#$@%#$%!

Ngiler SH3LL 360
: / usr / src / litespeed-wp-plugin / 7.7 / litespeed-cache / src /

Information Server
MySQL : OFF Perl : OFF CURL : ON WGET : OFF PKEXEC : OFF

Directive	Local Value
IP Address	63.250.38.10
System	Linux premium90.web-hosting.com 4.18.0-553.44.1.lve.el8.x86_64 #1 SMP Thu Mar 13 14:29:12 UTC 2025 x86_64
User	likhxapw
PHP Version	8.3.30
Software	LiteSpeed
Doc root	Writable

Edit File : vary.cls.php \| Size : 21.33 KB
<?php /** * Manage the X-LiteSpeed-Vary behavior and vary cookie. * * @since 1.1.3 * @package LiteSpeed / namespace LiteSpeed; defined( 'WPINC' ) \|\| exit(); /* * Handles detection of user state (guest, logged-in, commenter, etc.) * and builds the X-LiteSpeed-Vary header and vary cookie accordingly. / class Vary extends Root { /* * Log tag used in debug output. * * @var string / const LOG_TAG = '🔱'; /* * Vary header name. * * @var string / const X_HEADER = 'X-LiteSpeed-Vary'; /* * Default vary cookie name (used for logged-in/commenter state). * * @var string / private static $_vary_name = '_lscache_vary'; /* * Whether Ajax calls are permitted to change the vary cookie. * * @var bool / private static $_can_change_vary = false; /* * Update the default vary cookie name if site settings require it. * * @since 4.0 * @since 7.0 Moved to after_user_init to allow ESI no-vary no conflict. * @return void / private function _update_vary_name() { $db_cookie = $this->conf( Base::O_CACHE_LOGIN_COOKIE ); // network aware in v3.0. // If no vary set in rewrite rule. if ( ! isset( $_SERVER['LSCACHE_VARY_COOKIE'] ) ) { if ( $db_cookie ) { // Check for ESI no-vary control. $something_wrong = true; if ( ! empty( $_GET[ ESI::QS_ACTION ] ) && ! empty( $_GET['_control'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended $control_raw = wp_unslash( (string) $_GET['_control'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized $control = array_map( 'sanitize_text_field', explode( ',', $control_raw ) ); if ( in_array( 'no-vary', $control, true ) ) { self::debug( 'no-vary control existed, bypass vary_name update' ); $something_wrong = false; self::$_vary_name = $db_cookie; } } if ( defined( 'LITESPEED_CLI' ) \|\| wp_doing_cron() ) { $something_wrong = false; } if ( $something_wrong ) { // Display cookie error msg to admin. if ( is_multisite() ? is_network_admin() : is_admin() ) { Admin_Display::show_error_cookie(); } Control::set_nocache( '❌❌ vary cookie setting error' ); } } return; } // DB setting does not exist – nothing to check. if ( ! $db_cookie ) { return; } // Beyond this point, ensure DB vary is present in $_SERVER env. $server_raw = wp_unslash( (string) $_SERVER['LSCACHE_VARY_COOKIE'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized $vary_arr = array_map( 'trim', explode( ',', $server_raw ) ); if ( in_array( $db_cookie, $vary_arr, true ) ) { self::$_vary_name = $db_cookie; return; } if ( is_multisite() ? is_network_admin() : is_admin() ) { Admin_Display::show_error_cookie(); } Control::set_nocache( 'vary cookie setting lost error' ); } /* * Run after user init to set up vary/caching for current request. * * @since 4.0 * @return void / public function after_user_init() { $this->_update_vary_name(); // Logged-in user. if ( Router::is_logged_in() ) { // If not ESI, check cache logged-in user setting. if ( ! $this->cls( 'Router' )->esi_enabled() ) { // Cache logged-in => private cache. if ( $this->conf( Base::O_CACHE_PRIV ) && ! is_admin() ) { add_action( 'wp_logout', __NAMESPACE__ . '\Purge::purge_on_logout' ); $this->cls( 'Control' )->init_cacheable(); Control::set_private( 'logged in user' ); } else { // No cache for logged-in user. Control::set_nocache( 'logged in user' ); } } elseif ( ! is_admin() ) { // ESI is on; can be public cache, but ensure cacheable is initialized. $this->cls( 'Control' )->init_cacheable(); } // Clear login state on logout. add_action( 'clear_auth_cookie', [ $this, 'remove_logged_in' ] ); } else { // Only after vary init we can detect guest mode. $this->_maybe_guest_mode(); // Set vary cookie when user logs in (to avoid guest vary). add_action( 'set_logged_in_cookie', [ $this, 'add_logged_in' ], 10, 4 ); add_action( 'wp_login', __NAMESPACE__ . '\Purge::purge_on_logout' ); $this->cls( 'Control' )->init_cacheable(); // Check login-page cacheable setting — login page doesn't go through main WP logic. add_action( 'login_init', [ $this->cls( 'Tag' ), 'check_login_cacheable' ], 5 ); // Optional lightweight guest vary updater. if ( ! empty( $_GET['litespeed_guest'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended add_action( 'wp_loaded', [ $this, 'update_guest_vary' ], 20 ); } } // Commenter checks. add_filter( 'comments_array', [ $this, 'check_commenter' ] ); // Set vary cookie for commenter. add_action( 'set_comment_cookies', [ $this, 'append_commenter' ] ); // REST: don't change vary because they don't carry on user info usually. add_action( 'rest_api_init', function () { self::debug( 'Rest API init disabled vary change' ); add_filter( 'litespeed_can_change_vary', '__return_false' ); } ); } /* * Mark request as Guest mode when applicable. * * @since 4.0 * @return void / private function _maybe_guest_mode() { if ( defined( 'LITESPEED_GUEST' ) ) { self::debug( '👒👒 Guest mode ' . ( LITESPEED_GUEST ? 'predefined' : 'turned off' ) ); return; } if ( ! $this->conf( Base::O_GUEST ) ) { return; } // If vary is set, then not a guest. if ( self::has_vary() ) { return; } // Admin QS present? not a guest. if ( ! empty( $_GET[ Router::ACTION ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended return; } if ( wp_doing_ajax() ) { return; } if ( wp_doing_cron() ) { return; } // Request to update vary? not a guest. if ( ! empty( $_GET['litespeed_guest'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended return; } // User explicitly turned guest off. if ( ! empty( $_GET['litespeed_guest_off'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended return; } self::debug( '👒👒 Guest mode' ); ! defined( 'LITESPEED_GUEST' ) && define( 'LITESPEED_GUEST', true ); if ( $this->conf( Base::O_GUEST_OPTM ) ) { ! defined( 'LITESPEED_GUEST_OPTM' ) && define( 'LITESPEED_GUEST_OPTM', true ); } } /* * Update Guest vary * * @since 4.0 * @deprecated 4.1 Use independent lightweight guest.vary.php instead. * @return void / public function update_guest_vary() { // Must not be cached. ! defined( 'LSCACHE_NO_CACHE' ) && define( 'LSCACHE_NO_CACHE', true ); $_guest = new Lib\Guest(); if ( $_guest->always_guest() \|\| self::has_vary() ) { // If contains vary already, don't reload (avoid loops). ! defined( 'LITESPEED_GUEST' ) && define( 'LITESPEED_GUEST', true ); self::debug( '🤠🤠 Guest' ); echo '[]'; exit; } self::debug( 'Will update guest vary in finalize' ); // Return JSON to trigger reload. echo wp_json_encode( [ 'reload' => 'yes' ] ); exit; } /* * Filter callback on `comments_array` to mark commenter state. * * @since 1.0.4 * * @param array $comments The comments to output. * @return array Filtered comments. / public function check_commenter( $comments ) { /* * Allow bypassing pending comment check for comment plugins. * * @since 2.9.5 / if ( apply_filters( 'litespeed_vary_check_commenter_pending', true ) ) { $pending = false; foreach ( $comments as $comment ) { if ( ! $comment->comment_approved ) { $pending = true; break; } } // No pending comments => ensure public cache state. if ( ! $pending ) { self::debug( 'No pending comment' ); $this->remove_commenter(); // Remove commenter prefilled info for public cache. foreach ( $_COOKIE as $cookie_name => $cookie_value ) { if ( strlen( $cookie_name ) >= 15 && 0 === strpos( $cookie_name, 'comment_author_' ) ) { unset( $_COOKIE[ $cookie_name ] ); } } return $comments; } } // Pending comments present — set commenter vary. $this->add_commenter(); if ( $this->conf( Base::O_CACHE_COMMENTER ) ) { Control::set_private( 'existing commenter' ); } else { Control::set_nocache( 'existing commenter' ); } return $comments; } /* * Check if default vary has a value * * @since 1.1.3 * * @return false\|string Cookie value or false if missing. / public static function has_vary() { if ( empty( $_COOKIE[ self::$_vary_name ] ) ) { return false; } // Cookie values are not user-displayed; unslash only. return wp_unslash( (string) $_COOKIE[ self::$_vary_name ] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized } /* * Append user status with logged-in. * * @since 1.1.3 * @since 1.6.2 Removed static referral. * * @param string\|false $logged_in_cookie The logged-in cookie value. * @param int\|false $expire Expiration timestamp. * @param int\|false $expiration Unused (WordPress signature). * @param int\|false $uid User ID. * @return void / public function add_logged_in( $logged_in_cookie = false, $expire = false, $expiration = false, $uid = false ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed self::debug( 'add_logged_in' ); // Allow Ajax vary change during login flow. // NOTE: Run before `$this->_update_default_vary()` to make vary changeable self::can_ajax_vary(); // Ensure vary cookie exists/updated. $this->_update_default_vary( $uid, $expire ); } /* * Remove user logged-in status. * * @since 1.1.3 * @since 1.6.2 Removed static referral. * @return void / public function remove_logged_in() { self::debug( 'remove_logged_in' ); // Allow Ajax vary change during logout flow. self::can_ajax_vary(); // Force update vary to remove login status. $this->_update_default_vary( -1 ); } /* * Allow vary to be changed for Ajax calls. * * @since 2.2.2 * @since 2.6 Changed to static. * @return void / public static function can_ajax_vary() { self::debug( '_can_change_vary -> true' ); self::$_can_change_vary = true; } /* * Whether we can change the default vary right now. * * @since 1.6.2 * @return bool / private function can_change_vary() { // Don't change on Ajax unless explicitly allowed (no webp header). if ( Router::is_ajax() && ! self::$_can_change_vary ) { self::debug( 'can_change_vary bypassed due to ajax call' ); return false; } // Allow only GET/POST. // POST request can set vary to fix #820789 login "loop" guest cache issue. if ( isset( $_SERVER['REQUEST_METHOD'] ) && 'GET' !== $_SERVER['REQUEST_METHOD'] && 'POST' !== $_SERVER['REQUEST_METHOD'] ) { self::debug( 'can_change_vary bypassed due to method not get/post' ); return false; } // Disable when crawler is making the request. if ( ! empty( $_SERVER['HTTP_USER_AGENT'] ) && 0 === strpos( wp_unslash( (string) $_SERVER['HTTP_USER_AGENT'] ), Crawler::FAST_USER_AGENT ) // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized ) { self::debug( 'can_change_vary bypassed due to crawler' ); return false; } if ( ! apply_filters( 'litespeed_can_change_vary', true ) ) { self::debug( 'can_change_vary bypassed due to litespeed_can_change_vary hook' ); return false; } return true; } /* * Update default vary cookie (idempotent within a request). * * @since 1.6.2 * @since 1.6.6.1 Guard to ensure single run. * * @param int\|false $uid User ID or false. * @param int\|false $expire Expiration timestamp (default: +2 days). * @return void / private function _update_default_vary( $uid = false, $expire = false ) { // Ensure header output only runs once. if ( ! defined( 'LITESPEED_DID_' . __FUNCTION__ ) ) { define( 'LITESPEED_DID_' . __FUNCTION__, true ); } else { self::debug2( '_update_default_vary bypassed due to run already' ); return; } // ESI shouldn't change vary (main page only). if ( defined( 'LSCACHE_IS_ESI' ) && LSCACHE_IS_ESI ) { self::debug2( '_update_default_vary bypassed due to ESI' ); return; } $vary = $this->finalize_default_vary( $uid ); $current_vary = self::has_vary(); if ( $current_vary !== $vary && 'commenter' !== $current_vary && $this->can_change_vary() ) { if ( ! $expire ) { $expire = time() + 2 DAY_IN_SECONDS; } $this->_cookie( $vary, (int) $expire ); } } /** * Get the current vary cookie name. * * @since 1.9.1 * @return string / public function get_vary_name() { return self::$_vary_name; } /* * Check if a user role is in a configured vary group. * * @since 1.2.0 * @since 3.0 Moved here from conf.cls. * * @param string $role User role(s), comma-separated. * @return int\|string Group ID or 0. / public function in_vary_group( $role ) { $group = 0; $vary_groups = $this->conf( Base::O_CACHE_VARY_GROUP ); $roles = explode( ',', $role ); $found = array_intersect( $roles, array_keys( (array) $vary_groups ) ); if ( $found ) { $groups = []; foreach ( $found as $curr_role ) { $groups[] = $vary_groups[ $curr_role ]; } $group = implode( ',', array_unique( $groups ) ); } elseif ( in_array( 'administrator', $roles, true ) ) { $group = 99; } if ( $group ) { self::debug2( 'role in vary_group [group] ' . $group ); } return $group; } /* * Finalize default vary cookie value for current user. * NOTE: Login process will also call this because it does not call wp hook as normal page loading. * * @since 1.6.2 * * @param int\|false $uid Optional user ID. * @return false\|string False for guests when no vary needed, or hashed vary. / public function finalize_default_vary( $uid = false ) { // Bypass vary for guests where applicable (avoid non-guest filenames for assets). if ( defined( 'LITESPEED_GUEST' ) && LITESPEED_GUEST ) { return false; } $vary = []; if ( $this->conf( Base::O_GUEST ) ) { $vary['guest_mode'] = 1; } if ( ! $uid ) { $uid = get_current_user_id(); } else { self::debug( 'uid: ' . $uid ); } // Get user role/group. $role = Router::get_role( $uid ); if ( $uid > 0 ) { $vary['logged-in'] = 1; if ( $role ) { // Parse role group from settings. $role_group = $this->in_vary_group( $role ); if ( $role_group ) { $vary['role'] = $role_group; } } // Admin bar preference. $pref = get_user_option( 'show_admin_bar_front', $uid ); self::debug2( 'show_admin_bar_front: ' . var_export( $pref, true ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_var_export $admin_bar = ( false === $pref \|\| 'true' === $pref ); if ( $admin_bar ) { $vary['admin_bar'] = 1; self::debug2( 'admin bar : true' ); } } else { self::debug( 'role id: failed, guest' ); } /* * Filter vary entries before hashing. * * @since 1.6 Added for Role Excludes for optimization cls * @since 1.6.2 Hooked to webp (legacy) * @since 3.0 Used by 3rd hooks too / $vary = apply_filters( 'litespeed_vary', $vary ); if ( ! $vary ) { return false; } ksort( $vary ); $list = []; foreach ( $vary as $key => $val ) { $list[] = $key . ':' . $val; } $res = implode( ';', $list ); if ( defined( 'LSCWP_LOG' ) ) { return $res; } // Encrypt in production. return md5( $this->conf( Base::HASH ) . $res ); } /* * Get hash of all varies that affect caching (current cookies + default + env). * * @since 4.0 * @return string / public function finalize_full_varies() { $vary = $this->_finalize_curr_vary_cookies( true ); $vary .= $this->finalize_default_vary( get_current_user_id() ); $vary .= $this->get_env_vary(); return $vary; } /* * Get request environment vary value (from server variables). * * @since 4.0 * @return string\|false / public function get_env_vary() { $env_vary = isset( $_SERVER['LSCACHE_VARY_VALUE'] ) ? wp_unslash( (string) $_SERVER['LSCACHE_VARY_VALUE'] ) : false; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized if ( ! $env_vary ) { $env_vary = isset( $_SERVER['HTTP_X_LSCACHE_VARY_VALUE'] ) ? wp_unslash( (string) $_SERVER['HTTP_X_LSCACHE_VARY_VALUE'] ) : false; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized } return $env_vary; } /* * Mark current user as commenter (called on comment submit). * * @since 1.1.6 * @return void / public function append_commenter() { $this->add_commenter( true ); } /* * Add commenter vary (optionally from redirect). * * @since 1.1.3 * * @param bool $from_redirect Whether request is from redirect page. * @return void / private function add_commenter( $from_redirect = false ) { // If the cookie is lost somehow, set it. if ( 'commenter' !== self::has_vary() ) { self::debug( 'Add commenter' ); // Save commenter status only for current domain path. $this->_cookie( 'commenter', time() + (int) apply_filters( 'comment_cookie_lifetime', 30000000 ), self::_relative_path( $from_redirect ) ); } } /* * Remove commenter vary if set. * * @since 1.1.3 * @return void / private function remove_commenter() { if ( 'commenter' === self::has_vary() ) { self::debug( 'Remove commenter' ); $this->_cookie( false, false, self::_relative_path() ); } } /* * Generate a relative cookie path from current request. * * @since 1.1.3 * * @param bool $from_redirect When true, uses HTTP_REFERER; otherwise SCRIPT_URL. * @return string\|false Path or false. / private static function _relative_path( $from_redirect = false ) { $path = false; $tag = $from_redirect ? 'HTTP_REFERER' : 'SCRIPT_URL'; if ( ! empty( $_SERVER[ $tag ] ) ) { $parsed = wp_parse_url( wp_unslash( (string) $_SERVER[ $tag ] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized $path = ! empty( $parsed['path'] ) ? $parsed['path'] : false; self::debug( 'Cookie Vary path: ' . ( $path ? $path : 'false' ) ); } return $path; } /* * Build the final X-LiteSpeed-Vary header for current request. * NOTE: Non caccheable page can still set vary ( for logged in process ). * * @since 1.0.13 * * @return string\|void Header string or nothing when not needed. / public function finalize() { // Finalize default vary for non-guest. if ( ! defined( 'LITESPEED_GUEST' ) \|\| ! LITESPEED_GUEST ) { $this->_update_default_vary(); } $tp_cookies = $this->_finalize_curr_vary_cookies(); if ( ! $tp_cookies ) { self::debug2( 'no customized vary' ); return; } self::debug( 'finalized 3rd party cookies', $tp_cookies ); return self::X_HEADER . ': ' . implode( ',', $tp_cookies ); } /* * Get vary cookies (names or values JSON) added for current page. * * @since 1.0.13 * * @param bool $values_json When true, returns JSON array of cookie values; else cookie=name items. * @return array\|string\|false List of vary cookie items, JSON string, or false when none. / private function _finalize_curr_vary_cookies( $values_json = false ) { global $post; $cookies = []; // No need to append default vary cookie name. if ( ! empty( $post->post_password ) ) { $postpass_key = 'wp-postpass_' . COOKIEHASH; if ( $this->_get_cookie_val( $postpass_key ) ) { self::debug( 'finalize bypassed due to password protected vary ' ); // If user has password cookie, do not cache & ignore existing vary cookies. Control::set_nocache( 'password protected vary' ); return false; } $cookies[] = $values_json ? $this->_get_cookie_val( $postpass_key ) : $postpass_key; } $cookies = apply_filters( 'litespeed_vary_curr_cookies', $cookies ); if ( $cookies ) { $cookies = array_filter( array_unique( $cookies ) ); self::debug( 'vary cookies changed by filter litespeed_vary_curr_cookies', $cookies ); } if ( ! $cookies ) { return false; } // Format cookie name data or value data. sort( $cookies ); // Maintain stable order for $values_json=true. foreach ( $cookies as $k => $v ) { $cookies[ $k ] = $values_json ? $this->_get_cookie_val( $v ) : 'cookie=' . $v; } return $values_json ? wp_json_encode( $cookies ) : $cookies; } /* * Get a cookie value safely. * * @since 4.0 * * @param string $key Cookie name. * @return false\|string Cookie value or false. / private function _get_cookie_val( $key ) { if ( ! empty( $_COOKIE[ $key ] ) ) { return wp_unslash( (string) $_COOKIE[ $key ] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized } return false; } /* * Set or clear the vary cookie. * * If the vary cookie changed, mark page as non-cacheable for this response. * * @since 1.0.4 * * @param int\|false $val Cookie value to set, or false to clear. * @param int $expire Expiration timestamp (ignored when $val is false). * @param string $path Cookie path (false to use COOKIEPATH). * @return void */ private function _cookie( $val = false, $expire = 0, $path = false ) { if ( ! $val ) { $expire = 1; } // HTTPS bypass toggle for clients using both HTTP/HTTPS. $is_ssl = $this->conf( Base::O_UTIL_NO_HTTPS_VARY ) ? false : is_ssl(); setcookie( self::$_vary_name, $val, (int) $expire, $path ? $path : COOKIEPATH, COOKIE_DOMAIN, $is_ssl, true ); self::debug( 'set_cookie ---> [k] ' . self::$_vary_name . ' [v] ' . ( false === $val ? 'false' : $val ) . ' [ttl] ' . ( (int) $expire - time() ) ); } } Back

Edit File : vary.cls.php | Size : 21.33 KB

<?php
/**
 * Manage the X-LiteSpeed-Vary behavior and vary cookie.
 *
 * @since   1.1.3
 * @package LiteSpeed
 */

namespace LiteSpeed;

defined( 'WPINC' ) || exit();

/**
 * Handles detection of user state (guest, logged-in, commenter, etc.)
 * and builds the X-LiteSpeed-Vary header and vary cookie accordingly.
 */
class Vary extends Root {

/**
	 * Log tag used in debug output.
	 *
	 * @var string
	 */
	const LOG_TAG = '🔱';

/**
	 * Vary header name.
	 *
	 * @var string
	 */
	const X_HEADER = 'X-LiteSpeed-Vary';

/**
	 * Default vary cookie name (used for logged-in/commenter state).
	 *
	 * @var string
	 */
	private static $_vary_name = '_lscache_vary';

/**
	 * Whether Ajax calls are permitted to change the vary cookie.
	 *
	 * @var bool
	 */
	private static $_can_change_vary = false;

/**
	 * Update the default vary cookie name if site settings require it.
	 *
	 * @since 4.0
	 * @since 7.0 Moved to after_user_init to allow ESI no-vary no conflict.
	 * @return void
	 */
	private function _update_vary_name() {
		$db_cookie = $this->conf( Base::O_CACHE_LOGIN_COOKIE ); // network aware in v3.0.

// If no vary set in rewrite rule.
		if ( ! isset( $_SERVER['LSCACHE_VARY_COOKIE'] ) ) {
			if ( $db_cookie ) {
				// Check for ESI no-vary control.
				$something_wrong = true;

if ( ! empty( $_GET[ ESI::QS_ACTION ] ) && ! empty( $_GET['_control'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
					$control_raw = wp_unslash( (string) $_GET['_control'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
					$control     = array_map( 'sanitize_text_field', explode( ',', $control_raw ) );
					if ( in_array( 'no-vary', $control, true ) ) {
						self::debug( 'no-vary control existed, bypass vary_name update' );
						$something_wrong  = false;
						self::$_vary_name = $db_cookie;
					}
				}

if ( defined( 'LITESPEED_CLI' ) || wp_doing_cron() ) {
					$something_wrong = false;
				}

if ( $something_wrong ) {
					// Display cookie error msg to admin.
					if ( is_multisite() ? is_network_admin() : is_admin() ) {
						Admin_Display::show_error_cookie();
					}
					Control::set_nocache( '❌❌ vary cookie setting error' );
				}
			}
			return;
		}

// DB setting does not exist – nothing to check.
		if ( ! $db_cookie ) {
			return;
		}

// Beyond this point, ensure DB vary is present in $_SERVER env.
		$server_raw = wp_unslash( (string) $_SERVER['LSCACHE_VARY_COOKIE'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
		$vary_arr   = array_map( 'trim', explode( ',', $server_raw ) );

if ( in_array( $db_cookie, $vary_arr, true ) ) {
			self::$_vary_name = $db_cookie;
			return;
		}

if ( is_multisite() ? is_network_admin() : is_admin() ) {
			Admin_Display::show_error_cookie();
		}
		Control::set_nocache( 'vary cookie setting lost error' );
	}

/**
	 * Run after user init to set up vary/caching for current request.
	 *
	 * @since 4.0
	 * @return void
	 */
	public function after_user_init() {
		$this->_update_vary_name();

// Logged-in user.
		if ( Router::is_logged_in() ) {
			// If not ESI, check cache logged-in user setting.
			if ( ! $this->cls( 'Router' )->esi_enabled() ) {
				// Cache logged-in => private cache.
				if ( $this->conf( Base::O_CACHE_PRIV ) && ! is_admin() ) {
					add_action( 'wp_logout', __NAMESPACE__ . '\Purge::purge_on_logout' );

$this->cls( 'Control' )->init_cacheable();
					Control::set_private( 'logged in user' );
				} else {
					// No cache for logged-in user.
					Control::set_nocache( 'logged in user' );
				}
			} elseif ( ! is_admin() ) {
				// ESI is on; can be public cache, but ensure cacheable is initialized.
				$this->cls( 'Control' )->init_cacheable();
			}

// Clear login state on logout.
			add_action( 'clear_auth_cookie', [ $this, 'remove_logged_in' ] );
		} else {
			// Only after vary init we can detect guest mode.
			$this->_maybe_guest_mode();

// Set vary cookie when user logs in (to avoid guest vary).
			add_action( 'set_logged_in_cookie', [ $this, 'add_logged_in' ], 10, 4 );
			add_action( 'wp_login', __NAMESPACE__ . '\Purge::purge_on_logout' );

$this->cls( 'Control' )->init_cacheable();

// Check login-page cacheable setting — login page doesn't go through main WP logic.
			add_action( 'login_init', [ $this->cls( 'Tag' ), 'check_login_cacheable' ], 5 );

// Optional lightweight guest vary updater.
			if ( ! empty( $_GET['litespeed_guest'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
				add_action( 'wp_loaded', [ $this, 'update_guest_vary' ], 20 );
			}
		}

// Commenter checks.
		add_filter( 'comments_array', [ $this, 'check_commenter' ] );

// Set vary cookie for commenter.
		add_action( 'set_comment_cookies', [ $this, 'append_commenter' ] );

// REST: don't change vary because they don't carry on user info usually.
		add_action(
			'rest_api_init',
			function () {
				self::debug( 'Rest API init disabled vary change' );
				add_filter( 'litespeed_can_change_vary', '__return_false' );
			}
		);
	}

/**
	 * Mark request as Guest mode when applicable.
	 *
	 * @since 4.0
	 * @return void
	 */
	private function _maybe_guest_mode() {
		if ( defined( 'LITESPEED_GUEST' ) ) {
			self::debug( '👒👒 Guest mode ' . ( LITESPEED_GUEST ? 'predefined' : 'turned off' ) );
			return;
		}

if ( ! $this->conf( Base::O_GUEST ) ) {
			return;
		}

// If vary is set, then not a guest.
		if ( self::has_vary() ) {
			return;
		}

// Admin QS present? not a guest.
		if ( ! empty( $_GET[ Router::ACTION ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
			return;
		}

if ( wp_doing_ajax() ) {
			return;
		}

if ( wp_doing_cron() ) {
			return;
		}

// Request to update vary? not a guest.
		if ( ! empty( $_GET['litespeed_guest'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
			return;
		}

// User explicitly turned guest off.
		if ( ! empty( $_GET['litespeed_guest_off'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
			return;
		}

self::debug( '👒👒 Guest mode' );

! defined( 'LITESPEED_GUEST' ) && define( 'LITESPEED_GUEST', true );

if ( $this->conf( Base::O_GUEST_OPTM ) ) {
			! defined( 'LITESPEED_GUEST_OPTM' ) && define( 'LITESPEED_GUEST_OPTM', true );
		}
	}

/**
	 * Update Guest vary
	 *
	 * @since      4.0
	 * @deprecated 4.1 Use independent lightweight guest.vary.php instead.
	 * @return void
	 */
	public function update_guest_vary() {
		// Must not be cached.
		! defined( 'LSCACHE_NO_CACHE' ) && define( 'LSCACHE_NO_CACHE', true );

$_guest = new Lib\Guest();
		if ( $_guest->always_guest() || self::has_vary() ) {
			// If contains vary already, don't reload (avoid loops).
			! defined( 'LITESPEED_GUEST' ) && define( 'LITESPEED_GUEST', true );
			self::debug( '🤠🤠 Guest' );
			echo '[]';
			exit;
		}

self::debug( 'Will update guest vary in finalize' );

// Return JSON to trigger reload.
		echo wp_json_encode( [ 'reload' => 'yes' ] );
		exit;
	}

/**
	 * Filter callback on `comments_array` to mark commenter state.
	 *
	 * @since 1.0.4
	 *
	 * @param array $comments The comments to output.
	 * @return array Filtered comments.
	 */
	public function check_commenter( $comments ) {
		/**
		 * Allow bypassing pending comment check for comment plugins.
		 *
		 * @since 2.9.5
		 */
		if ( apply_filters( 'litespeed_vary_check_commenter_pending', true ) ) {
			$pending = false;
			foreach ( $comments as $comment ) {
				if ( ! $comment->comment_approved ) {
					$pending = true;
					break;
				}
			}

// No pending comments => ensure public cache state.
			if ( ! $pending ) {
				self::debug( 'No pending comment' );
				$this->remove_commenter();

// Remove commenter prefilled info for public cache.
				foreach ( $_COOKIE as $cookie_name => $cookie_value ) {
					if ( strlen( $cookie_name ) >= 15 && 0 === strpos( $cookie_name, 'comment_author_' ) ) {
						unset( $_COOKIE[ $cookie_name ] );
					}
				}

return $comments;
			}
		}

// Pending comments present — set commenter vary.
		$this->add_commenter();

if ( $this->conf( Base::O_CACHE_COMMENTER ) ) {
			Control::set_private( 'existing commenter' );
		} else {
			Control::set_nocache( 'existing commenter' );
		}

return $comments;
	}

/**
	 * Check if default vary has a value
	 *
	 * @since 1.1.3
	 *
	 * @return false|string Cookie value or false if missing.
	 */
	public static function has_vary() {
		if ( empty( $_COOKIE[ self::$_vary_name ] ) ) {
			return false;
		}
		// Cookie values are not user-displayed; unslash only.
		return wp_unslash( (string) $_COOKIE[ self::$_vary_name ] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
	}

/**
	 * Append user status with logged-in.
	 *
	 * @since 1.1.3
	 * @since 1.6.2 Removed static referral.
	 *
	 * @param string|false $logged_in_cookie The logged-in cookie value.
	 * @param int|false    $expire           Expiration timestamp.
	 * @param int|false    $expiration       Unused (WordPress signature).
	 * @param int|false    $uid              User ID.
	 * @return void
	 */
	public function add_logged_in( $logged_in_cookie = false, $expire = false, $expiration = false, $uid = false ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed
		self::debug( 'add_logged_in' );

// Allow Ajax vary change during login flow.
		// NOTE: Run before `$this->_update_default_vary()` to make vary changeable
		self::can_ajax_vary();

// Ensure vary cookie exists/updated.
		$this->_update_default_vary( $uid, $expire );
	}

/**
	 * Remove user logged-in status.
	 *
	 * @since 1.1.3
	 * @since 1.6.2 Removed static referral.
	 * @return void
	 */
	public function remove_logged_in() {
		self::debug( 'remove_logged_in' );

// Allow Ajax vary change during logout flow.
		self::can_ajax_vary();

// Force update vary to remove login status.
		$this->_update_default_vary( -1 );
	}

/**
	 * Allow vary to be changed for Ajax calls.
	 *
	 * @since 2.2.2
	 * @since 2.6 Changed to static.
	 * @return void
	 */
	public static function can_ajax_vary() {
		self::debug( '_can_change_vary -> true' );
		self::$_can_change_vary = true;
	}

/**
	 * Whether we can change the default vary right now.
	 *
	 * @since 1.6.2
	 * @return bool
	 */
	private function can_change_vary() {
		// Don't change on Ajax unless explicitly allowed (no webp header).
		if ( Router::is_ajax() && ! self::$_can_change_vary ) {
			self::debug( 'can_change_vary bypassed due to ajax call' );
			return false;
		}

// Allow only GET/POST.
		// POST request can set vary to fix #820789 login "loop" guest cache issue.
		if (
			isset( $_SERVER['REQUEST_METHOD'] )
			&& 'GET' !== $_SERVER['REQUEST_METHOD']
			&& 'POST' !== $_SERVER['REQUEST_METHOD']
		) {
			self::debug( 'can_change_vary bypassed due to method not get/post' );
			return false;
		}

// Disable when crawler is making the request.
		if (
			! empty( $_SERVER['HTTP_USER_AGENT'] )
			&& 0 === strpos( wp_unslash( (string) $_SERVER['HTTP_USER_AGENT'] ), Crawler::FAST_USER_AGENT ) // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
		) {
			self::debug( 'can_change_vary bypassed due to crawler' );
			return false;
		}

if ( ! apply_filters( 'litespeed_can_change_vary', true ) ) {
			self::debug( 'can_change_vary bypassed due to litespeed_can_change_vary hook' );
			return false;
		}

return true;
	}

/**
	 * Update default vary cookie (idempotent within a request).
	 *
	 * @since 1.6.2
	 * @since 1.6.6.1 Guard to ensure single run.
	 *
	 * @param int|false $uid    User ID or false.
	 * @param int|false $expire Expiration timestamp (default: +2 days).
	 * @return void
	 */
	private function _update_default_vary( $uid = false, $expire = false ) {
		// Ensure header output only runs once.
		if ( ! defined( 'LITESPEED_DID_' . __FUNCTION__ ) ) {
			define( 'LITESPEED_DID_' . __FUNCTION__, true );
		} else {
			self::debug2( '_update_default_vary bypassed due to run already' );
			return;
		}

// ESI shouldn't change vary (main page only).
		if ( defined( 'LSCACHE_IS_ESI' ) && LSCACHE_IS_ESI ) {
			self::debug2( '_update_default_vary bypassed due to ESI' );
			return;
		}

$vary         = $this->finalize_default_vary( $uid );
		$current_vary = self::has_vary();

if ( $current_vary !== $vary && 'commenter' !== $current_vary && $this->can_change_vary() ) {
			if ( ! $expire ) {
				$expire = time() + 2 * DAY_IN_SECONDS;
			}
			$this->_cookie( $vary, (int) $expire );
		}
	}

/**
	 * Get the current vary cookie name.
	 *
	 * @since 1.9.1
	 * @return string
	 */
	public function get_vary_name() {
		return self::$_vary_name;
	}

/**
	 * Check if a user role is in a configured vary group.
	 *
	 * @since 1.2.0
	 * @since 3.0 Moved here from conf.cls.
	 *
	 * @param string $role User role(s), comma-separated.
	 * @return int|string Group ID or 0.
	 */
	public function in_vary_group( $role ) {
		$group       = 0;
		$vary_groups = $this->conf( Base::O_CACHE_VARY_GROUP );

$roles = explode( ',', $role );
		$found = array_intersect( $roles, array_keys( (array) $vary_groups ) );

if ( $found ) {
			$groups = [];
			foreach ( $found as $curr_role ) {
				$groups[] = $vary_groups[ $curr_role ];
			}
			$group = implode( ',', array_unique( $groups ) );
		} elseif ( in_array( 'administrator', $roles, true ) ) {
			$group = 99;
		}

if ( $group ) {
			self::debug2( 'role in vary_group [group] ' . $group );
		}

return $group;
	}

/**
	 * Finalize default vary cookie value for current user.
	 * NOTE: Login process will also call this because it does not call wp hook as normal page loading.
	 *
	 * @since 1.6.2
	 *
	 * @param int|false $uid Optional user ID.
	 * @return false|string False for guests when no vary needed, or hashed vary.
	 */
	public function finalize_default_vary( $uid = false ) {
		// Bypass vary for guests where applicable (avoid non-guest filenames for assets).
		if ( defined( 'LITESPEED_GUEST' ) && LITESPEED_GUEST ) {
			return false;
		}

$vary = [];

if ( $this->conf( Base::O_GUEST ) ) {
			$vary['guest_mode'] = 1;
		}

if ( ! $uid ) {
			$uid = get_current_user_id();
		} else {
			self::debug( 'uid: ' . $uid );
		}

// Get user role/group.
		$role = Router::get_role( $uid );

if ( $uid > 0 ) {
			$vary['logged-in'] = 1;

if ( $role ) {
				// Parse role group from settings.
				$role_group = $this->in_vary_group( $role );
				if ( $role_group ) {
					$vary['role'] = $role_group;
				}
			}

// Admin bar preference.
			$pref = get_user_option( 'show_admin_bar_front', $uid );
			self::debug2( 'show_admin_bar_front: ' . var_export( $pref, true ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_var_export
			$admin_bar = ( false === $pref || 'true' === $pref );

if ( $admin_bar ) {
				$vary['admin_bar'] = 1;
				self::debug2( 'admin bar : true' );
			}
		} else {
			self::debug( 'role id: failed, guest' );
		}

/**
		 * Filter vary entries before hashing.
		 *
		 * @since 1.6 Added for Role Excludes for optimization cls
		 * @since 1.6.2 Hooked to webp (legacy)
		 * @since 3.0 Used by 3rd hooks too
		 */
		$vary = apply_filters( 'litespeed_vary', $vary );

if ( ! $vary ) {
			return false;
		}

ksort( $vary );
		$list = [];
		foreach ( $vary as $key => $val ) {
			$list[] = $key . ':' . $val;
		}

$res = implode( ';', $list );
		if ( defined( 'LSCWP_LOG' ) ) {
			return $res;
		}
		// Encrypt in production.
		return md5( $this->conf( Base::HASH ) . $res );
	}

/**
	 * Get hash of all varies that affect caching (current cookies + default + env).
	 *
	 * @since 4.0
	 * @return string
	 */
	public function finalize_full_varies() {
		$vary  = $this->_finalize_curr_vary_cookies( true );
		$vary .= $this->finalize_default_vary( get_current_user_id() );
		$vary .= $this->get_env_vary();
		return $vary;
	}

/**
	 * Get request environment vary value (from server variables).
	 *
	 * @since 4.0
	 * @return string|false
	 */
	public function get_env_vary() {
		$env_vary = isset( $_SERVER['LSCACHE_VARY_VALUE'] ) ? wp_unslash( (string) $_SERVER['LSCACHE_VARY_VALUE'] ) : false; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
		if ( ! $env_vary ) {
			$env_vary = isset( $_SERVER['HTTP_X_LSCACHE_VARY_VALUE'] ) ? wp_unslash( (string) $_SERVER['HTTP_X_LSCACHE_VARY_VALUE'] ) : false; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
		}
		return $env_vary;
	}

/**
	 * Mark current user as commenter (called on comment submit).
	 *
	 * @since 1.1.6
	 * @return void
	 */
	public function append_commenter() {
		$this->add_commenter( true );
	}

/**
	 * Add commenter vary (optionally from redirect).
	 *
	 * @since 1.1.3
	 *
	 * @param bool $from_redirect Whether request is from redirect page.
	 * @return void
	 */
	private function add_commenter( $from_redirect = false ) {
		// If the cookie is lost somehow, set it.
		if ( 'commenter' !== self::has_vary() ) {
			self::debug( 'Add commenter' );

// Save commenter status only for current domain path.
			$this->_cookie(
				'commenter',
				time() + (int) apply_filters( 'comment_cookie_lifetime', 30000000 ),
				self::_relative_path( $from_redirect )
			);
		}
	}

/**
	 * Remove commenter vary if set.
	 *
	 * @since 1.1.3
	 * @return void
	 */
	private function remove_commenter() {
		if ( 'commenter' === self::has_vary() ) {
			self::debug( 'Remove commenter' );
			$this->_cookie( false, false, self::_relative_path() );
		}
	}

/**
	 * Generate a relative cookie path from current request.
	 *
	 * @since 1.1.3
	 *
	 * @param bool $from_redirect When true, uses HTTP_REFERER; otherwise SCRIPT_URL.
	 * @return string|false Path or false.
	 */
	private static function _relative_path( $from_redirect = false ) {
		$path = false;
		$tag  = $from_redirect ? 'HTTP_REFERER' : 'SCRIPT_URL';
		if ( ! empty( $_SERVER[ $tag ] ) ) {
			$parsed = wp_parse_url( wp_unslash( (string) $_SERVER[ $tag ] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
			$path   = ! empty( $parsed['path'] ) ? $parsed['path'] : false;
			self::debug( 'Cookie Vary path: ' . ( $path ? $path : 'false' ) );
		}
		return $path;
	}

/**
	 * Build the final X-LiteSpeed-Vary header for current request.
	 * NOTE: Non caccheable page can still set vary ( for logged in process ).
	 *
	 * @since 1.0.13
	 *
	 * @return string|void Header string or nothing when not needed.
	 */
	public function finalize() {
		// Finalize default vary for non-guest.
		if ( ! defined( 'LITESPEED_GUEST' ) || ! LITESPEED_GUEST ) {
			$this->_update_default_vary();
		}

$tp_cookies = $this->_finalize_curr_vary_cookies();

if ( ! $tp_cookies ) {
			self::debug2( 'no customized vary' );
			return;
		}

self::debug( 'finalized 3rd party cookies', $tp_cookies );

return self::X_HEADER . ': ' . implode( ',', $tp_cookies );
	}

/**
	 * Get vary cookies (names or values JSON) added for current page.
	 *
	 * @since 1.0.13
	 *
	 * @param bool $values_json When true, returns JSON array of cookie values; else cookie=name items.
	 * @return array|string|false List of vary cookie items, JSON string, or false when none.
	 */
	private function _finalize_curr_vary_cookies( $values_json = false ) {
		global $post;

$cookies = []; // No need to append default vary cookie name.

if ( ! empty( $post->post_password ) ) {
			$postpass_key = 'wp-postpass_' . COOKIEHASH;
			if ( $this->_get_cookie_val( $postpass_key ) ) {
				self::debug( 'finalize bypassed due to password protected vary ' );
				// If user has password cookie, do not cache & ignore existing vary cookies.
				Control::set_nocache( 'password protected vary' );
				return false;
			}

$cookies[] = $values_json ? $this->_get_cookie_val( $postpass_key ) : $postpass_key;
		}

$cookies = apply_filters( 'litespeed_vary_curr_cookies', $cookies );
		if ( $cookies ) {
			$cookies = array_filter( array_unique( $cookies ) );
			self::debug( 'vary cookies changed by filter litespeed_vary_curr_cookies', $cookies );
		}

if ( ! $cookies ) {
			return false;
		}

// Format cookie name data or value data.
		sort( $cookies ); // Maintain stable order for $values_json=true.
		foreach ( $cookies as $k => $v ) {
			$cookies[ $k ] = $values_json ? $this->_get_cookie_val( $v ) : 'cookie=' . $v;
		}

return $values_json ? wp_json_encode( $cookies ) : $cookies;
	}

/**
	 * Get a cookie value safely.
	 *
	 * @since 4.0
	 *
	 * @param string $key Cookie name.
	 * @return false|string Cookie value or false.
	 */
	private function _get_cookie_val( $key ) {
		if ( ! empty( $_COOKIE[ $key ] ) ) {
			return wp_unslash( (string) $_COOKIE[ $key ] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
		}

return false;
	}

/**
	 * Set or clear the vary cookie.
	 *
	 * If the vary cookie changed, mark page as non-cacheable for this response.
	 *
	 * @since 1.0.4
	 *
	 * @param int|false $val    Cookie value to set, or false to clear.
	 * @param int       $expire Expiration timestamp (ignored when $val is false).
	 * @param string    $path   Cookie path (false to use COOKIEPATH).
	 * @return void
	 */
	private function _cookie( $val = false, $expire = 0, $path = false ) {
		if ( ! $val ) {
			$expire = 1;
		}

// HTTPS bypass toggle for clients using both HTTP/HTTPS.
		$is_ssl = $this->conf( Base::O_UTIL_NO_HTTPS_VARY ) ? false : is_ssl();

setcookie( self::$_vary_name, $val, (int) $expire, $path ? $path : COOKIEPATH, COOKIE_DOMAIN, $is_ssl, true );
		self::debug( 'set_cookie ---> [k] ' . self::$_vary_name . ' [v] ' . ( false === $val ? 'false' : $val ) . ' [ttl] ' . ( (int) $expire - time() ) );
	}
}

Back