Commit 517bd08fac for wordpress.org

commit 517bd08facb711f5980871b4d0c8eafae246b02c
Author: whyisjake <whyisjake@git.wordpress.org>
Date:   Wed Oct 14 15:10:54 2026 +0000

    Security: Use `str_contains()` and `str_starts_with()` in the Secrets API.

    Replaces the `strpos()` comparisons in the Site Health tests and `WP_Secrets_Libsodium_Provider::list_secrets()` with `str_contains()` and `str_starts_with()`, which are available in core through the polyfills added in WordPress 5.9.

    Follow-up to [64337].

    Props soean.
    See #66187.

    Built from https://develop.svn.wordpress.org/trunk@64344


    git-svn-id: http://core.svn.wordpress.org/trunk@63494 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-admin/includes/secrets-site-health.php b/wp-admin/includes/secrets-site-health.php
index 65ffe28869..eef44e9266 100644
--- a/wp-admin/includes/secrets-site-health.php
+++ b/wp-admin/includes/secrets-site-health.php
@@ -85,7 +85,7 @@ function wp_secrets_site_health_result( string $test, string $label, string $sta
 function wp_secrets_site_health_test_key_source(): array {
 	$key_source = _wp_secrets_get_key_manager()->get_keyring()->get_key_source();

-	if ( false !== strpos( $key_source, 'broken' ) ) {
+	if ( str_contains( $key_source, 'broken' ) ) {
 		return wp_secrets_site_health_result(
 			'secrets_api_key_source',
 			__( 'Secrets API key source is broken' ),
@@ -97,7 +97,7 @@ function wp_secrets_site_health_test_key_source(): array {
 		);
 	}

-	if ( false !== strpos( $key_source, 'legacy interpretation' ) ) {
+	if ( str_contains( $key_source, 'legacy interpretation' ) ) {
 		return wp_secrets_site_health_result(
 			'secrets_api_key_source',
 			__( 'Secrets API key should be regenerated' ),
@@ -109,7 +109,7 @@ function wp_secrets_site_health_test_key_source(): array {
 		);
 	}

-	if ( false !== strpos( $key_source, 'LOGGED_IN_KEY' ) ) {
+	if ( str_contains( $key_source, 'LOGGED_IN_KEY' ) ) {
 		return wp_secrets_site_health_result(
 			'secrets_api_key_source',
 			__( 'Secrets API is using a fallback key' ),
diff --git a/wp-includes/secrets/class-wp-secrets-libsodium-provider.php b/wp-includes/secrets/class-wp-secrets-libsodium-provider.php
index d7dc205cf9..6278a5dddf 100644
--- a/wp-includes/secrets/class-wp-secrets-libsodium-provider.php
+++ b/wp-includes/secrets/class-wp-secrets-libsodium-provider.php
@@ -650,7 +650,7 @@ final class WP_Secrets_Libsodium_Provider implements WP_Secrets_Provider {
 		$entries = array();

 		foreach ( $names as $name ) {
-			if ( '' !== $name_prefix && 0 !== strpos( $name, $name_prefix . '/' ) ) {
+			if ( '' !== $name_prefix && ! str_starts_with( $name, $name_prefix . '/' ) ) {
 				continue;
 			}

diff --git a/wp-includes/version.php b/wp-includes/version.php
index 55a127d80b..8012b7ae92 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-alpha-64343';
+$wp_version = '7.2-alpha-64344';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.