Skip to content

Commit ceeb6c7

Browse files
mcguffinmcguffin
committed
security audit
1 parent 870405f commit ceeb6c7

File tree

10 files changed

+97
-20
lines changed

10 files changed

+97
-20
lines changed

‎.editorconfig

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ charset = utf-8
99
trim_trailing_whitespace = true
1010
insert_final_newline = true
1111

12-
[{package.json, .eslintrc, *.yml}]
12+
[{package.json, composer.json, .eslintrc, *.yml}]
1313
indent_style = space
1414
indent_size = 2
1515

‎.gitignore

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,8 @@
1010
.svnignore
1111
.sass-cache
1212
node_modules/
13+
vendor/
14+
!/include/vendor/
15+
16+
# phpcs
17+
phpcs-report.txt

‎composer.json

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,34 @@
44
"type": "wordpress-plugin",
55
"minimum-stability": "dev",
66
"license": "GPL-3.0-or-later",
7+
"homepage": "https://github.com/mcguffin/acf-customizer",
8+
"keywords": [
9+
"ACF",
10+
"Repeater",
11+
"WordPress",
12+
"Plugin"
13+
],
714
"authors": [
8-
{
9-
"name": "Jörn Lund"
10-
}
15+
{
16+
"name": "Jörn Lund"
17+
}
1118
],
1219
"require": {
13-
"composer/installers": "~1.0"
20+
"composer/installers": "~1.2",
21+
"php": ">=5.6.0"
22+
},
23+
"require-dev": {
24+
"squizlabs/php_codesniffer": "*",
25+
"wp-coding-standards/wpcs": "*",
26+
"phpcompatibility/php-compatibility": "*",
27+
"pheromone/phpcs-security-audit":"*"
28+
},
29+
"scripts": {
30+
"post-install-cmd": [
31+
"[ -f vendor/bin/phpcs ] && \"vendor/bin/phpcs\" --config-set installed_paths vendor/wp-coding-standards/wpcs,vendor/pheromone/phpcs-security-audit || true"
32+
],
33+
"post-update-cmd": [
34+
"[ -f vendor/bin/phpcs ] && \"vendor/bin/phpcs\" --config-set installed_paths vendor/wp-coding-standards/wpcs,vendor/pheromone/phpcs-security-audit || true"
35+
]
1436
}
15-
}
37+
}

‎include/ACFCustomizer/Compat/ACF/Customize.php

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -107,9 +107,13 @@ public function get_section_id_by_fieldgroup_post_id( $field_group_key, $post_id
107107
* @action customize_controls_enqueue_scripts
108108
*/
109109
public function enqueue_customize_scripts() {
110-
add_action('acf/enqueue_scripts',array($this,'enqueue_assets'));
111-
acf_enqueue_scripts();
112-
acf_enqueue_uploader();
110+
//if (did_action('acf/enqueue_scripts') <= 0) {
111+
add_action('acf/enqueue_scripts',array($this,'enqueue_assets'));
112+
acf_enqueue_scripts();
113+
acf_enqueue_uploader();
114+
// } else {
115+
// $this->enqueue_assets();
116+
// }
113117
}
114118

115119

‎include/ACFCustomizer/Compat/ACF/CustomizePreview.php

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ protected function __construct() {
3939
*/
4040
public function partial_field( $selector, $post_id = null ) {
4141
if ( $path = $this->build_path( $selector, $post_id ) ) {
42-
echo $this->get_partial_button( $path );
42+
echo $this->get_partial_button( $path ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
4343
}
4444
}
4545

@@ -48,7 +48,7 @@ public function partial_field( $selector, $post_id = null ) {
4848
*/
4949
public function partial_row( ) {
5050
if ( $path = $this->build_path( ) ) {
51-
echo $this->get_partial_button( $path );
51+
echo $this->get_partial_button( $path ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
5252
}
5353
}
5454

@@ -58,7 +58,7 @@ public function partial_row( ) {
5858
*/
5959
public function partial_subfield( $selector ) {
6060
if ( $path = $this->build_path( $selector ) ) {
61-
echo $this->get_partial_button( $path );
61+
echo $this->get_partial_button( $path ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
6262
}
6363
}
6464

@@ -173,7 +173,11 @@ public function changeset_data( $manager ) {
173173
return $data;
174174
}
175175

176-
$customized = json_decode( wp_unslash( $_REQUEST['customized'] ), true );
176+
$customized = json_decode( wp_unslash( $_REQUEST['customized'] ), true ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
177+
178+
if ( ! is_array( $customized ) ) {
179+
return $data;
180+
}
177181

178182
foreach ( $customized as $key => $value ) {
179183

‎include/ACFCustomizer/Compat/ACF/FieldgroupControl.php

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,11 @@ public function __construct( $manager, $id, $args = array() ) {
3939
* @action wp_ajax_load_customizer_field_groups_{$this->id}
4040
*/
4141
public function load_field_groups() {
42-
42+
if ( ! isset( $_REQUEST['_nonce'] ) ) {
43+
wp_send_json_error( array(
44+
'message' => __( 'Nonce missing.', 'acf-customizer' ),
45+
) );
46+
}
4347
// check nonce
4448
if ( ! wp_verify_nonce($_REQUEST['_nonce'],'load-field-group') ) {
4549
wp_send_json_error( array(
@@ -69,7 +73,7 @@ public function load_field_groups() {
6973

7074
foreach ( $this->setting->field_groups as $field_group_key ) {
7175
$field_group = acf_get_field_group( $field_group_key );
72-
printf( '<div data-key="%s">', $field_group_key );
76+
printf( '<div data-key="%s">', esc_attr( $field_group_key ) );
7377
$field_group['label_placement'] = 'top';
7478
$fields = acf_get_fields( $field_group );
7579

‎include/ACFCustomizer/Compat/ACF/FieldgroupSection.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ public function __construct( $manager, $id, $args = array() ) {
5858
*/
5959
$this->context = json_decode( wp_unslash( $_REQUEST['acf_customize_context'] ) );
6060
} else {
61-
61+
// ???
6262
}
6363

6464
}

‎include/ACFCustomizer/Compat/ACF/Storage/Storage.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ protected function set_context() {
7777
type: term|post
7878
]
7979
*/
80-
if ( $context = json_decode( wp_unslash( $_REQUEST['acf_customize_context'] ), true ) ) {
80+
if ( $context = json_decode( wp_unslash( $_REQUEST['acf_customize_context'] ), true ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
8181
extract( $context );
8282
$type = in_array( $type, [ 'term', 'post' ] ) ? $type : '';
8383
$id = intval( $id );
@@ -171,7 +171,7 @@ protected function get_changeset_value( $field_key, $fallback = null, $post_id =
171171

172172
if ( ! $changeset_data ) {
173173
$changeset_data = $this->manager->changeset_data();
174-
$changeset_data = array_map( [$this, '_flatten_value' ], $changeset_data );
174+
$changeset_data = array_map( [ $this, '_flatten_value' ], $changeset_data );
175175
}
176176
// options an theme_mods are stored under their post id
177177
if ( ! is_null( $post_id ) ) {

‎package.json

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@
99
"dev-test": "./src/run/dev-test.sh",
1010
"dashicons": "node ./src/run/dashicons.js",
1111
"rollback": "git reset --hard HEAD~ && git push origin +master",
12-
"i18n": "wp i18n make-pot . languages/acf-customizer.pot --domain=acf-customizer --exclude=tmp/*"
12+
"i18n": "wp i18n make-pot . languages/acf-customizer.pot --domain=acf-customizer --exclude=tmp/*",
13+
"audit": "./vendor/squizlabs/php_codesniffer/bin/phpcs . --report=code --standard=./phpcs-security.ruleset.xml -n -s > ./phpcs-report.txt || exit 0"
1314
},
1415
"repository": {
1516
"type": "git",
@@ -105,4 +106,4 @@
105106
"browserify-shim": {
106107
"jquery": "global:jQuery"
107108
}
108-
}
109+
}

‎phpcs-security.ruleset.xml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<?xml version="1.0"?>
2+
<ruleset name="WordPress Security">
3+
4+
<!-- Set a description for this ruleset. -->
5+
<description>A WordPress Ruleset to check application safety.</description>
6+
7+
<exclude-pattern>assets/*</exclude-pattern>
8+
<exclude-pattern>node_modules/*</exclude-pattern>
9+
<exclude-pattern>test/*</exclude-pattern>
10+
<exclude-pattern>vendor/*</exclude-pattern>
11+
<exclude-pattern>*.min.js</exclude-pattern>
12+
<exclude-pattern>js/*.js</exclude-pattern>
13+
<exclude-pattern>css/*.css</exclude-pattern>
14+
15+
<rule ref="Generic.PHP.Syntax"/>
16+
17+
<!-- Include the WordPress ruleset, with exclusions. -->
18+
<rule ref="WordPress.CodeAnalysis">
19+
</rule>
20+
<rule ref="WordPress.DB">
21+
</rule>
22+
<rule ref="WordPress.NamingConventions.PrefixAllGlobals"/>
23+
<rule ref="WordPress.PHP">
24+
<!-- omit non security sniffs -->
25+
<exclude name="WordPress.PHP.DontExtract"/>
26+
<exclude name="WordPress.PHP.YodaConditions"/>
27+
</rule>
28+
<rule ref="WordPress.Security">
29+
</rule>
30+
<rule ref="WordPress.Utils">
31+
</rule>
32+
<rule ref="WordPress.WP">
33+
<exclude name="WordPress.WP.I18n.MixedOrderedPlaceholders"/>
34+
<exclude name="WordPress.WP.I18n.UnorderedPlaceholders"/>
35+
<exclude name="WordPress.WP.I18n.NonSingularStringLiteralText"/>
36+
</rule>
37+
</ruleset>

0 commit comments

Comments
 (0)