Changeset 64337 for trunk/src/wp-includes/load.php

Timestamp:

10/13/2026 07:54:18 PM (7 hours ago)

Author:

whyisjake

Message:

Security: Introduce the Secrets API.

Credentials such as API keys and tokens are usually stored as plaintext options, so anyone with a database dump or backup can read them. The Secrets API gives plugins and core a place to store them encrypted instead, using wp_set_secret(), wp_get_secret(), wp_delete_secret() and related functions. Each secret keeps its previous version, so a credential can be rotated without breaking the code that reads it.

By default, secrets are encrypted with libsodium and stored in the options table. The encryption key never goes in the database: it comes from a WP_SECRETS_KEY constant in wp-config.php, or is derived from the LOGGED_IN_KEY and LOGGED_IN_SALT constants when that is not defined.

Hosts can use a different method by adding a wp-content/secrets.php drop-in, which loads just before must-use plugins, in the same way object-cache.php replaces the object cache. A drop-in can hand all storage to an external secrets manager, or replace only where secrets are stored or only where the encryption key comes from, such as a key management service. If a drop-in is broken, every Secrets API call returns a WP_Error rather than falling back to the default method, so a misconfigured host shows up as an error rather than as secrets that appear not to exist. Conformance test suites are included for drop-in authors.

Also adds the manage_secrets capability, granted to administrators through populate_roles_720() and upgrade_720(), the manage_network_secrets meta capability for super admins, and Site Health tests for the Secrets API.

This provides the encrypted storage requested in #64789, so the Connectors screen's API keys can move off plaintext options in a follow-up. The admin screen is deferred to 7.3, and the WP-CLI commands stay in the feature plugin.

Props ericmann, westonruter, mindctrl, audrasjb, whyisjake.
Fixes #66187. See #64789.

File:

• trunk/src/wp-includes/load.php (modified) (1 diff)

trunk/src/wp-includes/load.php

@@ -826 +826 @@
 
 /**
+ * Loads the secrets.php drop-in, if one exists, and records whether it left the
+ * Secrets API's provider, store, and keyring overrides in a usable state.
+ *
+ * Runs once, before must-use plugins load, so that every interface a drop-in's
+ * classes implement already exists and every plugin sees the drop-in's provider.
+ *
+ * Sets `$GLOBALS['wp_secrets_dropin_loaded']` as soon as the file is found, whether
+ * or not it then loads cleanly: wp_using_secrets_dropin() reports presence, not
+ * health.
+ *
+ * Sets `$GLOBALS['wp_secrets_dropin_broken']` when the require throws, or when any of
+ * `$GLOBALS['wp_secrets_provider']`, `$GLOBALS['wp_secrets_store']`, or
+ * `$GLOBALS['wp_secrets_keyring']` is set to something that does not implement its
+ * interface. A global left unset is fine: a drop-in that overrides only the keyring
+ * leaves the other two alone. Once the flag is set, every Secrets API operation
+ * returns WP_Error for the rest of the request rather than falling back to the
+ * default provider, so a broken drop-in reads as unreachable, never as absent.
+ *
+ * PHP treats a class that implements an interface but omits a required method as an
+ * uncatchable fatal error, even inside the try/catch around the require. That case
+ * cannot be intercepted from PHP code.
+ *
+ * @since 7.2.0
+ * @access private
+ */
+function wp_load_secrets_dropin(): void {
+        static $loaded = false;
+
+        if ( $loaded ) {
+                return;
+        }
+
+        $loaded = true;
+
+        $dropin_path = WP_CONTENT_DIR . '/secrets.php';
+
+        if ( ! file_exists( $dropin_path ) ) {
+                return;
+        }
+
+        $GLOBALS['wp_secrets_dropin_loaded'] = true;
+
+        try {
+                require $dropin_path;
+        } catch ( Throwable $e ) {
+                $GLOBALS['wp_secrets_dropin_broken'] = true;
+
+                return;
+        }
+
+        if ( isset( $GLOBALS['wp_secrets_store'] ) && ! ( $GLOBALS['wp_secrets_store'] instanceof WP_Secrets_Store ) ) {
+                $GLOBALS['wp_secrets_dropin_broken'] = true;
+        }
+
+        if ( isset( $GLOBALS['wp_secrets_keyring'] ) && ! ( $GLOBALS['wp_secrets_keyring'] instanceof WP_Secrets_Keyring ) ) {
+                $GLOBALS['wp_secrets_dropin_broken'] = true;
+        }
+
+        if ( isset( $GLOBALS['wp_secrets_provider'] ) && ! ( $GLOBALS['wp_secrets_provider'] instanceof WP_Secrets_Provider ) ) {
+                $GLOBALS['wp_secrets_dropin_broken'] = true;
+        }
+}
+
+/**
  * Starts the WordPress object cache.
  *