ACL: Default to restricting all on non-prod if ACL is enabled but no …

…options are set (#5796)
Automattic · Aug 14, 2024 · 4b38fdf · 4b38fdf
1 parent 35be4b5
commit 4b38fdf
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 9 deletions.
diff --git a/files/acl/acl.php b/files/acl/acl.php
@@ -18,8 +18,9 @@
 
 function maybe_load_restrictions() {
 	$is_files_acl_enabled            = defined( 'VIP_FILES_ACL_ENABLED' ) && true === constant( 'VIP_FILES_ACL_ENABLED' );
-	$is_restrict_all_enabled         = get_option_as_bool( 'vip_files_acl_restrict_all_enabled' );
-	$is_restrict_unpublished_enabled = get_option_as_bool( 'vip_files_acl_restrict_unpublished_enabled' );
+	$is_restrict_all_enabled         = get_option_as_bool_if_exists( 'vip_files_acl_restrict_all_enabled' );
+	$is_restrict_unpublished_enabled = get_option_as_bool_if_exists( 'vip_files_acl_restrict_unpublished_enabled' );
+	$no_option_set                   = null === $is_restrict_all_enabled && null === $is_restrict_unpublished_enabled;
 
 	if ( ! $is_files_acl_enabled ) {
 		// Throw warning if restrictions are enabled but ACL constant is not set.
@@ -32,11 +33,11 @@ function maybe_load_restrictions() {
 		return;
 	}
 
-	if ( $is_restrict_all_enabled ) {
+	if ( true === $is_restrict_all_enabled || ( $no_option_set && ( defined( 'VIP_GO_ENV' ) && 'production' !== VIP_GO_ENV ) ) ) {
 		require_once __DIR__ . '/restrict-all-files.php';
 
 		add_filter( 'vip_files_acl_file_visibility', __NAMESPACE__ . '\Restrict_All_Files\check_file_visibility', 10, 2 );
-	} elseif ( $is_restrict_unpublished_enabled ) {
+	} elseif ( true === $is_restrict_unpublished_enabled ) {
 		require_once __DIR__ . '/restrict-unpublished-files.php';
 
 		add_filter( 'vip_files_acl_file_visibility', __NAMESPACE__ . '\Restrict_Unpublished_Files\check_file_visibility', 10, 2 );
@@ -45,8 +46,19 @@ function maybe_load_restrictions() {
 	}
 }
 
-function get_option_as_bool( $option_name ) {
-	$value = get_option( $option_name, false );
+/**
+ * Get an option as a boolean if it exists. If it does not exist, return null.
+ *
+ * @param string $option_name The name of the option to get.
+ *
+ * @return boolean|null The option value as a boolean, or null if the option does not exist.
+ */
+function get_option_as_bool_if_exists( $option_name ) {
+	$value = get_option( $option_name, null );
+
+	if ( null === $value ) {
+		return $value;
+	}
 
 	return in_array( $value, [
 		true,

diff --git a/tests/files/acl/test-acl.php b/tests/files/acl/test-acl.php
@@ -111,9 +111,9 @@ public function test__maybe_load_restrictions__constant_and_restrict_unpublished
 	}
 
 	public function test__get_option_as_bool__option_not_exists() {
-		$actual_value = get_option_as_bool( 'my_test_get_option_as_bool_option_not_exists' );
+		$actual_value = get_option_as_bool_if_exists( 'my_test_get_option_as_bool_option_not_exists' );
 
-		$this->assertEquals( false, $actual_value );
+		$this->assertEquals( null, $actual_value );
 	}
 
 	public function data_provider__get_option_as_bool__option_exists() {
@@ -166,7 +166,7 @@ public function data_provider__get_option_as_bool__option_exists() {
 	public function test__get_option_as_bool__option_exists( $option_value, $expected_value ) {
 		update_option( 'my_test_get_option_as_bool_option', $option_value );
 
-		$actual_value = get_option_as_bool( 'my_test_get_option_as_bool_option' );
+		$actual_value = get_option_as_bool_if_exists( 'my_test_get_option_as_bool_option' );
 
 		$this->assertEquals( $expected_value, $actual_value );
 	}