Short stored license keys crash admin editor license-data rendering

Summary

Opening the WordPress post editor can terminate with a ValueError while Revive Social prepares license display data.

Expected behavior: License information is rendered safely, including when the stored key is missing or shorter than the displayed suffix length.

Actual behavior: A short stored key causes an uncaught str_repeat() argument error during the admin request.

Impact: The affected administrator cannot open the post editor until the triggering license data is no longer processed.

Customer context

• Product / area: Revive Social (tweet-old-post), admin license-data bootstrap
• Version: 9.4.1
• Environment: WordPress 7.0.3; PHP 8.2.32 and 8.2.33
• Integration / third party: Pro license data option
• Reported error / symptom: ValueError: str_repeat(): Argument #2 ($times) must be greater than or equal to 0
• Impact: Two production crash occurrences across one distinct site, on admin post-editor requests, between 2026-08-08 and 2026-08-11 UTC.

Reproduction notes

1. Activate the Pro companion so ROP_PRO_VERSION is defined.
2. Ensure the persisted Pro license-data object contains a license property and a key shorter than four characters.
3. Open a WordPress post editor.

Reported result: The admin request reaches get_license_data_view() and throws ValueError: str_repeat(): Argument #2 ($times) must be greater than or equal to 0.

Reproduction status: Confirmed from production stack trace and direct source inspection; a local WordPress runtime reproduction was not run.

Diagnosis

Conclusion

The crash is confirmed in product code. Telemetry identifies includes/admin/class-rop-global-settings.php:606, and that line computes the str_repeat() count as the license-key byte length minus four without a lower bound. The recorded ValueError proves this count was negative for the affected stored value.

Where this likely occurs

• includes/admin/class-rop-global-settings.php:578-609 — Rop_Global_Settings::get_license_data_view() reads the persisted Pro-license object and, at line 606, builds passwordMask with str_repeat( '*', strlen( $license_data->key ) - 4 ).
• includes/admin/class-rop-admin.php:351-355 — Rop_Admin::enqueue_scripts() unconditionally obtains license_data_view while preparing admin script settings. The supplied stack trace reaches this call from the block editor admin request.
• includes/admin/class-rop-global-settings.php:552-568 — Rop_Global_Settings::get_license_data() verifies the option is nonempty and has a license property, but this inspected path has no equivalent length check for the optional key property before display masking.
• The masking expression was introduced in commit 4e0f6cadd (fix: move the license field to dashboard) and is present in v9.1.0. Local history shows no change to this file in the v9.4.1 release range.

Engineering notes

• The affected branch requires the Pro companion constant and a nonempty tweet_old_post_pro_license_data object containing both license and key.
• The fault is in the free plugin repository, not the bundled Themeisle SDK; telemetry explicitly marks the crash location as outside SDK code.
• The available code does not establish how a key shorter than four characters reached the option. The production exception is direct evidence that such a value can reach this display path.
• PHP 8.2 reports a negative repetition count as an uncaught ValueError; compatibility behavior on older PHP versions was not inspected.

Test coverage status

No direct coverage for Rop_Global_Settings::get_license_data_view(), license_data_view, or passwordMask was found under tests/ during inspection. tests/test-plugin.php:47-57 covers Rop_Global_Settings::license_type() default behavior, not license-key display masking.

What to verify or explore next

• Reproduce with the Pro companion active and a stored license-data object whose license property is present and whose key contains fewer than four characters, then open a post editor.
• Run the relevant PHPUnit suite after exercising the public admin/license-display path.
• Check whether license activation, migration, or failed validation workflows can persist empty or truncated key values.
• Confirm behavior on supported PHP versions other than the reported PHP 8.2 environment.

Unknowns / follow-up

• The telemetry report does not include the stored key length or the workflow that created it.
• No customer-specific site access or runtime reproduction was available or used.

Confidence

Confidence: 98/100

Production telemetry records two uncaught PHP 8.2 ValueError occurrences in Revive Social 9.4.1 at a source expression that passes strlen( $license_data->key ) - 4 directly to str_repeat(). The captured exception establishes that the persisted key value was shorter than four characters on the affected site.

Crash telemetry

Occurrences	2
Distinct sites	1
First seen	2026-08-08 19:14 UTC
Last seen	2026-08-11 18:39 UTC
Crash location	product:includes/admin/class-rop-global-settings.php:606
Request context	admin
Inside Themeisle SDK	no
Product versions	9.4.1
WP versions	7.0.3
PHP versions	8.2.32, 8.2.33
SDK versions	3.3.58

---

Source: automated crash report — tweet-old-post, fingerprint c6ec81c7f6cf05a4b9f64a45816fa85f
Generated by bug-report-triage (ID: bug-report-triage_6a7c0c09675892.15372453)