Tags: nawawi/docket-cache

bump 26.04.10: fix object cache object-injection and related security…

… hardening

- WP_Object_Cache: return cached strings exactly as stored to prevent PHP
  object injection from serialized-looking values, verify stored key/group
  before serving, and add an on-disk format version that migrates pre-update
  cache files on read without a manual flush.
- Admin: nonce-gate the Suspend Object Cache state change, build the config
  notice via a text node with a restricted option key (DOM XSS), validate the
  flush-cache file index against path traversal, and escape cron event output.
- Cronbot: drop captured cron hook output from the ping response, and only
  attach cookies to loopback requests, never the remote endpoint.
- Limit runtime.php to expected on/off/integer values, cache HTTP responses
  only for credential-free GET requests, skip the shared menu cache for
  logged-in users, and store the WP-CLI OPcache secret in a non-web-readable
  file.

bump 26.04.10: fix object cache object-injection and related security…

… hardening

- WP_Object_Cache: return cached strings exactly as stored to prevent PHP
  object injection from serialized-looking values, verify stored key/group
  before serving, and add an on-disk format version that migrates pre-update
  cache files on read without a manual flush.
- Admin: nonce-gate the Suspend Object Cache state change, build the config
  notice via a text node with a restricted option key (DOM XSS), validate the
  flush-cache file index against path traversal, and escape cron event output.
- Cronbot: drop captured cron hook output from the ping response, and only
  attach cookies to loopback requests, never the remote endpoint.
- Limit runtime.php to expected on/off/integer values, cache HTTP responses
  only for credential-free GET requests, skip the shared menu cache for
  logged-in users, and store the WP-CLI OPcache secret in a non-web-readable
  file.

bump 26.04.09: fix transient cleanup SQL injection and verify remote SSL

- Use prepared statements when removing transients from the database.
- Verify the SSL certificate on requests to remote endpoints.
- Escape the Cronbot error message in the admin notice.
- Remove Critical Version Checking and the api.docketcache.com endpoint.
- Show a sponsor notice on the Cronbot page when the service is connected.
- Trim older entries from the readme.txt changelog.

bump 26.04.08: fix Cache Log reset key leak and harden cronbot ping

- Redact query string values in the Cache Log request URI.
- Default Cache Log file name is no longer predictable.
- Remove Cache Log files left under the old name.
- Rejected cronbot ping returns 500 instead of a PHP fatal error.
- Exclude Cookie and Authorization headers from stored ping data.

bump 26.04.07

- Fixed: Polyfill PhpToken stub -> Extend scoped Nawawi\Symfony\Polyfill\Php80\PhpToken.
- Improved: Updated Symfony vendor libraries for PHP 8.4 compatibility.

bump 26.04.06

Security fixes:
- Cache Log: escape output with esc_textarea() to prevent stored XSS via
  poisoned REQUEST_URI log lines (admin/log.php).
- dc_log(): sanitise REQUEST_URI before writing it as the log caller.
- Plugin: add capability check to the cache log (dl) and debug.log (wplog)
  downloads, which ran on the init hook before admin auth and were reachable
  unauthenticated.

update funding

bump 26.04.04

- Added: Configuration UI toggle for WP-CLI OPcache Invalidation (mirrors DOCKET_CACHE_WPCLI_OPCACHE constant).
- Fixed: CliOpcache::notify() -> Buffered per-file notifications at shutdown to prevent HTTP request floods during GC and individual cache unlinks.
- Fixed: CliOpcache -> REST route registered before compat check to eliminate 404 noise when workers bail early under load.
- Fixed: CronAgent::receive_ping() -> Type-safety guard on ping inputs to prevent PHP 8 TypeError from array-form values.
- Fixed: CronAgent::receive_ping() -> Explicit return after close_ping() when CRONBOT is disabled.
- Fixed: CronAgent::receive_ping() -> Multisite loop isolates per-site errors via try/catch; wpcron_error reported so cronbot server detects persistent failures.
- Fixed: CronAgent::run_wpcron() -> Re-entry guard via instance flag and try/finally.
- Fixed: CronAgent::run_wpcron() -> ob_end_clean() on exception path; stop decrementing $run_event below zero.
- Fixed: CronAgent::run_wpcron() -> Pre-init $results and $cron_event to prevent PHP 8 undefined-variable warnings.
- Fixed: CronAgent::run_wpcron() -> REQUEST_URI check uses urldecode() and checks wp_doing_cron() first to avoid URL-encoded bypass.
- Fixed: CronAgent::send_action() -> Cache key includes action to prevent collision between on/off calls from the same IP.
- Improved: CronAgent::send_action() -> $stmp cache-buster refreshes every 5 minutes to avoid CDN staleness in long-running processes.
- Improved: CronAgent::check_connection() -> Skip on AJAX/REST/cron requests to reduce shutdown-hook overhead on high-traffic endpoints.

bump 26.04.03

- Added: CliOpcache — Invalidate web-server OPcache from WP-CLI via REST endpoint
- Added: DOCKET_CACHE_WPCLI_OPCACHE constant to enable/disable CLI OPcache invalidation
- Added: DOCKET_CACHE_CONFIGACTION constant to enable/disable Export/Import settings
- Added: Export/Import settings feature for configuration backup and restore
- Fixed: CliOpcache path traversal protection using realpath() validation
- Fixed: CliOpcache bulk flush suppression to avoid excessive HTTP requests
- Fixed: CliOpcache shared secret initialised during REST route registration
- Fixed: ReqAction flush Object Cache causing 502 nginx error by deferring flush after response
- Fixed: Plugin::get_opcache_status() filter scripts by ABSPATH for shared hosting
- Fixed: Plugin::get_opcache_status() removed unnecessary is_file() stale check
- Fixed: OPcache Viewer escaped output of configuration values to prevent XSS
- Improved: Filesystem::unlink() notify web-server OPcache on individual cache file deletion
- Improved: Filesystem::cachedir_flush() utilise Crawler class for internal HTTP requests
- Improved: Plugin::get_opcache_status() skip building scripts array for overview, cap at 50000
- Improved: Plugin::get_opcache_status() timeout guard for file cache scan on shared hosting
- Improved: OPcacheView removed "All Items" option, replaced with 50000 items cap
- Improved: OPcacheView::get_status() cache result to prevent double scan per page load

bump 24.07.07

- Fixed: _load_textdomain_just_in_time was called incorrectly on WordPress 6.7+.