Repository navigation
fix: make the connector rate limit atomic (#228) - #240
Merged
Merged
Conversation
WP.org review R agentic-admin/28May26/T5 (29 Sep, AI-flagged): the transient-based counter was read-then-written, so concurrent requests could read the same count and bypass the per-user limit. The counter is now an options row incremented with a single INSERT ... ON DUPLICATE KEY UPDATE, which the database applies atomically, with one row per user per clock minute. Older rows are deleted as it goes and on uninstall. Tested: 40 concurrent requests as one user against a limit of 30 allowed exactly 30 (twice), with no database errors. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Answers the only item in WP.org's 29 Sep review (
R agentic-admin/28May26/T5). Remote loading, escaping and Tested up to are no longer listed after #238 and #239.Flag (
class-connectors.php:505, their AI): the rate limit read a transient and then wrotecount + 1, so concurrent requests could read the same value and get past the per-user limit.Fix:
INSERT … ON DUPLICATE KEY UPDATE option_value = option_value + 1. The database applies that atomically.Tested:
🤖 Generated with Claude Code