GH#1255: feat: disable tenant-side gateway manager in sovereign mode#1257
Conversation
superdav42
added
the
origin:worker
Completion Summary
aidevops.sh v3.17.27 plugin for OpenCode v1.15.7 with claude-haiku-4-5 spent 1m and 1,573 tokens on this as a headless worker. |
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis PR adds early-exit guards to two payment-related methods in ChangesSovereign Tenant Gateway Bypass
Estimated code review effort🎯 2 (Simple) | ⏱️ ~5 minutes Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔨 Build Complete - Ready for Testing!📦 Download Build Artifact (Recommended)Download the zip build, upload to WordPress and test:
🌐 Test in WordPress Playground (Very Experimental)Click the link below to instantly test this PR in your browser - no installation needed! Login credentials: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
inc/managers/class-gateway-manager.php (1)
622-626: ⚡ Quick winConsider moving the sovereign tenant guard after the nonce check.
While the early return prevents any sensitive operation from executing, checking the nonce before returning maintains consistent AJAX security practices and prevents potential issues if code is modified later.
🔒 Suggested defensive ordering
public function ajax_check_payment_status(): void { - if ( defined( 'WU_MT_SOVEREIGN_TENANT' ) && WU_MT_SOVEREIGN_TENANT ) { - return; - } - check_ajax_referer('wu_payment_status_poll', 'nonce'); + + if ( defined( 'WU_MT_SOVEREIGN_TENANT' ) && WU_MT_SOVEREIGN_TENANT ) { + return; + } $payment_hash = wu_request('payment_hash');🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@inc/managers/class-gateway-manager.php` around lines 622 - 626, Move the sovereign-tenant early return so the AJAX nonce is validated first: in the method containing check_ajax_referer and the WU_MT_SOVEREIGN_TENANT guard, call check_ajax_referer('wu_payment_status_poll', 'nonce') before evaluating defined('WU_MT_SOVEREIGN_TENANT') && WU_MT_SOVEREIGN_TENANT, then keep the return behavior unchanged; this ensures the AJAX nonce check (check_ajax_referer) always runs for that endpoint while preserving the existing sovereign tenant short-circuit via the same guard symbol.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@inc/managers/class-gateway-manager.php`:
- Around line 622-626: Move the sovereign-tenant early return so the AJAX nonce
is validated first: in the method containing check_ajax_referer and the
WU_MT_SOVEREIGN_TENANT guard, call check_ajax_referer('wu_payment_status_poll',
'nonce') before evaluating defined('WU_MT_SOVEREIGN_TENANT') &&
WU_MT_SOVEREIGN_TENANT, then keep the return behavior unchanged; this ensures
the AJAX nonce check (check_ajax_referer) always runs for that endpoint while
preserving the existing sovereign tenant short-circuit via the same guard
symbol.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: d0e6c1ad-eee3-4878-a2ae-fa405f62092b
📒 Files selected for processing (1)
inc/managers/class-gateway-manager.php
|
Performance Test Results Performance test results for d44d9c1 are in 🛎️! Note: the numbers in parentheses show the difference to the previous (baseline) test run. Differences below 2% or 0.5 in absolute values are not shown. URL:
|
superdav42
force-pushed
the
feature/auto-20260522-063744-gh1255
branch
from
72e6e2b to
52edb06
Compare
🔨 Build Complete - Ready for Testing!📦 Download Build Artifact (Recommended)Download the zip build, upload to WordPress and test:
🌐 Test in WordPress Playground (Very Experimental)Click the link below to instantly test this PR in your browser - no installation needed! Login credentials: |
…ments (#1266) Extends the sovereign-mode disable pattern (established in #1257, #1258, #1261) to the remaining 8 customer-facing UI elements. When WU_MT_SOVEREIGN_TENANT is defined, each element renders a single 'Manage on main site' link instead of its normal output. Changes: - Add sovereign helper function wu_mt_main_site_account_url() in inc/functions/sovereign.php - Add sovereign-redirect template in views/elements/sovereign-redirect.php - Add sovereign-mode short-circuit to output() method in 8 UI elements: * Account_Summary_Element * Billing_Info_Element * Invoices_Element * My_Sites_Element * Current_Membership_Element * Current_Site_Element * Template_Switching_Element * Domain_Mapping_Element - Add comprehensive unit tests for sovereign-mode functionality Resolves #1263 Resolves Ultimate-Multisite/ultimate-multisite-multi-tenancy#86 Resolves Ultimate-Multisite/ultimate-multisite-multi-tenancy#87
superdav42
added
the
review-feedback-scanned
1 participant
Summary
Added early-return guards to process_gateway_confirmations() and ajax_check_payment_status() methods when WU_MT_SOVEREIGN_TENANT is defined. This prevents gateway confirmation processing and payment status polling on tenant sites in sovereign mode, as checkout and payment handling occur on the main site.
Files Changed
inc/managers/class-gateway-manager.php
Runtime Testing
Resolves #1255
aidevops.sh v3.17.27 plugin for OpenCode v1.15.7 with claude-haiku-4-5 spent 1m and 1,573 tokens on this as a headless worker.
Summary by CodeRabbit
Bug Fixes