Improve security, accessibility, and stability in mu-plugins - #4173
Open
murshed wants to merge 1 commit into
Open
Improve security, accessibility, and stability in mu-plugins#4173murshed wants to merge 1 commit into
murshed wants to merge 1 commit into
Conversation
- Add safety checks for undefined superglobal keys ($_SERVER['PHP_SELF']) - Fix SQL injection vulnerabilities by properly escaping table/column names in dynamic SQL - Improve accessibility: add target="_blank" with rel="noopener noreferrer" and screen reader text to external links - Restrict postMessage to window.location.origin instead of '*' for better security - Add type checking and default values for potentially undefined array keys - Fix response array indexing in Wp_Http_Dummy to preserve request IDs - Make DISABLE_WP_CRON definition conditional to avoid redefine errors - Add transaction wrapper for trigger creation in sync plugin - Fix error code comparison to cast to string for reliable equality check
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Improves WordPress Playground MU-plugins for better security, accessibility, and runtime stability across PHP versions by hardening SQL/HTTP handling, tightening cross-origin messaging behavior, and improving admin UI messaging and i18n behavior.
Changes:
- Hardened SQLite trigger creation and exception handling logic in sync MU-plugin.
- Improved HTTP transport option defaults and reduced runtime warnings in remote MU-plugin HTTP code.
- Enhanced security/accessibility in admin-facing messaging and adjusted postMessage target origin behavior.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/playground/sync/src/sync-mu-plugin.php | Escapes identifiers for trigger creation and tweaks exception code comparison. |
| packages/playground/remote/src/lib/playground-mu-plugin/playground-includes/wp_http_fetch.php | Adds safer defaults for options and guards against non-string responses. |
| packages/playground/remote/src/lib/playground-mu-plugin/playground-includes/wp_http_dummy.php | Preserves request IDs when returning multiple responses. |
| packages/playground/remote/src/lib/playground-mu-plugin/0-playground.php | Improves link security/a11y, adjusts gettext filter signature, restricts postMessage target origin, and hardens cron disabling checks. |
| packages/playground/remote/src/lib/playground-mu-plugin/0-playground-php52.php | Makes WP Cron disabling safer on legacy PHP by guarding constants and $_SERVER access. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+91
to
+112
| $pdo->beginTransaction(); | ||
| foreach (playground_sync_get_autoincrement_columns() as $table => $column) { | ||
| $pdo->query(<<<SQL | ||
| CREATE TRIGGER IF NOT EXISTS | ||
| force_seq_autoincrement_on_{$table}_{$column} | ||
| AFTER INSERT ON $table | ||
| $table_escaped = '"' . str_replace('"', '""', $table) . '"'; | ||
| $column_escaped = '"' . str_replace('"', '""', $column) . '"'; | ||
| $table_raw_escaped = str_replace("'", "''", $table); | ||
| $trigger_name = "force_seq_autoincrement_on_" . preg_replace('/[^a-zA-Z0-9_]/', '_', $table . '_' . $column); | ||
|
|
||
| $pdo->query(" | ||
| CREATE TRIGGER IF NOT EXISTS {$trigger_name} | ||
| AFTER INSERT ON {$table_escaped} | ||
| FOR EACH ROW | ||
| WHEN | ||
| -- Don't run this trigger when we're replaying queries from another peer | ||
| (SELECT value FROM playground_variables WHERE name = 'is_replaying') = 'no' | ||
| BEGIN | ||
| -- Update the inserted row with the next available ID | ||
| UPDATE {$table} SET {$column} = ( | ||
| SELECT seq FROM playground_sequence WHERE table_name = '{$table}' | ||
| UPDATE {$table_escaped} SET {$column_escaped} = ( | ||
| SELECT seq FROM playground_sequence WHERE table_name = '{$table_raw_escaped}' | ||
| ) + 1 WHERE rowid = NEW.rowid; | ||
| -- Record the ID that was just assigned | ||
| UPDATE playground_sequence SET seq = seq + 1 WHERE table_name = '{$table}'; | ||
| UPDATE playground_sequence SET seq = seq + 1 WHERE table_name = '{$table_raw_escaped}'; | ||
| END; | ||
| SQL); | ||
| "); | ||
| } | ||
| $pdo->commit(); |
Comment on lines
64
to
+68
| $this->headers = post_message_to_js($request); | ||
|
|
||
| if (!is_string($this->headers)) { | ||
| return false; | ||
| } |
Comment on lines
250
to
254
| type: 'playground-url-change', | ||
| url: window.location.href | ||
| }), | ||
| '*' | ||
| window.location.origin | ||
| ); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix identified runtime warnings/errors, improve PHP 8.0–8.5 compatibility, enhance security & cross-origin messaging, fix localization (i18n) for non-English WordPress sites, and implement WCAG 2.1 AA accessibility standards in WordPress Playground MU-plugin components.