Changeset 3753699 for yuracode-security/trunk/src/Admin/SettingsPage.php

Timestamp:

10/18/2026 11:12:11 PM (10 hours ago)

Author:

yuracode

Message:

Release YuraCode Security 1.0.6

File:

• yuracode-security/trunk/src/Admin/SettingsPage.php (modified) (10 diffs)

yuracode-security/trunk/src/Admin/SettingsPage.php

@@ -10 +10 @@
         const OPTION_GROUP = 'yuracode-security_settings_group';
         const PAGE = 'yuracode-security';
+
+        // Placeholder tab on subsites of a multisite network: the firewall is
+        // network-managed, so its real sections collapse into this read-only one.
+        const NETWORK_FIREWALL_SECTION = 'yuracode-security_network_firewall';
 
         public static function init() {
@@ -62 +66 @@
                 $defaults = Plugin::defaults();
                 $input = is_array($input) ? $input : array();
+                $manages_file = HtaccessManager::current_site_manages_file();
                 $out = array();
 
                 foreach (Schema::fields() as $field) {
                         list($section, $key, $label, $type, $args) = $field;
+
+                        // The firewall is network-managed on multisite: subsites don't
+                        // render its fields, so its keys are dropped here, exactly like
+                        // Pro keys after a license lapse.
+                        if (!$manages_file && self::is_firewall_section($section)) {
+                                continue;
+                        }
 
                         $path = explode('.', $args['path']);
@@ -92 +104 @@
 
         public static function htaccess_notice() {
-                if (!self::on_settings_page()) {
+                if (!self::on_settings_page() || !HtaccessManager::current_site_manages_file()) {
                         return;
                 }
@@ -112 +124 @@
 
         public static function htaccess_server_notice() {
-                if (!self::on_settings_page()) {
+                if (!self::on_settings_page() || !HtaccessManager::current_site_manages_file()) {
                         return;
                 }
@@ -147 +159 @@
          */
         public static function rewrite_block_notice() {
-                if (!self::on_settings_page() || !current_user_can('manage_options')) {
+                if (
+                        !self::on_settings_page()
+                        || !current_user_can('manage_options')
+                        || !HtaccessManager::current_site_manages_file()
+                ) {
                         return;
                 }
@@ -175 +191 @@
                 // Direct links to a tab (?ycs_tab=<id>) only activate known schema
                 // sections or extra tabs; anything else falls back to the first tab.
-                $known_tabs = array_merge(array_keys(Schema::sections()), array_keys($extra_tabs));
+                $known_tabs = array_merge(array_keys(self::visible_sections()), array_keys($extra_tabs));
 
                 if (!in_array($active_tab, $known_tabs, true)) {
@@ -211 +227 @@
                 $first = true;
 
-                foreach (Schema::sections() as $id => $section): ?>
+                foreach (self::visible_sections() as $id => $section): ?>
                         <button
                                 type="button"
@@ -248 +264 @@
                 $first = true;
 
-                foreach (Schema::sections() as $id => $section): ?>
+                foreach (self::visible_sections() as $id => $section): ?>
                         <div
                                 id="panel-<?php echo esc_attr($id); ?>"
@@ -263 +279 @@
                                         </div>
                                         <div class="ycs-fields">
-                                                <?php FieldRenderer::render_fields($id); ?>
+                                                <?php
+
+                                                if (self::NETWORK_FIREWALL_SECTION === $id) {
+                                                        echo
+                                                                '<p class="description">'
+                                                                        . esc_html__(
+                                                                                'The firewall rules live in the one .htaccess file in the WordPress root that every site on this network shares, so they are configured on the main site. Open Settings > YuraCode Security there. The hardening and login-protection settings on this page apply to this site only.',
+                                                                                'yuracode-security',
+                                                                        )
+                                                                        . '</p>';
+                                                } else {
+                                                        FieldRenderer::render_fields($id);
+                                                }
+                                                ?>
                                         </div>
                                 </div>
@@ -295 +324 @@
         }
 
+        private static function visible_sections() {
+                return self::sections_for_context(Schema::sections(), HtaccessManager::current_site_manages_file());
+        }
+
+        /**
+         * Sections as the current context shows them; pure, so the multisite
+         * branch stays testable on a single-site install.
+         *
+         * On a subsite of a multisite network the firewall sections collapse
+         * into a single read-only tab: the rules live in the one .htaccess the
+         * network shares and are managed on the main site.
+         *
+         * @param array $sections     Schema sections, id => section.
+         * @param bool  $site_manages Whether the current site writes the .htaccess.
+         */
+        public static function sections_for_context($sections, $site_manages) {
+                if ($site_manages) {
+                        return $sections;
+                }
+
+                $out = array();
+
+                foreach ((array) $sections as $id => $section) {
+                        if (self::is_firewall_section($id)) {
+                                continue;
+                        }
+
+                        $out[$id] = $section;
+                }
+
+                $out[self::NETWORK_FIREWALL_SECTION] = array(
+                        'title' => __('Firewall', 'yuracode-security'),
+                        'desc' => __(
+                                'The firewall protects the entire network and is managed on the main site.',
+                                'yuracode-security',
+                        ),
+                );
+
+                return $out;
+        }
+
+        /**
+         * Whether a schema section belongs to the network-managed firewall.
+         *
+         * Add-ons registering firewall sections reuse the `yuracode-security_firewall*`
+         * prefix, so they collapse on subsites too.
+         */
+        private static function is_firewall_section($id) {
+                return str_starts_with((string) $id, 'yuracode-security_firewall');
+        }
+
         private static function schema_tab_active($id, $active_tab, $first) {
                 // No tab selected (or an unknown/extra tab): the first schema tab wins.