Updates

Author: PDowney

.github/copilot-instructions.md

@@ -35,10 +35,8 @@ You must read files completely and thoroughly, with a minimum of 1500 lines per
 - Follow WordPress theme and plugin development guidelines.
 - Use WordPress REST API for custom endpoints and data retrieval.
 - Ensure all code is compatible with the WordPress ecosystem, including themes and plugins.
-- As this is a WordPress-focused project, avoid using frameworks or libraries that are not compatible with WordPress.
-- Do not use frameworks or libraries that are not commonly used in the WordPress ecosystem.
+- As this is a WordPress-focused project, avoid using frameworks or libraries that are not compatible or commonly used with WordPress.
 - Avoid using non-standard or experimental features that are not widely adopted in the WordPress community.
-- For any project that utilizes WooCommerce, ensure minimum version compatibility with WooCommerce 5.0+.
 
 ## WordPress Coding Standards
 
@@ -63,7 +61,7 @@ You must read files completely and thoroughly, with a minimum of 1500 lines per
   - WordPress 6.5+ (minimum)
   - PHP 7.4+ (minimum)
   - WooCommerce 5.0+ (if applicable)
-- Do not use features or functions that are not available in these versions.
+- Do not use features or functions that are deprecated or not available in these versions.
 
 ## Version Control and Documentation
 
@@ -86,8 +84,8 @@ You must read files completely and thoroughly, with a minimum of 1500 lines per
 - Note: changelog.txt has been removed from this project. Only maintain readme.txt (for WordPress.org) and CHANGELOG.md (for developers).
 - Please do not skip these locations, as the changelog files must be in sync with each other, and the version numbers must be consistent across all files.
 - I will instruct you when to update the version number, and you should not do this automatically. Always ask for confirmation before updating the version number.
-- When the version number is updated, ensure that the new version number is reflected in all relevant files, including the plugin header, changelog files, and documentation files.
-- WHen the version number is updated, make special note to update the "Unreleased" section in the changelog files to reflect the new version number and a brief description of the changes made. This ensures that all changes are documented and easily accessible for future reference.
+- When the version number is updated, ensure that the new version number is reflected in all relevant files, as outlined in Version Locations above.
+- When the version number is updated, make special note to update the "Unreleased" section in the changelog files to reflect the new version number and a brief description of the changes made. This ensures that all changes are documented and easily accessible for future reference.
 
 # General Coding Standards
 
@@ -132,7 +130,7 @@ You must read files completely and thoroughly, with a minimum of 1500 lines per
 - If you encounter a security vulnerability in the codebase, do not disclose it publicly. Instead, report it privately to the project maintainers or through a responsible disclosure process.
 - If you are unsure about the security implications of a specific code change, ask for clarification or guidance before proceeding.
 - Always follow the principle of least privilege when implementing security features, ensuring that users and processes have only the permissions they need to perform their tasks.
-- If you encounter a security vulnerability in a third-party library or dependency, check if there is an updated version that addresses the issue. If not, consider alternatives or report the vulnerability to the library maintainers.
+- If you encounter a security vulnerability in a third-party library or dependency, check if there is an updated version that addresses the issue. If not, consider alternatives and notify me of the situation.
 - If there is a possible security vulnerability in the codebase, you should always ask for confirmation before proceeding with any changes. This ensures that the project maintainers are aware of the potential risk and can provide guidance on how to address it safely.
 - If I ask you to make changes that could potentially introduce security vulnerabilities, you should always ask for confirmation before proceeding. This ensures that the project maintainers are aware of the potential risk and can provide guidance on how to address it safely.
 
@@ -150,7 +148,6 @@ You must read files completely and thoroughly, with a minimum of 1500 lines per
 - Only ask for confirmation when an action is destructive (e.g., data loss, deletion)
 - Always attempt to identify and fix bugs automatically
 - Only ask for manual intervention if domain-specific knowledge is required
-- Auto-generate missing files, boilerplate, and tests when possible
 - Auto-lint and format code using standard tools (e.g., Prettier, ESLint, dotnet format)
 - Changes should be made directly to the file in question. Example: admin.php should be modified directly, not by creating a new file like admin-changes.php.
 - New files may be created when appropriate, but they should be relevant to the task at hand, so long as they are not a rewrite of an existing file. We want to avoid unnecessary duplication of files.

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog for Simple WP Site Exporter
 
+## Unreleased
+
+### Security Fix
+- **Critical Security Fix**: Resolved a fatal error caused by a missing `sse_get_safe_wp_cli_path()` function. This function is essential for securely locating the WP-CLI executable, and its absence prevented the database export process from running. The new function ensures that the plugin can reliably find WP-CLI in common locations, allowing the export to proceed as intended.
+
 ## 1.8.1 - July 11, 2025
 ### Documentation Workflow Updates
 - **Version Control**: Removed `changelog.txt` file to streamline documentation; maintaining only `readme.txt` (WordPress.org) and `CHANGELOG.md` (for developers).

readme.txt

@@ -3,7 +3,7 @@ Contributors: enginescript
 Tags: backup, export, migration, site export, database export
 Requires at least: 6.5
 Tested up to: 6.8
-Stable tag: 1.8.1
+Stable tag: 1.8.2
 Requires PHP: 7.4
 License: GPLv3 or later
 License URI: https://www.gnu.org/licenses/gpl-3.0.html
@@ -89,6 +89,9 @@ along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 == Changelog ==
 
+= 1.8.2 =
+* **Critical Security Fix**: Resolved a fatal error caused by a missing `sse_get_safe_wp_cli_path()` function. This function is essential for securely locating the WP-CLI executable, and its absence prevented the database export process from running. The new function ensures that the plugin can reliably find WP-CLI in common locations, allowing the export to proceed as intended.
+
 = Unreleased =
 * **Documentation Workflow**: Removed changelog.txt file to streamline documentation process
 * **Version Control**: Maintaining only readme.txt (WordPress.org) and CHANGELOG.md (developers) for changelog management

simple-wp-site-exporter.php

@@ -2,7 +2,7 @@
 /**
  * Plugin Name: Simple WP Site Exporter
  * Description: Exports the site files and database as a zip archive.
- * Version: 1.8.1
+ * Version: 1.8.2
  * Author: EngineScript
  * License: GPL v3 or later
  * Text Domain: Simple-WP-Site-Exporter
@@ -17,7 +17,7 @@
 
 // Define plugin version.
 if ( ! defined( 'ES_WP_SITE_EXPORTER_VERSION' ) ) {
-    define( 'ES_WP_SITE_EXPORTER_VERSION', '1.8.1' );
+    define( 'ES_WP_SITE_EXPORTER_VERSION', '1.8.2' );
 }
 
 /**
@@ -391,6 +391,38 @@ function sse_create_index_file( $export_dir ) {
     sse_log('Failed to write index.php file or directory not writable: ' . $export_dir, 'error');
 }
 
+/**
+ * Finds a safe path to the WP-CLI executable.
+ *
+ * @return string|WP_Error The path to WP-CLI on success, or a WP_Error on failure.
+ */
+function sse_get_safe_wp_cli_path() {
+    // Check for WP-CLI in common paths.
+    $common_paths = array(
+        ABSPATH . 'wp-cli.phar',
+        dirname( ABSPATH ) . '/wp-cli.phar',
+        '/usr/local/bin/wp',
+        '/usr/bin/wp',
+    );
+
+    foreach ( $common_paths as $path ) {
+        if ( is_executable( $path ) ) {
+            return $path;
+        }
+    }
+
+    // Check if 'wp' is in the system's PATH.
+    // Use 'where' for Windows and 'command -v' for Unix-like systems.
+    $command = ( strtoupper( substr( PHP_OS, 0, 3 ) ) === 'WIN' ) ? 'where wp' : 'command -v wp';
+    $path    = shell_exec( $command ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.system_calls_shell_exec -- Safe command to find executable.
+
+    if ( ! empty( $path ) ) {
+        return trim( $path );
+    }
+
+    return new WP_Error( 'wp_cli_not_found', __( 'WP-CLI executable not found. Please ensure it is installed and in your server\'s PATH.', 'Simple-WP-Site-Exporter' ) );
+}
+
 /**
  * Exports the database and returns file information.
  *
@@ -998,7 +1030,7 @@ function sse_sanitize_filename( $filename ) {
  * 
  * @param string|false $real_file_path The real file path or false if resolution failed.
  * @param string $real_base_dir The real base directory path.
- * @return bool True if file is within base directory, false otherwise.
+ * @return bool True if the file is within the base directory, false otherwise.
  */
 function sse_check_path_within_base( $real_file_path, $real_base_dir ) {
     // Ensure both paths are available for comparison
@@ -1518,91 +1550,4 @@ function sse_serve_file_download( $fileData ) {
 
     // Output file content
     sse_output_file_content( $sanitizedData['filepath'], $sanitizedData['filename'] );
-}
-
-/**
- * Safely get and validate WP-CLI path with enhanced security checks.
- *
- * @return string|WP_Error WP-CLI path on success, WP_Error on failure.
- */
-function sse_get_safe_wp_cli_path() {
-    // First try to get WP-CLI path
-    $wp_cli_path = trim( shell_exec( 'which wp 2>/dev/null' ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.system_calls_shell_exec -- Required for WP-CLI path discovery: uses system 'which' command with constant parameters
-    
-    $basic_validation = sse_validate_wp_cli_path($wp_cli_path);
-    if (is_wp_error($basic_validation)) {
-        return $basic_validation;
-    }
-    
-    $security_check = sse_validate_wp_cli_security($wp_cli_path);
-    if (is_wp_error($security_check)) {
-        return $security_check;
-    }
-    
-    $binary_verification = sse_verify_wp_cli_binary($wp_cli_path);
-    if (is_wp_error($binary_verification)) {
-        return $binary_verification;
-    }
-    
-    return $wp_cli_path;
-}
-
-/**
- * Validates basic WP-CLI path format.
- *
- * @param string $wp_cli_path The WP-CLI path to validate.
- * @return true|WP_Error True on success, WP_Error on failure.
- */
-function sse_validate_wp_cli_path($wp_cli_path) {
-    if ( empty( $wp_cli_path ) ) {
-        return new WP_Error( 'wp_cli_not_found', __( 'WP-CLI not found on this server.', 'Simple-WP-Site-Exporter' ) );
-    }
-    
-    // Validate path format (must be absolute path)
-    if ( strpos( $wp_cli_path, '/' ) !== 0 && strpos( $wp_cli_path, '\\' ) !== 0 ) {
-        return new WP_Error( 'wp_cli_not_absolute', __( 'WP-CLI path is not absolute.', 'Simple-WP-Site-Exporter' ) );
-    }
-    
-    return true;
-}
-
-/**
- * Validates WP-CLI path for security issues.
- *
- * @param string $wp_cli_path The WP-CLI path to validate.
- * @return true|WP_Error True on success, WP_Error on failure.
- */
-function sse_validate_wp_cli_security($wp_cli_path) {
-    // Check if path looks suspicious (basic security check)
-    if ( strpos( $wp_cli_path, ';' ) !== false || strpos( $wp_cli_path, '|' ) !== false || 
-         strpos( $wp_cli_path, '&' ) !== false || strpos( $wp_cli_path, '$' ) !== false ) {
-        return new WP_Error( 'wp_cli_suspicious', __( 'Suspicious characters detected in WP-CLI path.', 'Simple-WP-Site-Exporter' ) );
-    }
-    
-    // Check if file exists and is executable
-    if ( ! file_exists( $wp_cli_path ) ) {
-        return new WP_Error( 'wp_cli_not_exists', __( 'WP-CLI executable not found at detected path.', 'Simple-WP-Site-Exporter' ) );
-    }
-    
-    if ( ! is_executable( $wp_cli_path ) ) {
-        return new WP_Error( 'wp_cli_not_executable', __( 'WP-CLI file is not executable.', 'Simple-WP-Site-Exporter' ) );
-    }
-    
-    return true;
-}
-
-/**
- * Verifies that the binary is actually WP-CLI.
- *
- * @param string $wp_cli_path The WP-CLI path to verify.
- * @return true|WP_Error True on success, WP_Error on failure.
- */
-function sse_verify_wp_cli_binary($wp_cli_path) {
-    // Additional security: verify it's actually WP-CLI by running --version
-    $version_check = shell_exec( escapeshellarg( $wp_cli_path ) . ' --version 2>/dev/null' ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.system_calls_shell_exec -- Required for WP-CLI binary verification: path is validated and escaped with escapeshellarg()
-    if ( empty( $version_check ) || strpos( $version_check, 'WP-CLI' ) === false ) {
-        return new WP_Error( 'wp_cli_invalid_binary', __( 'Detected file is not a valid WP-CLI executable.', 'Simple-WP-Site-Exporter' ) );
-    }
-    
-    return true;
 }