From cfb975104fa9b95b063d7e84fb5937ed1cd7f41b Mon Sep 17 00:00:00 2001 From: Tim Nolte Date: Wed, 21 Jun 2023 10:15:13 -0400 Subject: [PATCH 1/7] fix: Fixes incorrect order of array_replace_recursive arguments & other issues * Fixes #433 * Fixes #432 * Fixes #431 * Further clean-up & standardization between object-cache.php & wp-redis.php. * Fixes incorrect order of array_replace_recursive arguments. * Addresses issue with port still not being null for socket connections due to defaults array_repalce_recursive use. --- object-cache.php | 12 +++++++----- wp-redis.php | 19 ++++++++++++------- 2 files changed, 19 insertions(+), 12 deletions(-) diff --git a/object-cache.php b/object-cache.php index 78b04fb..20c28d4 100644 --- a/object-cache.php +++ b/object-cache.php @@ -1247,10 +1247,11 @@ public function build_client_parameters( $redis_server ) { // Attempt to automatically load Pantheon's Redis config from the env. if ( isset( $_SERVER['CACHE_HOST'] ) ) { $redis_server = [ - 'host' => wp_strip_all_tags( $_SERVER['CACHE_HOST'] ), - 'port' => isset( $_SERVER['CACHE_PORT'] ) ? wp_strip_all_tags( $_SERVER['CACHE_PORT'] ) : $port, - 'auth' => isset( $_SERVER['CACHE_PASSWORD'] ) ? wp_strip_all_tags( $_SERVER['CACHE_PASSWORD'] ) : null, - 'database' => isset( $_SERVER['CACHE_DB'] ) ? wp_strip_all_tags( $_SERVER['CACHE_DB'] ) : $database, + 'host' => strip_tags( $_SERVER['CACHE_HOST'] ), + 'port' => ! empty( $_SERVER['CACHE_PORT'] ) ? strip_tags( $_SERVER['CACHE_PORT'] ) : $port, + // Don't attempt to sanitize passwords as this can break authentication. + 'auth' => ! empty( $_SERVER['CACHE_PASSWORD'] ) ? $_SERVER['CACHE_PASSWORD'] : null, + 'database' => ! empty( $_SERVER['CACHE_DB'] ) ? strip_tags( $_SERVER['CACHE_DB'] ) : $database, ]; } else { $redis_server = [ @@ -1263,6 +1264,7 @@ public function build_client_parameters( $redis_server ) { if ( file_exists( $redis_server['host'] ) && 'socket' === filetype( $redis_server['host'] ) ) { // unix socket connection. // port must be null or socket won't connect. + unset( $redis_server['port'] ); $port = null; } elseif ( ! empty( $redis_server['port'] ) ) { // tcp connection. $port = $redis_server['port']; @@ -1277,7 +1279,7 @@ public function build_client_parameters( $redis_server ) { // 1s timeout, 100ms delay between reconnections. // merging the defaults with the original $redis_server enables any custom parameters to get sent downstream to the redis client. - return array_replace_recursive( $redis_server, $defaults ); + return array_replace_recursive( $defaults, $redis_server ); } /** diff --git a/wp-redis.php b/wp-redis.php index e420231..2b58cc4 100644 --- a/wp-redis.php +++ b/wp-redis.php @@ -35,21 +35,26 @@ */ function wp_redis_get_info() { global $wp_object_cache, $redis_server; + // Default Redis port. + $port = 6379; + // Default Redis database number. + $database = 0; if ( empty( $redis_server ) ) { // Attempt to automatically load Pantheon's Redis config from the env. if ( isset( $_SERVER['CACHE_HOST'] ) ) { $redis_server = [ - 'host' => sanitize_text_field( $_SERVER['CACHE_HOST'] ), - 'port' => isset( $_SERVER['CACHE_PORT'] ) ? sanitize_text_field( $_SERVER['CACHE_PORT'] ) : 6379, - 'auth' => isset( $_SERVER['CACHE_PASSWORD'] ) ? sanitize_text_field( $_SERVER['CACHE_PASSWORD'] ) : null, - 'database' => isset( $_SERVER['CACHE_DB'] ) ? sanitize_text_field( $_SERVER['CACHE_DB'] ) : 0, + 'host' => strip_tags( $_SERVER['CACHE_HOST'] ), + 'port' => ! empty( $_SERVER['CACHE_PORT'] ) ? strip_tags( $_SERVER['CACHE_PORT'] ) : $port, + // Don't attempt to sanitize passwords as this can break authentication. + 'auth' => ! empty( $_SERVER['CACHE_PASSWORD'] ) ? $_SERVER['CACHE_PASSWORD'] : null, + 'database' => ! empty( $_SERVER['CACHE_DB'] ) ? strip_tags( $_SERVER['CACHE_DB'] ) : $database, ]; } else { $redis_server = [ 'host' => '127.0.0.1', - 'port' => 6379, - 'database' => 0, + 'port' => $port, + 'database' => $database, ]; } } @@ -73,7 +78,7 @@ function wp_redis_get_info() { } else { $uptime_in_days .= ' days'; } - $database = ! empty( $redis_server['database'] ) ? $redis_server['database'] : 0; + $database = ! empty( $redis_server['database'] ) ? $redis_server['database'] : $database; $key_count = 0; if ( isset( $info[ 'db' . $database ] ) && preg_match( '#keys=([\d]+)#', $info[ 'db' . $database ], $matches ) ) { $key_count = $matches[1]; From 1d2b2691a83d19ff06a260678a86e69d50cba063 Mon Sep 17 00:00:00 2001 From: Tim Nolte Date: Fri, 23 Jun 2023 13:03:12 -0400 Subject: [PATCH 2/7] fix: Fixes sanitization methods and linting issues * Adjusts some items to use type-based sanitization. * Adds linting expection handling with comments for cases that require it. --- object-cache.php | 7 +++++-- wp-redis.php | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/object-cache.php b/object-cache.php index 20c28d4..fd0752e 100644 --- a/object-cache.php +++ b/object-cache.php @@ -1247,11 +1247,14 @@ public function build_client_parameters( $redis_server ) { // Attempt to automatically load Pantheon's Redis config from the env. if ( isset( $_SERVER['CACHE_HOST'] ) ) { $redis_server = [ + // Don't use WP methods to sanitize the host due to plugin loading issues with other caching methods. + // @phpcs:ignore WordPressVIPMinimum.Functions.StripTags.StripTagsOneParameter,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized 'host' => strip_tags( $_SERVER['CACHE_HOST'] ), - 'port' => ! empty( $_SERVER['CACHE_PORT'] ) ? strip_tags( $_SERVER['CACHE_PORT'] ) : $port, + 'port' => ! empty( $_SERVER['CACHE_PORT'] ) ? intval( $_SERVER['CACHE_PORT'] ) : $port, // Don't attempt to sanitize passwords as this can break authentication. + // @phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized 'auth' => ! empty( $_SERVER['CACHE_PASSWORD'] ) ? $_SERVER['CACHE_PASSWORD'] : null, - 'database' => ! empty( $_SERVER['CACHE_DB'] ) ? strip_tags( $_SERVER['CACHE_DB'] ) : $database, + 'database' => ! empty( $_SERVER['CACHE_DB'] ) ? intval( $_SERVER['CACHE_DB'] ) : $database, ]; } else { $redis_server = [ diff --git a/wp-redis.php b/wp-redis.php index 2b58cc4..b5a9f34 100644 --- a/wp-redis.php +++ b/wp-redis.php @@ -44,11 +44,14 @@ function wp_redis_get_info() { // Attempt to automatically load Pantheon's Redis config from the env. if ( isset( $_SERVER['CACHE_HOST'] ) ) { $redis_server = [ + // Don't use WP methods to sanitize the host due to plugin loading issues with other caching methods. + // @phpcs:ignore WordPressVIPMinimum.Functions.StripTags.StripTagsOneParameter,WordPress.Security.ValidatedSanitizedInput.InputNotSanitized 'host' => strip_tags( $_SERVER['CACHE_HOST'] ), - 'port' => ! empty( $_SERVER['CACHE_PORT'] ) ? strip_tags( $_SERVER['CACHE_PORT'] ) : $port, + 'port' => ! empty( $_SERVER['CACHE_PORT'] ) ? intval( $_SERVER['CACHE_PORT'] ) : $port, // Don't attempt to sanitize passwords as this can break authentication. + // @phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized 'auth' => ! empty( $_SERVER['CACHE_PASSWORD'] ) ? $_SERVER['CACHE_PASSWORD'] : null, - 'database' => ! empty( $_SERVER['CACHE_DB'] ) ? strip_tags( $_SERVER['CACHE_DB'] ) : $database, + 'database' => ! empty( $_SERVER['CACHE_DB'] ) ? intval( $_SERVER['CACHE_DB'] ) : $database, ]; } else { $redis_server = [ From 4d56e39a097552645b454ae0efc8de8b6be452ee Mon Sep 17 00:00:00 2001 From: Tim Nolte Date: Fri, 23 Jun 2023 13:11:22 -0400 Subject: [PATCH 3/7] fix: Removes invalid change made in #437 * Reverts this incorrect change that was made due to the incorrect use of `array_replace_recursive()`. --- object-cache.php | 2 -- 1 file changed, 2 deletions(-) diff --git a/object-cache.php b/object-cache.php index fd0752e..f2fd428 100644 --- a/object-cache.php +++ b/object-cache.php @@ -1269,8 +1269,6 @@ public function build_client_parameters( $redis_server ) { // port must be null or socket won't connect. unset( $redis_server['port'] ); $port = null; - } elseif ( ! empty( $redis_server['port'] ) ) { // tcp connection. - $port = $redis_server['port']; } $defaults = [ From 3de4ad36c7e5912958aef4f5cf285f2cefbfdfae Mon Sep 17 00:00:00 2001 From: Chris Reynolds Date: Fri, 23 Jun 2023 11:43:12 -0600 Subject: [PATCH 4/7] update changelog --- README.md | 3 +++ readme.txt | 3 +++ 2 files changed, 6 insertions(+) diff --git a/README.md b/README.md index e25712a..e71c8d1 100644 --- a/README.md +++ b/README.md @@ -107,6 +107,9 @@ There's a known issue with WordPress `alloptions` cache design. Specifically, a ### 1.4.3-dev ### * Bug fix: Fixes assumption that CACHE_PORT & CACHE_PASSWORD are Set. [[428](https://github.com/pantheon-systems/wp-redis/pull/428)] (props @timnolte) * Adds WP.org validation GitHub action [[#435](https://github.com/pantheon-systems/wp-redis/pull/435)] +* Bug fix: Fixes incorrect order of `array_replace_recursive` and other issues [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) +* Fixes [CMSP-470] Replace use of wp_strip_all_tags (possibly any wp filter function?) in object-cache.php [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) +* Fixes [CMSP-467] Please don't strip all tags from the cache password. [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) ### 1.4.2 (May 15, 2023) ### * Bug fix: Removes exception loop caused by `esc_html` in `_exception_handler()` [[421](https://github.com/pantheon-systems/wp-redis/pull/421)] diff --git a/readme.txt b/readme.txt index 08fcb5b..007ca43 100644 --- a/readme.txt +++ b/readme.txt @@ -105,6 +105,9 @@ There's a known issue with WordPress `alloptions` cache design. Specifically, a = 1.4.3-dev = * Bug fix: Fixes assumption that CACHE_PORT & CACHE_PASSWORD are Set. [[428](https://github.com/pantheon-systems/wp-redis/pull/428)] (props @tnolte) * Adds WP.org validation GitHub action [[#435](https://github.com/pantheon-systems/wp-redis/pull/435)] +* Bug fix: Fixes incorrect order of `array_replace_recursive` and other issues [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) +* Fixes [CMSP-470] Replace use of wp_strip_all_tags (possibly any wp filter function?) in object-cache.php [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) +* Fixes [CMSP-467] Please don't strip all tags from the cache password. [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) = 1.4.2 (May 15, 2023) = * Bug fix: Removes exception loop caused by `esc_html` in `_exception_handler()` [[421](https://github.com/pantheon-systems/wp-redis/pull/421)] From 6a133d6081d45b9d1ab0af362e677a9d12c117ce Mon Sep 17 00:00:00 2001 From: Phil Tyler Date: Fri, 23 Jun 2023 10:46:27 -0700 Subject: [PATCH 5/7] Update wp-redis.php --- wp-redis.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/wp-redis.php b/wp-redis.php index b5a9f34..8084df9 100644 --- a/wp-redis.php +++ b/wp-redis.php @@ -81,7 +81,9 @@ function wp_redis_get_info() { } else { $uptime_in_days .= ' days'; } - $database = ! empty( $redis_server['database'] ) ? $redis_server['database'] : $database; + if ( ! empty( $redis_server['database'] ) { + $database = $redis_server['database']; + } $key_count = 0; if ( isset( $info[ 'db' . $database ] ) && preg_match( '#keys=([\d]+)#', $info[ 'db' . $database ], $matches ) ) { $key_count = $matches[1]; From 818450f182660d29aff01db50d247cb103d2052e Mon Sep 17 00:00:00 2001 From: Chris Reynolds Date: Fri, 23 Jun 2023 11:47:35 -0600 Subject: [PATCH 6/7] update language in changelogs --- README.md | 4 ++-- readme.txt | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index e71c8d1..d245c43 100644 --- a/README.md +++ b/README.md @@ -108,8 +108,8 @@ There's a known issue with WordPress `alloptions` cache design. Specifically, a * Bug fix: Fixes assumption that CACHE_PORT & CACHE_PASSWORD are Set. [[428](https://github.com/pantheon-systems/wp-redis/pull/428)] (props @timnolte) * Adds WP.org validation GitHub action [[#435](https://github.com/pantheon-systems/wp-redis/pull/435)] * Bug fix: Fixes incorrect order of `array_replace_recursive` and other issues [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) -* Fixes [CMSP-470] Replace use of wp_strip_all_tags (possibly any wp filter function?) in object-cache.php [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) -* Fixes [CMSP-467] Please don't strip all tags from the cache password. [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) +* Bug fix: Replace use of wp_strip_all_tags in object-cache.php [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) +* Bug fix: Don't strip tags from the cache password. [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) ### 1.4.2 (May 15, 2023) ### * Bug fix: Removes exception loop caused by `esc_html` in `_exception_handler()` [[421](https://github.com/pantheon-systems/wp-redis/pull/421)] diff --git a/readme.txt b/readme.txt index 007ca43..8f25348 100644 --- a/readme.txt +++ b/readme.txt @@ -106,8 +106,8 @@ There's a known issue with WordPress `alloptions` cache design. Specifically, a * Bug fix: Fixes assumption that CACHE_PORT & CACHE_PASSWORD are Set. [[428](https://github.com/pantheon-systems/wp-redis/pull/428)] (props @tnolte) * Adds WP.org validation GitHub action [[#435](https://github.com/pantheon-systems/wp-redis/pull/435)] * Bug fix: Fixes incorrect order of `array_replace_recursive` and other issues [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) -* Fixes [CMSP-470] Replace use of wp_strip_all_tags (possibly any wp filter function?) in object-cache.php [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) -* Fixes [CMSP-467] Please don't strip all tags from the cache password. [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) +* Bug fix: Replace use of wp_strip_all_tags in object-cache.php [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) +* Bug fix: Don't strip tags from the cache password. [[434](https://github.com/pantheon-systems/wp-redis/pull/434)] (props @timnolte) = 1.4.2 (May 15, 2023) = * Bug fix: Removes exception loop caused by `esc_html` in `_exception_handler()` [[421](https://github.com/pantheon-systems/wp-redis/pull/421)] From c2d0366cbacbdac372c2d01d1f37aeab4d978a6b Mon Sep 17 00:00:00 2001 From: Chris Reynolds Date: Fri, 23 Jun 2023 11:50:38 -0600 Subject: [PATCH 7/7] fix missing closing ) --- wp-redis.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wp-redis.php b/wp-redis.php index 8084df9..dde161f 100644 --- a/wp-redis.php +++ b/wp-redis.php @@ -81,7 +81,7 @@ function wp_redis_get_info() { } else { $uptime_in_days .= ' days'; } - if ( ! empty( $redis_server['database'] ) { + if ( ! empty( $redis_server['database'] ) ) { $database = $redis_server['database']; } $key_count = 0;