From da1ccf394e2e800b8d5858aa0249c253e4830902 Mon Sep 17 00:00:00 2001 From: peptiderepo Date: Thu, 11 Jun 2026 13:50:26 +0000 Subject: [PATCH] fix(settings): sanitize reasoning token cap as numeric on save MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit QA F4 (P3): prautoblogger_reasoning_max_tokens was missing from the sanitize_field() numeric allowlist, so it saved as raw text (absint at read kept runtime safe). Saves as numeric-or-0 now, matching every other number field. CHANGELOG 0.18.1 entry notes the server-side sanitize (no new version — 0.18.1 is still unreleased). Agent-Session: prab-empty-draft-guard-20260611 --- CHANGELOG.md | 3 ++- includes/admin/class-admin-page.php | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9fcd7f9..c3a17f2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -38,7 +38,8 @@ missing") → empty draft post in the Review Queue, with the cost booked as `suc `max_tokens` is **raised** by the same amount, so no reasoning effort (incl. `xhigh`) can consume the visible-content budget. New setting `prautoblogger_reasoning_max_tokens` (Settings → AI Models, default `PRAUTOBLOGGER_DEFAULT_REASONING_MAX_TOKENS` = 2048; 0 - restores the previous uncapped effort mode). When the cap is active it replaces `effort` + restores the previous uncapped effort mode; the option is sanitized server-side as + numeric). When the cap is active it replaces `effort` (OpenRouter treats them as alternative budget controls); the `xhigh`/`high` effort options stay available but are bounded by default. Cost-governor reservations use the effective (raised) ceiling. diff --git a/includes/admin/class-admin-page.php b/includes/admin/class-admin-page.php index 8738b6b..a06decb 100755 --- a/includes/admin/class-admin-page.php +++ b/includes/admin/class-admin-page.php @@ -323,7 +323,7 @@ class PRAutoBlogger_Admin_Page { return wp_json_encode( array_values( array_map( 'sanitize_text_field', $items ) ) ); } - $numeric = array( 'prautoblogger_daily_article_target', 'prautoblogger_monthly_budget_usd', 'prautoblogger_min_word_count', 'prautoblogger_max_word_count', 'prautoblogger_default_author', 'prautoblogger_default_category', 'prautoblogger_pullpush_cache_ttl', 'prautoblogger_reddit_posts_per_subreddit' ); + $numeric = array( 'prautoblogger_daily_article_target', 'prautoblogger_monthly_budget_usd', 'prautoblogger_min_word_count', 'prautoblogger_max_word_count', 'prautoblogger_default_author', 'prautoblogger_default_category', 'prautoblogger_pullpush_cache_ttl', 'prautoblogger_reddit_posts_per_subreddit', 'prautoblogger_reasoning_max_tokens' ); if ( in_array( $option_name, $numeric, true ) ) { return is_numeric( $value ) ? $value : 0; }