Plugin breaks WordPress search functionality for non-logged-in users

[Alvaroeai]

Hello,
I'm writing to report a bug I've encountered with the Ally plugin that breaks the native WordPress search functionality.
The Problem:
When the plugin is active, the search functionality (/?s=query) does not work for users who are not logged in. Instead of showing the search results page, it reloads the current page (e.g., the homepage).
Initially, I suspected the issue might be a conflict with other plugins like WP-Rocket or Polylang. However, after deactivating both and seeing the problem persist, I noticed the "Clear cache" option within the Ally plugin's settings. This led me to investigate how the plugin handles caching. Ultimately, I confirmed that deactivating the Ally plugin was the only action that restored the search functionality.
Technical Cause:
After investigating the plugin's code, I've identified the root cause of the issue within the Remediation module. This module uses an output buffer and a page caching system to apply accessibility fixes.
The problem lies in the get_current_page_url() function located in the file modules/remediation/classes/utils.php. This function strips the query string from the URL when generating the page identifier for its cache. As a result, a URL like https://example.com/ and a search URL like https://example.com/?s=search-term are treated as the same page. The plugin then serves the cached version of the homepage instead of generating the search results.
The Solution:
I was able to fix the issue by making a small change to the get_current_page_url() function to ensure it preserves the URL's query string.
Here is the required code change in modules/remediation/classes/utils.php:
Original Code:
// ...
$request_uri = isset( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
$path = wp_parse_url( $request_uri, PHP_URL_PATH ); // removes query string
return rtrim( home_url( $path ), '/' );
// ...

Fixed Code:
// ...
$request_uri = isset( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
return rtrim( home_url( $request_uri ), '/' );
// ...

By removing the line that parses the URL path, the full request URI (including the query string) is used, which correctly differentiates the search results page from other pages in the cache.
I hope this report is helpful for the development team.

Best regards.