Fixes

Author: PDowney

CHANGELOG.md

@@ -2,6 +2,31 @@
 
 ## Unreleased
 
+### Critical Bug Fixes
+
+- **Scheduled Deletion Fix**: Fixed critical bug where automatic export file cleanup via WordPress cron was completely broken. The referer validation in `sse_validate_basic_export_file()` was blocking all cron-triggered deletions since scheduled tasks have no HTTP referer. Referer checks are now correctly applied only to user-facing download and deletion handlers.
+- **Deletion Notice Fix**: Fixed bug where success/failure notices after manually deleting an export file were lost due to `add_action('admin_notices')` being registered before `wp_safe_redirect()` + `exit`. Notices are now passed via query parameter and displayed on the redirected page.
+
+### Security & Escaping Fixes
+
+- **Double Escaping Prevention**: Fixed 9 instances of double-escaped WP_Error messages where `esc_html__()` was used in error construction but messages were escaped again with `esc_html()` at output time. Changed to `__()` in WP_Error constructors since escaping belongs at the output boundary.
+- **Admin Menu Escaping**: Removed redundant `esc_html__()` in `sse_admin_menu()` — WordPress core already escapes page and menu titles internally.
+- **Submit Button Escaping**: Removed redundant `esc_html__()` in `submit_button()` call — the function internally applies `esc_attr()` to button text.
+- **Database Export Error**: Removed pre-escaping of WP-CLI error output in `sse_export_database()` WP_Error to prevent double escaping when displayed via `sse_show_error_notice()`.
+- **Symlink Compatibility**: Removed overly strict `realpath()` equality check in `sse_validate_download_file_access()` that could block valid downloads on servers with symlinked upload directories. Directory containment validation already provides equivalent security.
+
+### Performance Improvements
+
+- **File Size Filter Caching**: Cached the `sse_max_file_size_for_export` filter result using a static variable in `sse_should_exclude_file()` to avoid redundant `get_transient()`, `get_current_user_id()`, and `apply_filters()` calls for every file during export.
+- **Error Log Autoload**: Added `false` autoload parameter to `update_option()` in `sse_store_log_in_database()` to prevent debug logs from being loaded into memory on every WordPress page request.
+
+### Code Quality
+
+- **Dead Code Removal**: Removed unused `sse_get_scheduled_deletions()` debugging function that was never called from any code path.
+- **Shell Safety**: Added `function_exists('shell_exec')` check in `sse_get_safe_wp_cli_path()` before attempting PATH lookup, preventing PHP warnings when `shell_exec` is disabled.
+- **POT File Cleanup**: Removed 6 stale translation entries referencing functions that no longer exist. Added missing translatable strings for file size options, error messages, and WP-CLI status messages.
+- **GEMINI.md**: Updated version reference from 1.8.4 to 1.9.1.
+
 ## 1.9.1 - September 29, 2025
 
 ### Scheduled Deletion System Enhancements

GEMINI.md

@@ -7,7 +7,7 @@ This is a secure WordPress site export plugin that creates complete site backups
 ## Plugin Details
 
 - **Name:** Simple WP Site Exporter
-- **Version:** 1.8.4
+- **Version:** 1.9.1
 - **WordPress Compatibility:** 6.5+
 - **PHP Compatibility:** 7.4+
 - **License:** GPL-3.0-or-later

languages/simple-wp-site-exporter.pot

@@ -216,30 +216,74 @@ msgstr ""
 msgid "File not found."
 msgstr ""
 
-#: simple-wp-site-exporter.php:1628
+#: simple-wp-site-exporter.php
 msgid "Unable to serve file download."
 msgstr ""
 
-#: simple-wp-site-exporter.php:1671
-msgid "WP-CLI not found on this server."
+#: simple-wp-site-exporter.php
+msgid "WP-CLI executable not found. Please ensure it is installed and in your server's PATH."
 msgstr ""
 
-#: simple-wp-site-exporter.php:1675
-msgid "WP-CLI path is not absolute."
+#: simple-wp-site-exporter.php
+msgid "shell_exec function is disabled on this server."
+msgstr ""
+
+#: simple-wp-site-exporter.php
+msgid "An export process is already running. Please wait for it to complete before starting a new one."
+msgstr ""
+
+#: simple-wp-site-exporter.php
+msgid "Could not create the export directory. Please verify filesystem permissions."
+msgstr ""
+
+#: simple-wp-site-exporter.php
+msgid "The export directory is not writable. Please adjust filesystem permissions."
+msgstr ""
+
+#: simple-wp-site-exporter.php
+msgid "Could not determine the WordPress upload directory or URL."
+msgstr ""
+
+#: simple-wp-site-exporter.php
+msgid "ZipArchive class is not available on your server. Cannot create zip file."
+msgstr ""
+
+#: simple-wp-site-exporter.php
+msgid "Failed to add database file to zip archive."
+msgstr ""
+
+#: simple-wp-site-exporter.php
+msgid "Failed to finalize or save the zip archive after processing files."
+msgstr ""
+
+#: simple-wp-site-exporter.php
+msgid "Maximum File Size"
 msgstr ""
 
-#: simple-wp-site-exporter.php:1687
-msgid "Suspicious characters detected in WP-CLI path."
+#: simple-wp-site-exporter.php
+msgid "No limit (include all files)"
 msgstr ""
 
-#: simple-wp-site-exporter.php:1692
-msgid "WP-CLI executable not found at detected path."
+#: simple-wp-site-exporter.php
+msgid "100 MB"
 msgstr ""
 
-#: simple-wp-site-exporter.php:1696
-msgid "WP-CLI file is not executable."
+#: simple-wp-site-exporter.php
+msgid "500 MB"
 msgstr ""
 
-#: simple-wp-site-exporter.php:1710
-msgid "Detected file is not a valid WP-CLI executable."
+#: simple-wp-site-exporter.php
+msgid "1 GB"
+msgstr ""
+
+#: simple-wp-site-exporter.php
+msgid "Files larger than this size will be excluded from the export. Choose \"No limit\" to include all files regardless of size."
+msgstr ""
+
+#: simple-wp-site-exporter.php
+msgid "Invalid file size."
+msgstr ""
+
+#: simple-wp-site-exporter.php
+msgid "Invalid request source."
 msgstr ""

readme.txt

@@ -90,6 +90,16 @@ along with this program.  If not, see <https://www.gnu.org/licenses/>.
 == Changelog ==
 
 = Unreleased =
+* **Critical Fix**: Fixed bug where automatic export file cleanup via WordPress cron was completely broken due to referer validation blocking cron-triggered deletions
+* **Critical Fix**: Fixed deletion success/failure notices being lost after redirect
+* **Security**: Fixed 9 instances of double-escaped WP_Error messages that could display garbled text to users
+* **Security**: Removed redundant double escaping in admin menu titles and submit button
+* **Security**: Removed overly strict realpath equality check that blocked downloads on servers with symlinked uploads
+* **Performance**: Cached file size filter result to avoid redundant lookups per file during export
+* **Performance**: Prevented debug error logs from autoloading on every WordPress page request
+* **Code Quality**: Removed unused `sse_get_scheduled_deletions()` dead code
+* **Code Quality**: Added `shell_exec` availability check in WP-CLI PATH lookup
+* **i18n**: Cleaned up stale .pot entries and added missing translatable strings
 
 = 1.9.1 =
 * **Scheduled Deletion System Enhancements**: Implemented comprehensive dual cleanup system with both individual file cleanup (5 minutes) and bulk directory cleanup (10 minutes) as safety net