pharmanext

No, the latest plugin update didn’t completely resolve the issue: see screenshot.

The crux of the problem is this: many posts on the site are evergreen, meaning there’s no point in regenerating the cache for them on a regular basis. In other words, the cache’s lifetime is infinite. This leads to the WPP nonce expiring. If you don’t use AJAX loading to display WPP, popular posts get cached as static content, meaning AJAX is necessary in any case.

My previous code really didn’t work for many reasons.

The solution is as follows. Remove the X-WP-Nonce header from the $_SERVER superglobal array for all REST requests to the wordpress-popular-posts/ namespace. WordPress will then not find the nonce and will not check it. Since the plugin’s endpoints are public (permission_callback => ‘__return_true’), they will work without a 403 error.

Why is this safe? WPP endpoints have permission_callback => ‘__return_true’, and they are public. The nonce is only needed for CSRF protection, which is not critical for public counters and widgets. No other REST endpoints are affected.

Here is the code:

add_action('rest_api_init', function() {
    $request_uri = $_SERVER['REQUEST_URI'] ?? '';
    if (strpos($request_uri, '/wordpress-popular-posts/') !== false) {
        unset($_SERVER['HTTP_X_WP_NONCE']);
  }
}, 1);

add_action('add_attachment', 'fix_meow_all_avif_permissions', 20);

add_filter('wp_generate_attachment_metadata', 'fix_meow_all_avif_permissions_meta', 20, 2);

function fix_meow_all_avif_permissions_meta($metadata, $attachment_id) {

    $upload_dir = wp_upload_dir();

    $base_dir = $upload_dir['basedir'] . '/';

    if (!empty($metadata['file'])) {

        $dir_path = dirname($base_dir . $metadata['file']) . '/';

        // Check AVIF for the original file

        $orig_avif = $base_dir . $metadata['file'] . '.avif';

        if (file_exists($orig_avif)) {

            @chmod($orig_avif, 0644);

        }

        // Check AVIF for the created thumbs

        if (!empty($metadata['sizes'])) {

            foreach ($metadata['sizes'] as $size_info) {

                if (!empty($size_info['file'])) {

                    $thumb_path = $dir_path . $size_info['file'];

                    // Standard AVIF

                    if (file_exists($thumb_path . '.avif')) {

                        @chmod($thumb_path . '.avif', 0644);

                    }

                    // Retina AVIF

                    $ext = pathinfo($size_info['file'], PATHINFO_EXTENSION);

                    $filename = pathinfo($size_info['file'], PATHINFO_FILENAME);

                    $retina_avif = $dir_path . $filename . '@2x.' . $ext . '.avif';

                    if (file_exists($retina_avif)) {

                        @chmod($retina_avif, 0644);

                    }

                }

            }

        }

    }

    return $metadata;

}

function fix_meow_all_avif_permissions($post_id) {

    if (wp_attachment_is_image($post_id)) {

        $file_path = get_attached_file($post_id);

        if ($file_path && file_exists($file_path . '.avif')) {

            @chmod($file_path . '.avif', 0644);

        }

    }

}

For anyone else who has encountered this issue, here is some code that sets the necessary permissions for AVIF files after they are generated.

The issue was in /beautiful-and-responsive-cookie-consent/class/class-nsc_bar_input_validation.php:

[debug.log]

PHP Fatal error:  Cannot redeclare escape_recursive() (previously declared in /beautiful-and-responsive-cookie-consent/class/class-nsc_bar_input_validation.php:414) in /beautiful-and-responsive-cookie-consent/class/class-nsc_bar_input_validation.php on line 414

Cause:

The error occurs because the escape_recursive() function is defined inside the escape_json_content() method. In PHP, nested functions are global – they are declared in the global scope the first time the method runs. If the method is called again, PHP attempts to redeclare the same function, triggering a fatal error.

Original Code:

   public function escape_json_content(string $json_string)

    {

        $decoded_json = json_decode($json_string, true);

        if (json_last_error() !== JSON_ERROR_NONE) {

            return false;

        }

        function escape_recursive($data, $allowedHtml)

        {

            if (is_array($data)) {

                foreach ($data as $key => $value) {

                    if ($key === "message" && is_string($value) === true) {

                        $data[$key] = wp_kses($value, $allowedHtml);

                        continue;

                    }

                    $data[$key] = escape_recursive($value, $allowedHtml);

                }

            } elseif (is_string($data)) {

                $data = stripslashes(esc_js($data));

            }

            return $data;

        }

        $escaped_json = escape_recursive($decoded_json, $this->allowedHtml);

        return json_encode($escaped_json, JSON_UNESCAPED_UNICODE);

    }

New Code:

private function escape_recursive($data, $allowedHtml)

{

    if (is_array($data)) {

        foreach ($data as $key => $value) {

            if ($key === "message" && is_string($value) === true) {

                $data[$key] = wp_kses($value, $allowedHtml);

                continue;

            }

            $data[$key] = $this->escape_recursive($value, $allowedHtml);

        }

    } elseif (is_string($data)) {

        $data = stripslashes(esc_js($data));

    }

    return $data;

}

public function escape_json_content(string $json_string)

{

    $decoded_json = json_decode($json_string, true);

    if (json_last_error() !== JSON_ERROR_NONE) {

        return false;

    }

    $escaped_json = $this->escape_recursive($decoded_json, $this->allowedHtml);

    return json_encode($escaped_json, JSON_UNESCAPED_UNICODE);

}

Dear developers, I am writing to clarify the status of my issue. Please provide a clear answer: has this bug been fixed? It has been FIVE months since I reported it.

To avoid any ambiguity, I hasten to inform you that the incompatibility is observed in its pure form, i.e., only the Twenty-Twenty Five (or Twenty-Twenty Four) theme is active, and only these two plugins.

Благодарю вас за разъяснение логики работы ЮKassa.