Skip to content

Block Theme Previews: Add a nonce for activation #4795

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
scruffian wants to merge 7 commits into from
Closed

Block Theme Previews: Add a nonce for activation #4795

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
d01393e
Block Theme Previews: Add a nonce for activation, and ensure that we …
scruffian Jul 5, 2023
b06bdb3
fix formatting
scruffian Jul 5, 2023
2041820
update comment
scruffian Jul 5, 2023
0cdfdc9
prefix function
scruffian Jul 5, 2023
af5e72c
Change wording of doc
tellthemachines Jul 11, 2023
c8deaf4
Add WP prefix to global
tellthemachines Jul 11, 2023
e7e4ce2
Add private note
tellthemachines Jul 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Add WP prefix to global 
Co-authored-by: Peter Wilson <[email protected]>
  • Loading branch information
@tellthemachines @peterwilsoncc
tellthemachines and peterwilsoncc authored Jul 11, 2023
commit c8deaf4915c547f52bc19d45e6b63f6ff3dd3f69
6 changes: 3 additions & 3 deletions src/wp-includes/theme-previews.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,9 +68,9 @@ function wp_attach_theme_preview_middleware() {
function wp_block_theme_activate_nonce() {
$nonce_handle = 'switch-theme_' . wp_get_theme_preview_path();
Copy link

@anton-vlasenko anton-vlasenko Jul 11, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nitpick: I don't see many PHP frameworks using inline tags to output text these days. Instead, I would use echo or print to output the nonce code to the buffer. But I admit, this is just a personal preference.

?>
<script type="text/javascript">
window.BLOCK_THEME_ACTIVATE_NONCE = '<?php echo wp_create_nonce( $nonce_handle ); ?>';
</script>
<script type="text/javascript">
window.WP_BLOCK_THEME_ACTIVATE_NONCE = '<?php echo wp_create_nonce( $nonce_handle ); ?>';
Copy link

@anton-vlasenko anton-vlasenko Jul 11, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This could potentially be a security issue. Is there a specific reason for not escaping the nonce value?

Suggested change
window.WP_BLOCK_THEME_ACTIVATE_NONCE = '<?php echo wp_create_nonce( $nonce_handle ); ?>';
window.WP_BLOCK_THEME_ACTIVATE_NONCE = '<?php echo esc_js( wp_create_nonce( $nonce_handle ) ); ?>';

Copy link
Contributor

@peterwilsoncc peterwilsoncc Jul 11, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch @anton-vlasenko -- it's more a bug than a security issue as it's not user input, however it may break with custom nonce implementations using special characters.

It will need to change to = <?php echo wp_json_encode( wp_create_nonce( $nonce_handle ) ); (without quotes) as esc_js() is intended for use in DOM attributes.

wp> esc_js( 'Pens & Pencils' );
=>  string(18) "Pens &amp; Pencils"
wp> wp_json_encode( 'Pens & Pencils' );
=> string(16) ""Pens & Pencils""

I'll reopen the ticket and add a PR to the GB repo.

Copy link

@anton-vlasenko anton-vlasenko Jul 12, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for getting back to my code review, @peterwilsoncc!

Yes, using wp_json_encode() is also an option.
In fact, I prefer wp_json_encode() over esc_js() because it automatically adds quotes.
I was just uncertain about which function aligns better with the "true WordPress way" of doing things.

</script>
<?php
}

Expand Down