Changeset 3767752 for softminal-cache/trunk/app/Cache/Config.php

Timestamp:

10/27/2026 04:42:52 AM (30 hours ago)

Author:

softminal

Message:

Release 1.1.1: multisite security fixes for the CDN address and the shared Cloudflare token

File:

• softminal-cache/trunk/app/Cache/Config.php (modified) (3 diffs)

softminal-cache/trunk/app/Cache/Config.php

@@ -3 +3 @@
 namespace SoftminalCache\App\Cache;
 
+use SoftminalCache\App\Modules\Cdn;
 use SoftminalCache\App\Core\Compat;
 use SoftminalCache\App\Core\Modules;
@@ -243 +244 @@
             $merged['modules'] = Modules::sanitize($input['modules'], $before['modules']);
         }
-        $settings = self::sanitize($merged);
+        $settings = self::keepCdnUrls($before, self::sanitize($merged));
         update_option(self::OPTION, $settings);
         Snapshots::record($before, $settings, $label);
@@ -262 +263 @@
     {
         $before   = self::get();
-        $settings = self::sanitize($settings);
+        $settings = self::keepCdnUrls($before, self::sanitize($settings));
         update_option(self::OPTION, $settings);
         Assets::sync($before, $settings);
         self::writeRuntime();
         ServerRules::sync($settings);
+
+        return $settings;
+    }
+
+    /**
+     * The CDN addresses stay as they were when the current user may not change them (see
+     * Cdn::mayChangeUrls()), whichever way the change came: the screen, a profile, an import, Undo.
+     *
+     * @param Settings $before
+     * @param Settings $settings
+     * @return Settings
+     */
+    private static function keepCdnUrls(array $before, array $settings): array
+    {
+        if (!Cdn::mayChangeUrls()) {
+            $settings['modules']['cdn']['urls'] = $before['modules']['cdn']['urls'] ?? [];
+        }
 
         return $settings;