Skip to content

Record stored addresses in the manifest and refuse subfolder sites - #151

Merged
PDowney merged 2 commits into
mainfrom
manifest-stored-addresses
Nov 8, 2026
Merged

PDowney merged 2 commits into
mainfrom
manifest-stored-addresses

Conversation

@PDowney

@PDowney PDowney commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

The plugin side of EngineScript's scripts audit (EngineScript/EngineScript#302, merged).

  • Stored addresses in the manifest: manifest.txt records the home and siteurl options (WP_HOME and WP_SITEURL when wp-config.php defines them) as home_url and site_url, as EngineScript's own exports do. home_url() and site_url() took the scheme of the admin page and passed through plugin filters. EngineScript's importer reads the site address and table prefix from these lines.
  • Address constant warning removed: the exporter page no longer warns when neither WP_HOME nor WP_SITEURL is defined; the importer reads the address from the manifest.
  • Subfolder sites refused: a site whose Site Address or WordPress Address has a path (/blog, WordPress in /wp) is not exported. EngineScript only hosts sites at the root of their domain, so the page shows an error with both addresses, and an export request gets the same error.

Testing

  • composer check-all passes (230 tests, including the new ManifestTest and SiteLayoutTest cases).
  • Plugin Check's PHPCS rulesets report nothing on includes/export.php.
  • The .pot template is regenerated and valid.

🤖 Generated with Claude Code

manifest.txt now records the home and siteurl options as home_url and
site_url, as EngineScript's own exports do, instead of home_url() and
site_url(), which follow the admin page's scheme and plugin filters.
The warning about missing WP_HOME and WP_SITEURL is removed, since the
importer reads the address from the manifest.

A site whose Site Address or WordPress Address has a path (/blog, or
WordPress in its own /wp folder) is no longer exported: EngineScript
only hosts sites at the root of their domain. The exporter page shows
an error in place of the form, and an export request is refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions github-actions Bot added documentation Improvements or additions to documentation security testing core export i18n labels Nov 8, 2026
@github-actions

github-actions Bot commented Nov 8, 2026

Copy link
Copy Markdown
Contributor

Thanks for contributing to EngineScript Site Exporter!

Before we review:

  • Have you tested your changes with WordPress 7.0+?
  • Are your changes compatible with PHP 8.3+?
  • Have you followed WordPress coding standards?
  • Did you update the CHANGELOG.md if needed?

Security Reminder
This plugin creates site export archives, so please ensure:

  • All user input is properly sanitized
  • All output is properly escaped
  • No security vulnerabilities are introduced

We'll review your PR soon.

@codacy-production

Copy link
Copy Markdown

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 9 complexity · 0 duplication

Metric Results
Complexity 9
Duplication 0

View in Codacy

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

Plugin Check 2.2 refuses "Tested up to" in the plugin header. The
WordPress version check script now tracks readme.txt only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@PDowney
PDowney merged commit 925fa38 into main Nov 8, 2026
27 checks passed
@github-actions
github-actions Bot deleted the manifest-stored-addresses branch November 8, 2026 06:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

core documentation Improvements or additions to documentation export i18n security testing

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant