Skip to content

Commit adb80cf

Browse files
svfcodesvfcode
authored
Fix. Settings. Improve psc detect in plugins list. (#720)
* Fix. Settings. Improve psc detect in plugins list. * fix cp
1 parent 61f9b06 commit adb80cf

3 files changed

Lines changed: 112 additions & 7 deletions

File tree

‎inc/spbc-admin.php‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -298,12 +298,15 @@ function spbc_plugin_list_show_vulnerability($plugin_file, $plugin_data, $_statu
298298
$do_show = (
299299
isset($spbc->settings['vulnerability_check__enable_cron'], $spbc->settings['vulnerability_check__warn_on_modules_pages']) &&
300300
$spbc->settings['vulnerability_check__enable_cron'] == true &&
301-
$spbc->settings['vulnerability_check__warn_on_modules_pages'] == true &&
302-
isset($plugin_data['slug']) // Only plugins which have slug (from wordpress catalog) need to check
301+
$spbc->settings['vulnerability_check__warn_on_modules_pages'] == true
303302
);
304303

305304
if ($do_show) {
306-
$plugin_slug = isset($plugin_data['slug']) ? $plugin_data['slug'] : sanitize_title($plugin_data['Name']);
305+
// WP.org slug is often missing here (custom Plugin URI). Fall back to folder/textdomain.
306+
$plugin_slug = VulnerabilityAlarm::getPluginSlug($plugin_data, $plugin_file);
307+
if ( $plugin_slug === '' ) {
308+
return;
309+
}
307310
$plugin_version = ! empty($plugin_data['Version']) ? $plugin_data['Version'] : '';
308311
$plugin_report = VulnerabilityAlarm::checkPluginVulnerabilityStatic($plugin_slug, $plugin_version);
309312
if ( $plugin_report instanceof \CleantalkSP\SpbctWP\VulnerabilityAlarm\Dto\PluginReport ) {

‎lib/CleantalkSP/SpbctWP/VulnerabilityAlarm/VulnerabilityAlarm.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -118,8 +118,8 @@ public static function getSafePlugins($plugins, $refresh_static_data_before = tr
118118
if ( $refresh_static_data_before ) {
119119
$plugins_to_cloud = [];
120120
// Prepare data to the cloud call
121-
foreach ( $plugins as $plugin ) {
122-
$verified_slug = static::getPluginSlug($plugin);
121+
foreach ( $plugins as $plugin_file => $plugin ) {
122+
$verified_slug = static::getPluginSlug($plugin, is_string($plugin_file) ? $plugin_file : '');
123123
if ( !empty($verified_slug) ) {
124124
$plugin_name = is_array($plugin)
125125
? (isset($plugin['name']) ? $plugin['name'] : (isset($plugin['Name']) ? $plugin['Name'] : $verified_slug))
@@ -155,8 +155,8 @@ public static function getSafePlugins($plugins, $refresh_static_data_before = tr
155155

156156
static::$plugins = $plugins_reports_to_use;
157157

158-
foreach ( $plugins as $plugin ) {
159-
$verified_slug = static::getPluginSlug($plugin);
158+
foreach ( $plugins as $plugin_file => $plugin ) {
159+
$verified_slug = static::getPluginSlug($plugin, is_string($plugin_file) ? $plugin_file : '');
160160
$verified_version = static::getPluginVersion($plugin);
161161

162162
if ( empty($verified_slug) ) {

‎tests/lib/CleantalkSP/VulnerabilityAlarm/VulnerabilityAlarmTest.php‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
<?php
2+
3+
use CleantalkSP\SpbctWP\VulnerabilityAlarm\Dto\ApiResults;
4+
use CleantalkSP\SpbctWP\VulnerabilityAlarm\Dto\PluginReport;
5+
use CleantalkSP\SpbctWP\VulnerabilityAlarm\VulnerabilityAlarm;
6+
use CleantalkSP\SpbctWP\VulnerabilityAlarm\VulnerabilityAlarmService;
7+
8+
class VulnerabilityAlarmTest extends SpbcTestCase
9+
{
10+
protected function setUp(): void
11+
{
12+
parent::setUp();
13+
delete_option(VulnerabilityAlarm::VULNERABILITY_LIST);
14+
}
15+
16+
protected function tearDown(): void
17+
{
18+
delete_option(VulnerabilityAlarm::VULNERABILITY_LIST);
19+
parent::tearDown();
20+
}
21+
22+
/**
23+
* ASE-like headers: no wordpress.org slug on the plugins list, custom Plugin URI.
24+
*
25+
* @return array<string, string>
26+
*/
27+
private function getAsePluginData()
28+
{
29+
return [
30+
'Name' => 'Admin and Site Enhancements (ASE)',
31+
'PluginURI' => 'https://www.wpase.com/plugin-uri',
32+
'Version' => '8.8.3',
33+
'Description' => 'Easily enable enhancements.',
34+
'Author' => 'wpase.com',
35+
'TextDomain' => 'admin-site-enhancements',
36+
];
37+
}
38+
39+
/**
40+
* @test
41+
*/
42+
public function testGetPluginSlugUsesFolderWhenWordpressOrgSlugIsMissing()
43+
{
44+
$plugin_file = 'admin-site-enhancements/admin-site-enhancements.php';
45+
46+
$this->assertSame(
47+
'admin-site-enhancements',
48+
VulnerabilityAlarm::getPluginSlug($this->getAsePluginData(), $plugin_file)
49+
);
50+
}
51+
52+
/**
53+
* @test
54+
*/
55+
public function testGetPluginSlugDoesNotUseSanitizedPluginName()
56+
{
57+
$plugin_file = 'admin-site-enhancements/admin-site-enhancements.php';
58+
$slug = VulnerabilityAlarm::getPluginSlug($this->getAsePluginData(), $plugin_file);
59+
60+
$this->assertNotSame(sanitize_title('Admin and Site Enhancements (ASE)'), $slug);
61+
$this->assertSame('admin-site-enhancements', $slug);
62+
}
63+
64+
/**
65+
* @test
66+
*/
67+
public function testCheckPluginVulnerabilityStaticMatchesFolderSlugWithoutWpOrgSlug()
68+
{
69+
$report = new PluginReport();
70+
$report->id = '19615';
71+
$report->slug = 'admin-site-enhancements';
72+
$report->app_status = 'vulnerable';
73+
$report->CVE = 'CVE-2026-19615';
74+
$report->rs_app_version_max = '9.0.1';
75+
76+
$list = new ApiResults();
77+
$list->plugins = [$report];
78+
update_option(VulnerabilityAlarm::VULNERABILITY_LIST, $list, false);
79+
80+
$plugin_file = 'admin-site-enhancements/admin-site-enhancements.php';
81+
$plugin_data = $this->getAsePluginData();
82+
$slug = VulnerabilityAlarm::getPluginSlug($plugin_data, $plugin_file);
83+
$found = VulnerabilityAlarm::checkPluginVulnerabilityStatic($slug, $plugin_data['Version']);
84+
85+
$this->assertInstanceOf(PluginReport::class, $found);
86+
$this->assertSame('admin-site-enhancements', $found->slug);
87+
$this->assertSame('CVE-2026-19615', $found->CVE);
88+
}
89+
90+
/**
91+
* @test
92+
*/
93+
public function testIsModuleVersionMatchesReportDetectsVulnerableVersion()
94+
{
95+
$report = new PluginReport();
96+
$report->rs_app_version_max = '9.0.1';
97+
98+
$this->assertTrue(VulnerabilityAlarmService::isModuleVersionMatchesReport($report, '8.8.3'));
99+
$this->assertFalse(VulnerabilityAlarmService::isModuleVersionMatchesReport($report, '9.0.1'));
100+
$this->assertFalse(VulnerabilityAlarmService::isModuleVersionMatchesReport($report, '9.0.2'));
101+
}
102+
}

0 commit comments

Comments
 (0)