peptide-repo/prautoblogger
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(settings): sanitize reasoning token cap as numeric on save

Browse Source 
QA F4 (P3): prautoblogger_reasoning_max_tokens was missing from the
sanitize_field() numeric allowlist, so it saved as raw text (absint at
read kept runtime safe). Saves as numeric-or-0 now, matching every other
number field. CHANGELOG 0.18.1 entry notes the server-side sanitize (no
new version — 0.18.1 is still unreleased).

Agent-Session: prab-empty-draft-guard-20260611
This commit is contained in:
peptiderepo
2026-06-11 13:50:26 +00:00
committed by peptiderepo
parent 27ef37fe15
commit b902216497
2 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG.md
View File

@@ -38,7 +38,8 @@ missing") → empty draft post in the Review Queue, with the cost booked as `suc
`max_tokens` is **raised** by the same amount, so no reasoning effort (incl. `xhigh`) can
consume the visible-content budget. New setting `prautoblogger_reasoning_max_tokens`
(Settings → AI Models, default `PRAUTOBLOGGER_DEFAULT_REASONING_MAX_TOKENS` = 2048; 0
restores the previous uncapped effort mode). When the cap is active it replaces `effort`
restores the previous uncapped effort mode; the option is sanitized server-side as
numeric). When the cap is active it replaces `effort`
(OpenRouter treats them as alternative budget controls); the `xhigh`/`high` effort options
stay available but are bounded by default. Cost-governor reservations use the effective
(raised) ceiling.

2
includes/admin/class-admin-page.php
View File

@@ -323,7 +323,7 @@ class PRAutoBlogger_Admin_Page {
return wp_json_encode( array_values( array_map( 'sanitize_text_field', $items ) ) );
}
$numeric = array( 'prautoblogger_daily_article_target', 'prautoblogger_monthly_budget_usd', 'prautoblogger_min_word_count', 'prautoblogger_max_word_count', 'prautoblogger_default_author', 'prautoblogger_default_category', 'prautoblogger_pullpush_cache_ttl', 'prautoblogger_reddit_posts_per_subreddit' );
$numeric = array( 'prautoblogger_daily_article_target', 'prautoblogger_monthly_budget_usd', 'prautoblogger_min_word_count', 'prautoblogger_max_word_count', 'prautoblogger_default_author', 'prautoblogger_default_category', 'prautoblogger_pullpush_cache_ttl', 'prautoblogger_reddit_posts_per_subreddit', 'prautoblogger_reasoning_max_tokens' );
if ( in_array( $option_name, $numeric, true ) ) {
return is_numeric( $value ) ? $value : 0;
}