Changeset 4574

Timestamp:

12/23/2016 05:27:03 PM (8 years ago)

Author:

iandunn

Message:

Jetpack Tweaks: Sanitize CSS saved through the Customizer

Location:

sites/trunk/wordcamp.org/public_html/wp-content/mu-plugins

Files:

• helper-functions.php (modified) (1 diff)
• jetpack-tweaks/css-sanitization.php (modified) (2 diffs)
• wp-cli-commands/rewrite-rules.php (modified) (1 diff)

sites/trunk/wordcamp.org/public_html/wp-content/mu-plugins/helper-functions.php

@@ -226 +226 @@
  * successful request, like stats scripts, where the resulting data would be distorted by a failed response.
  *
+ * @todo Add support for wp_remote_post() too
  * @todo Remove this if https://github.com/rmccue/Requests/issues/222 is implemented
  *

sites/trunk/wordcamp.org/public_html/wp-content/mu-plugins/jetpack-tweaks/css-sanitization.php

@@ -2 +2 @@
 
 namespace WordCamp\Jetpack_Tweaks;
+use WordCamp\RemoteCSS;
+use Exception;
+
 defined( 'WPINC' ) or die();
 
+add_filter( 'update_custom_css_data',     __NAMESPACE__ . '\sanitize_custom_css', 15       );   // After Jetpack_Custom_CSS_Enhancements::update_custom_css_data()
 add_action( 'csstidy_optimize_postparse', __NAMESPACE__ . '\sanitize_csstidy_parsed_rules' );
 add_action( 'admin_notices',              __NAMESPACE__ . '\notify_import_rules_stripped'  );
 add_action( 'csstidy_optimize_subvalue',  __NAMESPACE__ . '\sanitize_csstidy_subvalues'    );
+
+/**
+ * Sanitize CSS saved through the Core/Jetpack editor inside the Customizer
+ *
+ * By default, the Additional CSS section is only available to users with `unfiltered_html` -- which nobody on
+ * wordcamp.org has, not even super-admins -- but Jetpack re-maps that to `edit_theme_options`, allowing
+ * regular admins on all sites to use it.
+ *
+ * @param array $post
+ *
+ * @return array
+ */
+function sanitize_custom_css( $post ) {
+    try {
+        $post['css'] = RemoteCSS\sanitize_unsafe_css( $post['css'] );
+    } catch ( Exception $exception ) {
+        /*
+         * We can't save unsanitized CSS, and also don't want to overwrite the known-good value in the database.
+         * There's no way to gracefully abort the process and show an error message, so just die.
+         */
+        wp_die( $exception->getMessage() );
+    }
+
+    return $post;
+}
 
 /**
@@ -31 +60 @@
 /**
  * Notify the user that @import rules were stripped from their CSS
+ *
+ * todo Since WP 4.7 / Jetpack 4.2.2, we also need a way to show this warning in Customizer > Additional CSS. It
+ *      still needs to work in Remote CSS, though.
  */
 function notify_import_rules_stripped() {

sites/trunk/wordcamp.org/public_html/wp-content/mu-plugins/wp-cli-commands/rewrite-rules.php

@@ -35 +35 @@
             );
 
+            // todo use wcorg_redundant_remote_get
             $response = wp_remote_get( esc_url_raw( $ajax_url ) );