Ticket #46705: safe-option-updates.php

<?php

class safe_option_updates {
        static $nonce_validated = false;
        public static function on_nonce_validated() {
                self::$nonce_validated = true;
        }
        public static function on_option_updates($option) {
                if ( ! in_array($option, ['siteurl']) ) {
                        return;
                }
                if ( defined('WP_INSTALLING') && WP_INSTALLING ) {
                        return;
                }
                if ( ! current_user_can('manage_options') ) {
                        error_log('prevented attempt to alter critical option by unauthorized user');
                        die;
                }
                if ( ! self::$nonce_validated ) {
                        error_log('prevented attempt to alter critical option without nonce validation');
                        die;
                }
        }
}

add_action('update_option', ['safe_option_updates', 'on_option_updates'], 10, 1);
add_action('delete_option', ['safe_option_updates', 'on_option_updates'], 10, 1);
add_action('add_option', ['safe_option_updates', 'on_option_updates'], 10, 1);

add_action('check_admin_referer', ['safe_option_updates', 'on_nonce_validated']);
add_action('check_ajax_referer', ['safe_option_updates', 'on_nonce_validated']);