Product settings sections: audited per-product wp_options diagnostics - #45
Merged
Conversation
Audited 12 major products' source (Neve+Pro, Hestia, Optimole, Feedzy
free+pro, Revive Social free+pro, Visualizer, PPOM, Super Page Cache,
MPG, Otter, Starter Sites, LightStart) and mapped the wp_options rows
worth reading when debugging a ticket. Collectors call get_option()
only — never a product class, constant or function — so a product does
not need to load, and a fatal inside one cannot break diagnostics.
Every row is allowlisted per product from that audit; for rows mixing
configuration with secrets only the audited safe keys are read, so
credentials never reach the response at all rather than relying on the
key-name backstop. Excluded on evidence: Optimole api_key/service_data,
ROP services/active_accounts and rop_logs (logs full API responses incl.
Bluesky JWTs), Feedzy third-party API keys and logs.email (customer
address), SPC Cloudflare token/email/purge secrets, PPOM REST secret and
notification list, Otter form recipients/webhook URLs+headers/template
cloud keys, WPMM contact address, plus every licenser 'key' field
(status, plan and expiry are kept). Custom CSS/HTML, PDF templates and
import blobs are dropped as bulky; themes report customizer mod NAMES
only, never the values.
Values are trimmed on top (200-char strings, 50 entries, depth 4), and
allowlists support dot paths and lists of records.
/products/{slug} now answers for a built-in settings map, a
filter-registered provider, or both (settings + data in one response);
the manifest and index list the union, and only products that actually
stored something appear — an unknown slug still 404s. No consumer
change needed: the section route is unchanged.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
/products/{slug}now answers for built-in settings collectors as well as filter-registered providers — so support gets each product's real configuration without waiting for products to adopt the filter.How
An audit of 12 major products' source (Neve+Pro, Hestia, Optimole, Feedzy free+pro, Revive Social free+pro, Visualizer, PPOM, Super Page Cache, MPG, Otter, Starter Sites, LightStart) inventoried every
wp_optionsrow each product owns, with file:line evidence and a per-key sensitivity classification.inc/product-settings.phpmaps the debugging-relevant ones.Collectors call
get_option()only — never a product class, constant or function. A product needn't be loaded or even active to be read, and a fatal inside one cannot break diagnostics.Safety
Allowlisted per product and per key, so secrets are never read rather than relying on the response-time key-name backstop. Excluded on code evidence:
api_key/service_data; ROPservices/active_accountsandrop_logs(logs full API responses including BlueskyaccessJwt/refreshJwt); Feedzy third-party API keys andlogs.email(the customer's own address); Super Page Cache Cloudflare token/email/purge+preloader secrets; PPOM REST secret and notification recipient list; Otter form recipients, webhook URLs+headers, template-cloud keys; WPMM contact address.keyfield —licensestatus, plan and expiry are kept, which is what tickets actually need.The two credential leaks in bold were found by an adversarial review pass over the audit — both sit under names the backstop regex would not catch.
On top: 200-char string trim, 50-entry array cap, depth 4. Allowlists support dot paths (
general.status) and lists of records (per-webhook, per-form).Behavior
Manifest and
/productslist the union of built-in and registered sections, and only products that actually stored something appear. A slug with both returnssettingsanddatain one response. Unknown slug still 404s. No consumer change needed — the route is unchanged.30 tests / 107 assertions green, incl. allowlist enforcement, the two audited leak cases, dot paths, record lists, trimming, and settings+provider coexistence.
🤖 Generated with Claude Code