Skip to content

Improve security, accessibility, and stability in mu-plugins #4173

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
murshed wants to merge 1 commit into
base: trunk
Choose a base branch
from
Open

Improve security, accessibility, and stability in mu-plugins #4173

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions packages/playground/remote/src/lib/playground-mu-plugin/0-playground-php52.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,8 +77,11 @@ function _pg52_dummy_transports() {
// Modern 0-playground.php intentionally does NOT define this: on PHP
// 7+ the Fetch transport works, so WP Cron can run for real. Keep
// this block legacy-only.
define('DISABLE_WP_CRON', true);
if (substr($_SERVER['PHP_SELF'], -12) === '/wp-cron.php') {
if (!defined('DISABLE_WP_CRON')) {
define('DISABLE_WP_CRON', true);
}
$php_self = isset($_SERVER['PHP_SELF']) ? $_SERVER['PHP_SELF'] : '';
if ($php_self !== '' && substr($php_self, -12) === '/wp-cron.php') {
header('HTTP/1.1 503 Service Unavailable');
header('Content-Type: text/plain');
echo 'WP Cron is temporarily disabled in the Playground.';
Expand Down
24 changes: 14 additions & 10 deletions packages/playground/remote/src/lib/playground-mu-plugin/0-playground.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,11 +116,11 @@ function playground_has_wordpress_view_transitions() {

add_action('init', 'networking_disabled');
function networking_disabled() {
$networking_err_msg = '<div class="networking_err_msg">Network access is an <a href="https://github.com/WordPress/wordpress-playground/issues/85" target="_blank">experimental, opt-in feature</a>, which means you need to enable it to allow Playground to access the Plugins/Themes directories.
$networking_err_msg = '<div class="networking_err_msg">Network access is an <a href="https://github.com/WordPress/wordpress-playground/issues/85" target="_blank" rel="noopener noreferrer">experimental, opt-in feature<span class="screen-reader-text"> (opens in a new tab)</span></a>, which means you need to enable it to allow Playground to access the Plugins/Themes directories.
<p>There are two alternative methods to enable global networking support:</p>
<ol>
<li>Using the <a href="https://wordpress.github.io/wordpress-playground/developers/apis/query-api/">Query API</a>: for example, https://playground.wordpress.net/<em>?networking=yes</em> <strong>or</strong>
<li> Using the <a href="https://wordpress.github.io/wordpress-playground/blueprints/data-format/#features">Blueprint API</a>: add <code>"features": { "networking": true }</code> to the JSON file.
<li>Using the <a href="https://wordpress.github.io/wordpress-playground/developers/apis/query-api/" target="_blank" rel="noopener noreferrer">Query API<span class="screen-reader-text"> (opens in a new tab)</span></a>: for example, https://playground.wordpress.net/<em>?networking=yes</em> <strong>or</strong>
<li> Using the <a href="https://wordpress.github.io/wordpress-playground/blueprints/data-format/#features" target="_blank" rel="noopener noreferrer">Blueprint API<span class="screen-reader-text"> (opens in a new tab)</span></a>: add <code>"features": { "networking": true }</code> to the JSON file.
</li></ol>
<p>
When browsing Playground as a standalone instance, you can enable networking via the settings panel: select the option "Network access (e.g. for browsing plugins)" and hit the "Apply changes" button.<p>
Expand All @@ -138,14 +138,15 @@ function networking_disabled() {
return $res;
});

add_filter('gettext', function ($translation) {
if( $GLOBALS['pagenow'] === 'theme-install.php') {
if ($translation === 'An unexpected error occurred. Something may be wrong with WordPress.org or this server&#8217;s configuration. If you continue to have problems, please try the <a href="%s">support forums</a>.') {
add_filter('gettext', function ($translation, $text = '', $domain = 'default') {
$pagenow = isset($GLOBALS['pagenow']) ? $GLOBALS['pagenow'] : '';
if ('theme-install.php' === $pagenow) {
if (strpos($text, 'An unexpected error occurred.') !== false || $translation === 'An unexpected error occurred. Something may be wrong with WordPress.org or this server&#8217;s configuration. If you continue to have problems, please try the <a href="%s">support forums</a>.') {
return networking_disabled();
}
}
return $translation;
});
}, 10, 3);

/**
* Links with target="top" don't work in the playground iframe because of
Expand Down Expand Up @@ -249,7 +250,7 @@ function playground_report_url_to_parent() {
type: 'playground-url-change',
url: window.location.href
}),
'*'
window.location.origin
);
Comment on lines 250 to 254
}
</script>
Expand Down Expand Up @@ -434,8 +435,11 @@ function playground_enable_site_thumbnail_capture() {
* taking the full 30 seconds to complete. Since we're running PHP on a single
* worker, that blocks every other request from running until WP Cron completes.
*/
define('DISABLE_WP_CRON', true);
if(str_ends_with($_SERVER['PHP_SELF'], '/wp-cron.php')) {
if ( ! defined( 'DISABLE_WP_CRON' ) ) {
define( 'DISABLE_WP_CRON', true );
}
$php_self = isset( $_SERVER['PHP_SELF'] ) ? $_SERVER['PHP_SELF'] : '';
if ( '' !== $php_self && str_ends_with( $php_self, '/wp-cron.php' ) ) {
http_response_code(503);
header('Content-Type: text/plain');
echo 'WP Cron is temporarily disabled in the Playground.';
Expand Down
2 changes: 1 addition & 1 deletion ...ages/playground/remote/src/lib/playground-mu-plugin/playground-includes/wp_http_dummy.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ public function request_multiple($requests, $options)
{
$responses = array();
foreach ($requests as $id => $request) {
$responses[] = false;
$responses[$id] = false;
}
return $responses;
}
Expand Down
8 changes: 6 additions & 2 deletions ...ages/playground/remote/src/lib/playground-mu-plugin/playground-includes/wp_http_fetch.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ public function __destruct()
public function request($url, $headers = array(), $data = array(), $options = array())
{
if (!empty($data)) {
$data_format = $options['data_format'];
$data_format = isset($options['data_format']) ? $options['data_format'] : 'body';
if ($data_format === 'query') {
$url = self::format_get($url, $data);
$data = '';
Expand All @@ -55,14 +55,18 @@ public function request($url, $headers = array(), $data = array(), $options = ar
'headers' => $headers,
'data' => $data,
'url' => $url,
'method' => $options['type'],
'method' => isset($options['type']) ? $options['type'] : 'GET',
'blocking' => isset($options['blocking']) ? $options['blocking'] : true,
]
)
);

$this->headers = post_message_to_js($request);

if (!is_string($this->headers)) {
return false;
}
Comment on lines 64 to +68

// Store a file if the request specifies it.
// Are we sure that `$this->headers` includes the body of the response?
$before_response_body = strpos($this->headers, "\r\n\r\n");
Expand Down
27 changes: 15 additions & 12 deletions packages/playground/sync/src/sync-mu-plugin.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,25 +88,28 @@ function playground_sync_override_autoincrement_algorithm($local_id_offset = nul
$stmt->execute([':seq' => get_option('playground_id_offset')]);

// Create any missing AFTER INSERT triggers:
$pdo->beginTransaction();
foreach (playground_sync_get_autoincrement_columns() as $table => $column) {
$pdo->query(<<<SQL
CREATE TRIGGER IF NOT EXISTS
force_seq_autoincrement_on_{$table}_{$column}
AFTER INSERT ON $table
$table_escaped = '"' . str_replace('"', '""', $table) . '"';
$column_escaped = '"' . str_replace('"', '""', $column) . '"';
$table_raw_escaped = str_replace("'", "''", $table);
$trigger_name = "force_seq_autoincrement_on_" . preg_replace('/[^a-zA-Z0-9_]/', '_', $table . '_' . $column);

$pdo->query("
CREATE TRIGGER IF NOT EXISTS {$trigger_name}
AFTER INSERT ON {$table_escaped}
FOR EACH ROW
WHEN
-- Don't run this trigger when we're replaying queries from another peer
(SELECT value FROM playground_variables WHERE name = 'is_replaying') = 'no'
BEGIN
-- Update the inserted row with the next available ID
UPDATE {$table} SET {$column} = (
SELECT seq FROM playground_sequence WHERE table_name = '{$table}'
UPDATE {$table_escaped} SET {$column_escaped} = (
SELECT seq FROM playground_sequence WHERE table_name = '{$table_raw_escaped}'
) + 1 WHERE rowid = NEW.rowid;
-- Record the ID that was just assigned
UPDATE playground_sequence SET seq = seq + 1 WHERE table_name = '{$table}';
UPDATE playground_sequence SET seq = seq + 1 WHERE table_name = '{$table_raw_escaped}';
END;
SQL);
");
}
$pdo->commit();
Comment on lines +91 to +112
}

/**
Expand Down Expand Up @@ -335,7 +338,7 @@ function playground_sync_replay_sql_journal($queries)
// prevent synchronizing transient data.

// SQLSTATE[23000]: Integrity constraint violation: 19 UNIQUE constraint failed
if ($e->getCode() === "23000") {
if ((string) $e->getCode() === "23000") {
continue;
}
throw $e;
Expand Down
Loading