Update-notice cron ignores the global 'enabled' switch #10

New issue

Closed

opened 2026-10-16 21:07:23 -07:00 by eric · 0 comments

eric commented

2026-10-16 21:07:23 -07:00

Owner

Found during security audit run 3 (2026-10-16). This is a functional bug, not a security issue.

Problem

The update-notice cron is scheduled and run based only on the update_check setting (Apprise_Update_Checker::register() and run_update_check_cron(), includes/class-apprise-update-checker.php:154-174, 335-345). It ignores the global enabled switch. A site with the plugin turned off, but "Check for Updates" still on, keeps POSTing update notices to the configured Apprise URL.

Fix

Schedule and run the Apprise notice only when enabled is also true.
Keep the core update_plugins_git.pickysysadmin.ca filter tied to update_check alone, so one-click updates still work while notifications are off.
register() already unschedules the event when $notify is false. Add enabled to that condition.
Test: update_check on with enabled off means the cron is not scheduled, and run_update_check_cron() sends nothing.

Found during security audit run 3 (2026-10-16). This is a functional bug, not a security issue. ## Problem The update-notice cron is scheduled and run based only on the `update_check` setting (`Apprise_Update_Checker::register()` and `run_update_check_cron()`, `includes/class-apprise-update-checker.php:154-174, 335-345`). It ignores the global `enabled` switch. A site with the plugin turned off, but "Check for Updates" still on, keeps POSTing update notices to the configured Apprise URL. ## Fix - Schedule and run the Apprise **notice** only when `enabled` is also true. - Keep the core `update_plugins_git.pickysysadmin.ca` filter tied to `update_check` alone, so one-click updates still work while notifications are off. - `register()` already unschedules the event when `$notify` is false. Add `enabled` to that condition. - Test: `update_check` on with `enabled` off means the cron is not scheduled, and `run_update_check_cron()` sends nothing.

eric added the

bug

label

2026-10-16 21:07:23 -07:00

eric referenced this issue from a commit

2026-10-16 22:08:20 -07:00

fix: update-notice cron respects the global enabled switch

eric closed this issue

2026-10-16 22:08:20 -07:00

eric referenced this issue from a commit

2026-10-16 22:13:32 -07:00

docs: review README and readme.txt against the code