R3ap3r/aurora-wordpress-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Snapshot synced v3.6.1 working state as baseline

Browse Source 
Machine-sync snapshot: the working tree carried the full 3.0.0-3.6.1 arc
(licensing/FileManager/DatabaseExplorer removal, all new replacement screens
and REST controllers) that had not been committed on this machine. Captured
here as a safety baseline before starting the Adminify-parity revamp.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
NixReaper
2026-07-12 08:41:18 -05:00
co-authored by Claude Opus 4.8
parent 07d77bda57
commit e2db2ad4b5
88 changed files with 8944 additions and 2730 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/src/Options/Settings.php
+31 -17
View File
@@ -16,6 +16,29 @@ class Settings
public function __construct()
{
add_action("init", [self::class, "register"]);
add_action("init", [self::class, "remove_retired_keys"]);
}
// One-time cleanup for settings keys that no longer exist in the UI:
// the removed Remote Site Switcher feature (remote_sites stored a real
// secret — application passwords — that nothing ever consumed) and the
// removed licensing system (license_key, dev_license_override). Actively
// deletes them from the database rather than just leaving them inertly
// stored.
public static function remove_retired_keys()
{
$settings = self::get();
$retired = ["remote_sites", "remote_site_switcher_capability", "license_key", "dev_license_override"];
$present = array_intersect($retired, array_keys($settings));
if (empty($present)) {
return;
}
foreach ($present as $key) {
unset($settings[$key]);
}
update_option(self::OPTION_NAME, $settings);
}
public static function register()
@@ -28,8 +51,8 @@ class Settings
// it wholesale. This lets pages save just the keys they own (e.g. the
// dashboard sends only dashboard_card_order, the shell only dark_mode)
// without wiping settings they never received — which matters because
// most pages get a sanitized copy with secrets stripped (see
// get_safe()) and must never write that stripped copy back.
// most pages get a sanitized copy (see get_safe()) and must never
// write that stripped copy back.
"sanitize_callback" => [self::class, "merge_on_save"],
"show_in_rest" => [
"schema" => [
@@ -77,25 +100,16 @@ class Settings
/**
* Settings safe to expose on every admin page (the shell serializes this
* for all logged-in users). Strips secrets: the license key and remote
* site application passwords. The settings page itself (manage_options
* only) uses get() and receives the full value.
* for all logged-in users). Strips backup_s3_credentials/
* backup_gdrive_credentials (contain a secret access key / OAuth client
* secret + refresh token) — the exact "future field that shouldn't be
* broadcast" case this method was originally kept separate from get()
* to handle.
*/
public static function get_safe()
{
$settings = self::get();
unset($settings["license_key"]);
if (isset($settings["remote_sites"]) && is_array($settings["remote_sites"])) {
$settings["remote_sites"] = array_values(array_map(function ($site) {
return [
"url" => isset($site["url"]) ? $site["url"] : "",
"username" => isset($site["username"]) ? $site["username"] : "",
];
}, $settings["remote_sites"]));
}
unset($settings["backup_s3_credentials"], $settings["backup_gdrive_credentials"]);
return $settings;
}
}