnect / …
	364	+ * @return array
	365	+ */
	366	+ public function add_preconnect( $hints, $relation_type ) {
	367	+ if ( 'preconnect' !== $relation_type || ! is_array( $hints ) ) {
	368	+ return $hints;
	369	+ }
	370	+ if ( Cdn_Rewriter::is_dev_host() ) {
	371	+ return $hints;
	372	+ }
	373	+ $opts = $this->get_settings();
	374	+ $host = Cdn_Rewriter::normalize_host( (string) ( $opts['cdn_url'] ?? '' ) );
	375	+ if ( '' === $host ) {
	376	+ return $hints;
	377	+ }
	378	+ // crossorigin so the hint also warms the connection fonts will use —
	379	+ // font requests are CORS requests and would otherwise open a second
	380	+ // connection.
	381	+ $hints[] = array(
	382	+ 'href' => '//' . $host,
	383	+ 'crossorigin' => 'anonymous',
	384	+ );
	385	+ return $hints;
	386	+ }
	387	+
94	388	public function rewrite_attachment_url( $url ) {
95	389	if ( ! is_string( $url ) || '' === $url ) {
96	390	return $url;
97	391	}
		@@ -120,8 +414,9 @@
120	414	array(
121	415	'name' => 'xspeed cdn',
122	416	'callback' => array( $this, 'cli_handler' ),
123	417	'shortdesc' => 'Show CDN settings + test rewriting a URL.',
	418	+ 'ai_hint' => 'Is a CDN configured, and does URL rewriting work? Use to check whether assets are served from the CDN, or to test what a given URL rewrites to before trusting the setting.',
124	419	'synopsis' => array(
125	420	array(
126	421	'type' => 'positional',
127	422	'name' => 'action',