fix(audit L5): unter der Sperre Divis Laufzeit-Caches verwerfen (Options-Cache-Gruppe, GlobalData-/GlobalPreset-Static, et_theme_options) vor raw() und design_rev

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This commit is contained in:
Jan-Niclas Loosen
2026-10-20 00:26:40 +02:00
co-authored by Claude Sonnet 5.5
parent 6e84138979
commit 99c7aab238
28 changed files with 182 additions and 13 deletions
@@ -86,4 +86,28 @@ class GlobalVariablesAdapter implements DiviAdapter
{
return function_exists('et_pb_is_allowed') && (bool) et_pb_is_allowed('variables_manager');
}
/**
* Audit L5: GlobalData keeps a static copy of the variables that can be older than another writer's finished
* save (the option cache is dropped by DesignLock). Called under the lock, before reading.
*/
public function refresh(): void
{
self::forgetCached('variables');
}
/** Resets one entry of GlobalData's static runtime cache (private, so by reflection; gone = nothing to reset). */
private static function forgetCached(string $key): void
{
try {
$cache = new \ReflectionProperty(GlobalData::class, '_cached_data');
$data = $cache->getValue();
if (is_array($data) && array_key_exists($key, $data)) {
$data[$key] = null;
$cache->setValue(null, $data);
}
} catch (\ReflectionException) {
// Divi without that property: its reads are not cached this way.
}
}
}