Migrate Store v1.2.0 — WordPress 7 Readiness, Security Hardening & Shipping Method Coverage

[MahamadSayed]

Description

Summary

Prepares Migrate Store for WordPress 7.0 and bumps the plugin to v1.2.0.
The branch lands three phases of work — compatibility/headers, security
hardening & data integrity, and full shipping-method export coverage.

What changed

Phase 1 — Plugin headers & PHP compatibility

• Bumped version 1.1.9 → 1.2.0 (plugin header + MIGRATESTORE_VERSION).
• Added Requires at least: 6.0, Tested up to: 7.0, Requires PHP: 7.4,
  and Requires Plugins: woocommerce headers.
• Updated readme.txt (Tested up to, Stable tag, changelog).
• PHP 8.2 / 8.3 compatible; minimum PHP 7.4.

Phase 2 — Security hardening & data integrity

• Added manage_woocommerce capability checks to all export and import handlers.
• Validated ZIP uploads (MIME type + size limit) with guaranteed temp-file
  cleanup on both success and failure.
• Unified option field names (option_name / option_value) across all
  exporters and importers.
• Fixed the AbstractImporter constructor signature.
• Removed a duplicate entry in the email settings exporter.

Phase 3 — Shipping method coverage

• Shipping method export is no longer limited to the three built-in types;
  all registered shipping methods are now exported.
• Unrecognized methods are reported back to the user on import.
• Added shipping method filtering on the admin import page.

Files touched (plugin)

migratestore.php, readme.txt, includes/MigrateStore.php,
includes/Exporters/**, includes/Importers/**, includes/admin/admin-import-page.php
(+255 / −42 across 9 files).

Testing

• Manual export/import round-trip verified across all WooCommerce setting groups.
• Capability checks and ZIP validation exercised; temp files confirmed cleaned up.
• Shipping export verified against built-in and custom registered methods.

[amElnagdy]

Reviewed with the guard skills + Plugin Check. The headline feature work is good — the "refuse to merge into existing zones" guard, the skip-unregistered-methods handling, and the zip-slip path check are all solid additions. A few things before merge:

🔴 Blocking — data corruption on import (see inline on ShippingZonesImporter.php:118): serialized shipping-method settings get mangled because sanitization runs before is_serialized(). Your new per-instance settings export round-trips exactly this kind of data.

🟠 Plugin Check — new code in this PR:

• cleanup_import_artifacts() uses unlink() / rmdir() (MigrateStore.php:296,313,322,326) → wp_delete_file() / WP_Filesystem. It also re-implements the existing recursiveRemoveDirectory() — reuse that instead.
• ShippingZonesExporter.php:83 — interpolated SQL not prepared → wrap in $wpdb->prepare().
• MigrateStore.php:173 — $_POST / upload input not validated.

🟡 Non-blocking:

• Capability mismatch: menu pages use manage_options, action handlers use manage_woocommerce (MigrateStore.php:34-49 vs 125/162) — pick one.
• Changelog mentions a constructor-signature fix that isn't in this diff (readme.txt:73).

Separately, wp plugin check migratestore surfaces 23 pre-existing .org-blocking errors in the plugin's own code (legacy exporters/importers) unrelated to this PR — tracked in #12 so this PR stays focused.

[amElnagdy]

This corrupts serialized shipping-method settings on import. import_option() runs sanitize_text_field() on the raw value before is_serialized(). WooCommerce stores per-instance method settings as a serialized array; if any value contains a newline, double-space, or <, the serialized string's length prefixes get mangled → is_serialized() returns false → the settings array is silently stored corrupted.

The ordering is pre-existing, but this PR edits this line and adds the per-instance settings export that round-trips serialized data through here — so it's worth fixing here. The parent AbstractImporter::import_option() already does it correctly (unserialize raw → sanitize → enforce the option-name allowlist). Simplest fix: drop this override and rely on the parent; or mirror it:

protected function import_option( $data ) {
	$option_name  = sanitize_key( $data['option_name'] ?? $data['option'] );
	$option_value = $data['option_value'] ?? $data['value'];

	// Unserialize the RAW value first, THEN sanitize — sanitizing a serialized
	// string corrupts its length prefixes and silently destroys the settings.
	if ( is_serialized( $option_value ) ) {
		$option_value = maybe_unserialize( $option_value );
	}
	if ( is_array( $option_value ) ) {
		array_walk_recursive( $option_value, fn( &$v ) => $v = sanitize_text_field( $v ) );
	} else {
		$option_value = sanitize_text_field( $option_value );
	}

	update_option( $option_name, $option_value );
}

⚠️ This override also drops the parent's option-name allowlist guard — restoring it (or removing the override) closes that gap too.

[MahamadSayed]

@amElnagdy All issues raised in review have been addressed. Each fix was manually tested before commit.

🔴 Blocking

1. Serialized data corruption + dropped allowlist in ShippingZonesImporter::import_option() — c251d03

• Sanitization ran before unserialization, corrupting serialized per-instance method settings (sanitize_text_field() altered byte lengths without updating PHP's serialization length prefixes → silent is_serialized() failure → mangled string stored).
• Now maybe_unserialize() runs on the raw value first; sanitization only touches decoded leaves (recursive for arrays, is_string()-guarded for scalars).
• Restored an option-name allowlist guard (^woocommerce_.+_\d+_settings$) so a crafted import can't write arbitrary options.

🟡 Plugin Check

2. SQL injection flag in ShippingZonesExporter — 738f082

• The dynamic IN () query (already bound via prepare(), but flagged by Plugin Check for the interpolated placeholder variable) was replaced with a get_option() loop over the known option-name list — removes the flagged pattern entirely (no phpcs:ignore) and clears the direct-query/no-caching warnings. Output is byte-identical (maybe_serialize() preserves the wire format the importer expects).

3. Unvalidated upload input in handle_import_actio

• Hardened the $_FILES['json_zip_file'] reads flagged under WordPress.Security.ValidatedSanitizedInput: int-cast the error code, isset-guard + cast the size, and add wp_unslash() before sanitize_file_name() on the name. No behavioral change — capability check, nonce, MIME allowlist, and zip-slip protection were already in place.

4. Raw unlink()/rmdir() in import cleanup — 2f76d58

• Replaced raw filesystem calls with WordPress APIs in both cleanup paths: wp_delete_file() for single files and
  $wp_filesystem->delete($dir, true) for the temp trbstractImporter::cleanup()); removed the now-unused custom recursiveRemoveDirectory() helper.

⚪ Non-blocking

5. Capability mismatch + stale changelog — bdb506f

• Menu pages used manage_options while handlers used manage_woocommerce, so Shop Managers could trigger actions but never see the menu. Aligned the four menu pages to manage_woocommerce (matching the handlers and the plugin's WooCommerce scope).
• Removed the changelog line claiming the constructor-signature fix.