diff --git a/src/wp-includes/secrets/class-wp-secrets-config-key-provider.php b/src/wp-includes/secrets/class-wp-secrets-config-key-provider.php index c99adc925ecd0..1779d816e296d 100644 --- a/src/wp-includes/secrets/class-wp-secrets-config-key-provider.php +++ b/src/wp-includes/secrets/class-wp-secrets-config-key-provider.php @@ -243,8 +243,8 @@ private function get_site_key() { * Whether a pair of candidate salt values are usable as key material. * * Both must be non-empty strings, and neither may be the literal - * wp-config-sample.php placeholder – which every unconfigured install shares, - * making it a publicly known value rather than a secret. + * wp-config-sample.php placeholder or its translation – which every + * unconfigured install shares, making it a publicly known value rather than a secret. * * Takes explicit arguments rather than reading LOGGED_IN_KEY/LOGGED_IN_SALT * directly so the decision logic is testable without touching real constants, @@ -261,9 +261,19 @@ private function get_site_key() { * @phpstan-assert-if-true non-empty-string $logged_in_salt */ private function are_usable_salt_values( $logged_in_key, $logged_in_salt ): bool { + $placeholders = array( + self::KNOWN_PLACEHOLDER, + /* + * translators: This string should only be translated if wp-config-sample.php is localized. + * You can check the localized release package or + * https://i18n.svn.wordpress.org//branches//dist/wp-config-sample.php + */ + __( 'put your unique phrase here' ), + ); + return array_all( array( $logged_in_key, $logged_in_salt ), - fn( $value ) => is_string( $value ) && '' !== $value && self::KNOWN_PLACEHOLDER !== $value + fn( $value ) => is_string( $value ) && '' !== $value && ! in_array( $value, $placeholders, true ) ); } diff --git a/tests/phpunit/tests/secrets/wpSecretsConfigKeyProvider.php b/tests/phpunit/tests/secrets/wpSecretsConfigKeyProvider.php index b14d19549cb0e..638b5999b4575 100644 --- a/tests/phpunit/tests/secrets/wpSecretsConfigKeyProvider.php +++ b/tests/phpunit/tests/secrets/wpSecretsConfigKeyProvider.php @@ -170,6 +170,19 @@ public static function data_usable_salt_values(): array { ); } + public function test_are_usable_salt_values_rejects_translated_placeholder(): void { + $provider = new WP_Secrets_Config_Key_Provider(); + $filter = static function ( $translation, $text ) { + return 'put your unique phrase here' === $text ? 'mettez une phrase unique ici' : $translation; + }; + + add_filter( 'gettext', $filter, 10, 2 ); + $result = $this->invoke_private( $provider, 'are_usable_salt_values', array( 'mettez une phrase unique ici', 'a real salt' ) ); + remove_filter( 'gettext', $filter, 10 ); + + $this->assertFalse( $result ); + } + /** * @runInSeparateProcess * @preserveGlobalState disabled