hardening 2.4.1: 2meet-data-optimizer 1.4.1 (acceptance review fixes) #10

Merged

wpdev merged 5 commits from hardening/2.4.1 into main 2026-09-28 01:09:15 +08:00

Conversation 0 Commits 5 Files Changed 10

+276 -38

wpdev commented 2026-09-28 00:47:08 +08:00

Owner

Copy Link

Copy Source

2meet-data-optimizer 1.4.1 — fixes from the 2.4 acceptance review (security + correctness)

• PR-130 keep meta_key native when the query still orders by it (multi/array orderby, key name, meta_compare_key); keep a sort group WordPress may use as the primary clause
• PR-131 rewrite only standalone posts.ID tie-breaks in ORDER BY (FIELD()/IN expressions left alone); PCRE failures keep the SQL
• PR-132 drop router query vars a caller passed in; whitelist the copy route direction
• PR-133 new posts' flat rows get status/date copies; post-status-sync bumps the routed count version
• PR-134 1.4.1 notes and version

Verify: unit 704, integration 606 (+9 new), phpcs 0, stan OK; dev36 live 56/56; front end ids/found = native on HP pages.

🤖 Generated with Claude Code

https://claude.ai/code/session_01U9oVDuhVvJnmARBmtue7rt

2meet-data-optimizer 1.4.1 — fixes from the 2.4 acceptance review (security + correctness) - PR-130 keep meta_key native when the query still orders by it (multi/array orderby, key name, meta_compare_key); keep a sort group WordPress may use as the primary clause - PR-131 rewrite only standalone posts.ID tie-breaks in ORDER BY (FIELD()/IN expressions left alone); PCRE failures keep the SQL - PR-132 drop router query vars a caller passed in; whitelist the copy route direction - PR-133 new posts' flat rows get status/date copies; post-status-sync bumps the routed count version - PR-134 1.4.1 notes and version Verify: unit 704, integration 606 (+9 new), phpcs 0, stan OK; dev36 live 56/56; front end ids/found = native on HP pages. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01U9oVDuhVvJnmARBmtue7rt

wpdev added 5 commits 2026-09-28 00:47:09 +08:00

fix(2meet-data-optimizer): keep meta_key native when the query still orders by it ... bed3f906da

- meta_key is routed as EXISTS only when no orderby entry names meta_value,
  meta_value_num or the key (several orderings or an array included);
  clearing it made WordPress drop the price ordering
- A sort group is dropped as unused only when orderby names neither it,
  meta_value(_num) nor its key (it is then the primary clause)
- meta_compare_key other than '=' keeps meta_key native (LIKE matches other keys)
- Found in the 2.4 correctness review (regressions from PR-122)
- Verify: PostQueryRouterTest (3 new), router suites 67 OK
- PR: PR-130

fix(2meet-data-optimizer): rewrite only standalone posts.ID tie-breaks in ORDER BY ... 33addd1e49

- flat_first and the copy route share ties_on_post_id(): a posts.ID term
  alone (optionally with a direction) reads the flat post_id; posts.ID inside
  an expression a plugin added (FIELD(), IN) is left alone — inserting a
  direction there made the SQL invalid and the page empty
- PCRE failures return the text given instead of '' (the query kept its
  shape rather than becoming an empty request)
- Found in the 2.4 correctness review (Medium) and security review (Low L1)
- Verify: 2 new integration tests (the flat-first one runs the SQL), router suites 69 OK
- PR: PR-131

fix(2meet-data-optimizer): drop router query vars a caller passed in ... 80343ec282

- pre_get_posts clears wpdo_post_clauses / _sort / _copy_route / _count_sql
  before anything else: new WP_Query( array( … ) ) could preset them
- posts_orderby whitelists the copy route's direction
- Found in the 2.4 security review (Low L2; not reachable from URLs)
- Verify: PostQueryRouterCopyTest (1 new); integration 604, unit 704, phpcs 0
- PR: PR-132

fix(2meet-data-optimizer): give new posts' flat rows their status/date copies; sync drops cached counts ... 3e96357459

- add_flat_rows (wp_insert_post, after transition_post_status) inserts the
  copies with the empty row: a NULL copy turned the copy route off for the
  whole group until the next sync
- wp tmdo post-status-sync bumps the routed count version (not on dry runs)
- Test bootstrap: minimal WP_Post stub
- Found in the 2.4 correctness review (residual risks)
- Verify: 2 new integration tests; integration 606, unit 704, phpcs 0, stan OK
- PR: PR-133

chore(2meet-data-optimizer): 1.4.1 release notes and version ... 81324903a6

- CHANGELOG / readme: PR-130..133 (2.4 acceptance review fixes)
- Version 1.4.0 -> 1.4.1 (header, TMDO_VERSION, Stable tag)
- PR: PR-134

wpdev merged commit b6200c581c into main 2026-09-28 01:09:15 +08:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

wpdev

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wpdev/2meet-data-optimizer#10