Ship 1.6.0: Abilities permission fix, private data storage, HTML API content filters

[wpgaurav]

Closes every finding from the v1.5.0 audit, and is already running on gauravtiwari.org.

Security

Abilities API privilege escalation. One shared permission callback downgraded to edit_post whenever the input carried a post_id, and it guarded all nine abilities. No input schema set additionalProperties, and core only rejects unknown properties when that flag is false. Any user who could edit a single post could toggle modules off, create an external redirect from any path, create tasks, trigger loopback scans, and spend AI credits through /wp-abilities/v1/abilities/functionalities/*/run.

Now: a permission callback per ability, additionalProperties => false on every input schema, and check-content-integrity additionally verifies the post type. Verified against a real contributor account on production — all eight site-wide abilities return ability_invalid_permissions, and that user can still check only their own post.

Web-readable data files. wp-content/functionalities/redirects.json was served publicly at a fixed, guessable URL. Data now lives in a directory named with 20 random characters, created and migrated by Storage\Data_Directory, with .htaccess, web.config, and index.php written at both levels and an async Site Health probe that asks the server whether the folder is actually reachable.

Snippets mangled for visitors. Output ran kses against the viewer's capability, so anonymous readers got && where the author wrote &&, and comparison operators were eaten as tags — while the logged-in administrator saw the snippet work. Filtering now happens once at save time against the author's capability, with an unfiltered flag recorded per snippet.

Also: username throttling, an IP allowlist and an unlock action in Login Security; Prism bundled locally instead of pulled from a CDN; and a service worker that no longer caches wp-admin, the login page, REST responses, cross-origin requests, or anything marked no-store, with a capped runtime cache and per-URL precaching so one stale entry cannot abort install.

Correctness and performance

• A JSON exception preset served from a URL was fetched on every page load with a 10s timeout. It is now cached, and the cache clears whenever a post or page is edited, settings change, or the theme switches, keeping the last good list if a fetch fails.
• Link Management, Block Cleanup, and Schema moved from DOMDocument to WP_HTML_Tag_Processor. Attributes are edited in place, so Vue, Alpine, and mustache syntax survive untouched. The skip guard added in 1.4.3 and 1.4.4 is deleted, and content that used to be skipped entirely is now processed.
• Redirect hits and 404 aggregates are buffered and flushed in batches instead of rewriting the whole JSON file under an exclusive lock on every request.
• Redirects run at parse_request, before the main query, guarded against WordPress's own entry points.
• The bulk nofollow tool pages by ID cursor and can now finish past 100 posts; it previously returned the same first batch forever.
• The Content Integrity list column reads a result cached at save time instead of rendering and DOM-parsing every row on every visit.
• The SVG icon library leaves the autoload set. This needed a real upgrade routine, because update_option() returns early on an unchanged value and never touches the autoload column.
• Content Integrity and Assumption Detection gained the filters their documentation promised; the docs no longer advertise 19 hooks that were never fired.

Release hygiene

• .distignore patterns anchored to the root. An unanchored vendor was also matching assets/vendor/, which would have shipped a zip with Prism missing. build.sh now uses the same exclude list as the release workflow and asserts required runtime files.
• Translation template generated from source: 1,136 strings, previously a single placeholder.
• CI sparse-checks out wordpress-develop so the HTML API tests run rather than skip, diffs the POT file, and asserts the new runtime files ship.
• CLAUDE.md rewritten to the current architecture.

Testing

52 tests, 203 assertions. PHPCS clean, lint clean across PHP 7.4 to 8.5, distribution zip clean at 85 files.

Verified end to end on WordPress 7.0.2 locally and on gauravtiwari.org (WordPress 7.1, PHP 8.5.6, LiteSpeed, Cloudflare, 212 users): the permission model against a real contributor, the storage migration, snippet output for a logged-out visitor, all three content filters on real posts, hit buffering, preset invalidation, and every admin screen.

Two things live deployment caught

1. The migration was gated on module state. Both file-based modules are disabled on gauravtiwari.org, yet a redirects.json from an earlier version was still on disk and still public. Upgrader::has_legacy_data() now migrates whenever legacy files exist, regardless of whether the modules are on. Without this the exposed file would have stayed exposed.
2. .htaccess is inert on that host. Six forms were tested inside the plugin's own data directory — Require all denied, bare Order/Deny, FilesMatch, RedirectMatch 404, and a mod_rewrite forbid — and every one still served the file, because AllowOverride is off for wp-content. The unguessable directory name is therefore the protection that holds, which is why the Site Health check reports recommended rather than critical when a folder is servable.

Known follow-up

To make data files unservable even when the URL is known, each payload would need to sit inside a .php file beginning with <?php exit; ?>. That means a filename change, a read/write guard in Atomic_JSON_Store, and another migration, so it belongs in 1.6.1 with its own test pass rather than being rushed onto a live site.

Upgrade notes

Existing option names, hooks, admin URLs, shortcodes, and stored JSON stay compatible. Data written by earlier versions migrates on the first admin page load. Two intentional behaviour changes: disabling Heartbeat now applies to the front end only unless the new admin option is also enabled, so autosave and post locking keep working; and the revision limit is configurable rather than hard-coded to 10.

🤖 Generated with Claude Code