Commit 232122da5c for wordpress.org

commit 232122da5cec198e8588d9dd1df7c053ce0ee777
Author: whyisjake <whyisjake@git.wordpress.org>
Date:   Tue Nov 10 08:19:57 2026 +0000

    Security: Let the `secrets.php` drop-in set plain variables.

    `wp_load_secrets_dropin()` requires `wp-content/secrets.php` inside a function, so a drop-in that set an override as a plain variable, such as `$wp_secrets_keyring = new My_Keyring();`, only set a local variable. The override was ignored and the default was used instead, with nothing to say so.

    The `$wp_secrets_provider`, `$wp_secrets_store` and `$wp_secrets_keyring` globals are now declared before the drop-in is required, as `require_wp_db()` does with `$wpdb` for `db.php`. Drop-ins that write to `$GLOBALS` work as before.

    Follow-up to r64337.

    Props ericmann, jorbin.
    See #66187.

    Built from https://develop.svn.wordpress.org/trunk@65378


    git-svn-id: http://core.svn.wordpress.org/trunk@64517 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/load.php b/wp-includes/load.php
index 31f82524ba..4cd2b4467c 100644
--- a/wp-includes/load.php
+++ b/wp-includes/load.php
@@ -831,6 +831,10 @@ function wp_using_ext_object_cache( $using = null ) {
  * Runs once, before must-use plugins load, so that every interface a drop-in's
  * classes implement already exists and every plugin sees the drop-in's provider.
  *
+ * The drop-in sets its overrides in the `$wp_secrets_provider`, `$wp_secrets_store`
+ * and `$wp_secrets_keyring` globals. They are declared global before the require, so
+ * a plain assignment such as `$wp_secrets_keyring = new My_Keyring();` works.
+ *
  * Sets `$GLOBALS['wp_secrets_dropin_loaded']` as soon as the file is found, whether
  * or not it then loads cleanly: wp_using_secrets_dropin() reports presence, not
  * health.
@@ -873,6 +877,12 @@ function wp_load_secrets_dropin(): void {

 	$GLOBALS['wp_secrets_dropin_loaded'] = true;

+	/*
+	 * The drop-in is required inside this function. Declaring the overrides global
+	 * lets it set them as plain variables, as db.php does with $wpdb.
+	 */
+	global $wp_secrets_provider, $wp_secrets_store, $wp_secrets_keyring;
+
 	try {
 		require $dropin_path;
 	} catch ( Throwable $e ) {
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 5c51c8442a..a9c4932310 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-beta4-65377';
+$wp_version = '7.2-beta4-65378';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.