Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

INS-2936: Fix all Plugin Checker issues #46

Merged
merged 4 commits into from
Apr 3, 2024
Merged

INS-2936: Fix all Plugin Checker issues #46

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ffeb10f
INS-2937: Change order of script for gutenberg script
jespernpedersen Apr 2, 2024
7a28983
Revert commit from other PR
jespernpedersen Apr 2, 2024
7ed460e
Merge remote-tracking branch 'origin/master' into INS-2937
jespernpedersen Apr 3, 2024
4c3ee65
INS-2936: Fix nonce verification
jespernpedersen Apr 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions siteimprove/admin/class-siteimprove-admin.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,8 @@ public function gutenberg_siteimprove_plugin() {
'gutenberg-siteimprove-plugin',
plugin_dir_url( __FILE__ ) . 'js/siteimprove-gutenberg.js',
array( 'wp-plugins', 'wp-edit-post', 'wp-element', 'siteimprove' ),
true
$this->version,
false
);
$si_js_args = array(
'token' => get_option( 'siteimprove_token' ),
Expand Down Expand Up @@ -188,6 +189,7 @@ private function siteimprove_add_js( $url, $type ) {
$file_name = get_option( 'siteimprove_overlayjs_file', 'overlay-v2-dev.js' );
$disabled_new_version = get_option( 'siteimprove_disable_new_version' );
$pattern = '/^[a-zA-Z_\d-]+.js/';
$nonce = wp_create_nonce( 'siteimprove_nonce' );

if ( ! empty( $file_name ) ) {
if ( preg_match( $pattern, $file_name ) ) {
Expand All @@ -202,7 +204,11 @@ private function siteimprove_add_js( $url, $type ) {
$overlay_path = Siteimprove::JS_LIBRARY_URL . 'overlay-v1.js';
}
}
if ( ! isset( $_GET['si_preview'] ) || '0' === $_GET['si_preview'] ) {

if ( isset( $_GET['si_preview_nonce'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['si_preview_nonce'] ) ), 'siteimprove_nonce' ) ) {
return;
}
else {
wp_enqueue_script( $this->plugin_name, plugin_dir_url( __FILE__ ) . 'js/siteimprove.js', array( 'jquery' ), $this->version, false );
wp_enqueue_script( 'siteimprove_overlay', $overlay_path, array(), $this->version, true );
}
Expand All @@ -221,6 +227,7 @@ private function siteimprove_add_js( $url, $type ) {
'url' => $url,
'version' => $disabled_new_version,
'is_content_page' => $is_content_page,
'nonce' => $nonce,
);

wp_localize_script(
Expand Down
16 changes: 11 additions & 5 deletions siteimprove/admin/js/siteimprove.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,13 @@
(function ($) {
"use strict";

const getDom = async function (url) {
const getDom = async function (url, nonce) {
console.log(nonce);
const iframeContainer = document.createElement("div");
iframeContainer.setAttribute("id", "div_iframe");
document.body.appendChild(iframeContainer);
const separator = url.includes("?") ? "&" : "?";
iframeContainer.innerHTML = `<iframe id='domIframe' src=${url}${separator}si_preview=1 style='height:100vh; width:100%'></iframe>`;
iframeContainer.innerHTML = `<iframe id='domIframe' src=${url}${separator}si_preview_nonce=${nonce} style='height:100vh; width:100%'></iframe>`;
const iframe = document.getElementById("domIframe");
const promise = new Promise(function (resolve, reject) {
iframe.addEventListener(
Expand All @@ -36,12 +37,13 @@
};

window.siteimprove = {
input: function (url, token, version, is_content_page) {
input: function (url, token, version, is_content_page, nonce) {
this.url = url;
this.token = token;
this.method = "input";
this.version = version;
this.is_content_page = is_content_page;
this.nonce = nonce;
this.common(url);
},
domain: function (url, token) {
Expand Down Expand Up @@ -232,7 +234,7 @@

// If exist siteimprove_input, call input Siteimprove method.
if (typeof siteimprove_input !== "undefined") {
siteimprove.input(siteimprove_input.url, siteimprove_input.token, siteimprove_input.version, siteimprove_input.is_content_page);
siteimprove.input(siteimprove_input.url, siteimprove_input.token, siteimprove_input.version, siteimprove_input.is_content_page, siteimprove_input.nonce);
}

// If exist siteimprove_domain, call domain Siteimprove method.
Expand Down Expand Up @@ -262,20 +264,23 @@
var result = {
url: window.location.href,
token: "",
nonce: "",
};

if (typeof siteimprove_input !== "undefined") {
if (typeof siteimprove_input.url !== "undefined") {
result.url = siteimprove_input.url;
}
result.token = siteimprove_input.token;
result.nonce = siteimprove_input.nonce;
}

if (typeof siteimprove_domain !== "undefined") {
if (typeof siteimprove_domain.url !== "undefined") {
result.url = siteimprove_domain.url;
}
result.token = siteimprove_domain.token;
result.nonce = siteimprove_domain.nonce;
}
return result;
};
Expand All @@ -286,7 +291,8 @@
var si_prepublish_data = siGetCurrentUrlAndToken();
evt.preventDefault();
$("body").append('<div class="si-overlay"></div>');
var dom = await getDom(si_prepublish_data.url);
console.log(si_prepublish_data);
var dom = await getDom(si_prepublish_data.url, si_prepublish_data.nonce);
siteimprove.contentcheck_flatdom(
dom,
si_prepublish_data.url,
Expand Down
2 changes: 1 addition & 1 deletion siteimprove/admin/partials/class-siteimprove-admin-settings.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@ public function register_section() {
);

// Register a new section in the siteimprove page.
if ( isset( $_GET['devmode'] ) ) {
if ( isset( $_GET['devmode'] ) && wp_verify_nonce( sanitize_key( $_REQUEST['_wpnonce'] ), 'siteimprove-options' ) ) {
add_settings_section(
'siteimprove_dev_mode_section',
__( 'Dev Mode', 'siteimprove' ),
Expand Down
18 changes: 8 additions & 10 deletions siteimprove/includes/class-siteimprove.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,16 +146,14 @@ private function define_admin_hooks() {
$this->loader->add_action( 'siteimprove_before_settings_form', $plugin_admin, 'siteimprove_before_settings_form' );

// Siteimprove Actions.
if ( ! isset( $_GET['si_preview'] ) || '0' === $_GET['si_preview'] ) {
$this->loader->add_action( 'admin_init', $plugin_admin, 'siteimprove_init' );
$this->loader->add_action( 'publish_page', $plugin_admin, 'siteimprove_save_session_url_post' );
$this->loader->add_action( 'publish_post', $plugin_admin, 'siteimprove_save_session_url_post' );
$this->loader->add_action( 'edit_term', $plugin_admin, 'siteimprove_save_session_url_term', 10, 3 );
$this->loader->add_action( 'create_term', $plugin_admin, 'siteimprove_save_session_url_term', 10, 3 );
$this->loader->add_action( 'transition_post_status', $plugin_admin, 'siteimprove_save_session_url_product', 10, 3 );
$this->loader->add_action( 'wp_head', $plugin_admin, 'siteimprove_wp_head' );
$this->loader->add_action( 'admin_bar_menu', $plugin_admin, 'add_prepublish_toolbar_item', 500, 1 );
}
$this->loader->add_action( 'admin_init', $plugin_admin, 'siteimprove_init', $nonce );
$this->loader->add_action( 'publish_page', $plugin_admin, 'siteimprove_save_session_url_post' );
$this->loader->add_action( 'publish_post', $plugin_admin, 'siteimprove_save_session_url_post' );
$this->loader->add_action( 'edit_term', $plugin_admin, 'siteimprove_save_session_url_term', 10, 3 );
$this->loader->add_action( 'create_term', $plugin_admin, 'siteimprove_save_session_url_term', 10, 3 );
$this->loader->add_action( 'transition_post_status', $plugin_admin, 'siteimprove_save_session_url_product', 10, 3 );
$this->loader->add_action( 'wp_head', $plugin_admin, 'siteimprove_wp_head' );
$this->loader->add_action( 'admin_bar_menu', $plugin_admin, 'add_prepublish_toolbar_item', 500, 1 );
}

/**
Expand Down
Loading