From 1276c2174843c0e5328bf31946d0b8b31d1d4d75 Mon Sep 17 00:00:00 2001 From: Ivelina Dimova Date: Tue, 18 Aug 2026 14:05:55 +0300 Subject: [PATCH] fix: address WP.org T4 review items (#228) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two concrete code changes flagged in review R agentic-admin/schmitzoide/1Jun26/T4: - uploads-scan.php: resolve .well-known via get_home_path() instead of ABSPATH, which is wrong on subdirectory installs where the site root (document root) differs from the WordPress core directory. Guards the wp-admin/includes/file.php require so get_home_path() is available in the ability's REST load path. - vector-store.js: pin the Transformers.js jsDelivr URL to @3.8.1 (was floating @3). Matches indexing-worker.js and makes the readme changelog claim accurate — a privacy-first plugin should not depend on a CDN range that can ship new code without a deliberate bump. Co-Authored-By: Claude Opus 4.8 --- includes/abilities/security/uploads-scan.php | 7 ++++++- src/extensions/services/vector-store.js | 2 +- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/includes/abilities/security/uploads-scan.php b/includes/abilities/security/uploads-scan.php index a061a92..87ac99e 100644 --- a/includes/abilities/security/uploads-scan.php +++ b/includes/abilities/security/uploads-scan.php @@ -172,7 +172,12 @@ function agentic_admin_execute_uploads_scan( array $input = array() ): array { // 3. Scan .well-known directory (recursive). // Attackers hide backdoors in .well-known/ because admins rarely check it // and some security scanners skip dotfiles/dotdirs. - $well_known_dir = ABSPATH . '.well-known'; + // .well-known lives at the site root (document root), which is get_home_path() + // and can differ from ABSPATH on subdirectory installs. + if ( ! function_exists( 'get_home_path' ) ) { + require_once ABSPATH . 'wp-admin/includes/file.php'; + } + $well_known_dir = trailingslashit( get_home_path() ) . '.well-known'; if ( is_dir( $well_known_dir ) ) { $areas_scanned[] = '.well-known'; agentic_admin_scan_directory_for_dangerous_files( diff --git a/src/extensions/services/vector-store.js b/src/extensions/services/vector-store.js index 533dbc1..55ae86d 100644 --- a/src/extensions/services/vector-store.js +++ b/src/extensions/services/vector-store.js @@ -14,7 +14,7 @@ import { createLogger } from '../utils/logger'; const log = createLogger( 'VectorStore' ); const TRANSFORMERS_CDN = - 'https://cdn.jsdelivr.net/npm/@huggingface/transformers@3'; + 'https://cdn.jsdelivr.net/npm/@huggingface/transformers@3.8.1'; const MODEL_NAME = 'Xenova/all-MiniLM-L6-v2'; const DB_NAME = 'wp-agentic-rag-db'; const DB_VERSION = 1;