Skip to content

Backport v1.30.1 #1206

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pattonwebz merged 17 commits into from
Aug 25, 2025
Merged

Backport v1.30.1 #1206

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
1cdb35c
Merge pull request #1090 from equalizedigital/release/1.28.0
pattonwebz Jul 22, 2025
03552e1
Merge pull request #1124 from equalizedigital/release/1.29.0
pattonwebz Jul 29, 2025
c26e743
Merge pull request #1174 from equalizedigital/release/1.30.0
pattonwebz Aug 6, 2025
651dc62
Pass flag for if user can edit the current post to the frontend highl…
pattonwebz Aug 19, 2025
e6e6eec
Add a helper for permission checking that checks if the user can edit…
pattonwebz Aug 19, 2025
a48215b
Ensure user can edit the current post when calling endpoint saving is…
pattonwebz Aug 19, 2025
525151b
Add REST API endpoints behavior tests for permissions on post scan re…
pattonwebz Aug 19, 2025
edf9b50
Add test for limited user managing their own post
pattonwebz Aug 19, 2025
1f170c1
Add required validation and sanitization for post ID arguments
pattonwebz Aug 19, 2025
f4b27d6
Handle correct passed param types and return types
pattonwebz Aug 19, 2025
2b10940
Fix code formatting for numeric validation callbacks
pattonwebz Aug 19, 2025
b139ffb
Enhance API response validation in tests
pattonwebz Aug 19, 2025
7a20d43
updated: permission callback to require 'edit_posts' capability for a…
SteveJonesDev Aug 19, 2025
ab4599b
updated: permission callbacks to require 'edit_posts' capability for …
SteveJonesDev Aug 19, 2025
9889dd9
updated: permission callbacks to require 'edit_posts' capability for …
SteveJonesDev Aug 19, 2025
0bf343f
updated: permission callback to require 'publish_posts' capability fo…
SteveJonesDev Aug 19, 2025
3456ce5
Bump version to 1.30.1 and update changelog
pattonwebz Aug 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions accessibility-checker.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
* Plugin Name: Accessibility Checker
* Plugin URI: https://a11ychecker.com
* Description: Audit and check your website for accessibility before you hit publish. In-post accessibility scanner and guidance.
* Version: 1.30.0
* Version: 1.30.1
* Requires PHP: 7.4
* Author: Equalize Digital
* Author URI: https://equalizedigital.com
Expand All @@ -36,7 +36,7 @@

// Current plugin version.
if ( ! defined( 'EDAC_VERSION' ) ) {
define( 'EDAC_VERSION', '1.30.0' );
define( 'EDAC_VERSION', '1.30.1' );
}

// Current database version.
Expand Down Expand Up @@ -122,7 +122,7 @@ function edac_register_rules() {

// Use the new class-based rules system.
$default_rules = \EqualizeDigital\AccessibilityChecker\Rules\RuleRegistry::load_rules();

/**
* Filter the default rules.
*
Expand Down
8 changes: 5 additions & 3 deletions admin/class-welcome-page.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,9 +40,11 @@ public static function render_summary() {
</div>

<p class="edac-cols-right">
<button class="button" id="edac_clear_cached_stats">
<?php esc_html_e( 'Update Counts', 'accessibility-checker' ); ?>
</button>
<?php if ( current_user_can( 'publish_posts' ) ) : ?>
<button class="button" id="edac_clear_cached_stats">
<?php esc_html_e( 'Update Counts', 'accessibility-checker' ); ?>
</button>
<?php endif; ?>

<a class="edac-ml-1 button" href="<?php echo esc_url( admin_url( 'admin.php?page=accessibility_checker_full_site_scan' ) ); ?>">
<?php esc_html_e( 'Start New Scan', 'accessibility-checker' ); ?>
Expand Down
1 change: 1 addition & 0 deletions includes/classes/class-enqueue-frontend.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,7 @@ public static function maybe_enqueue_frontend_highlighter() {
'nonce' => wp_create_nonce( 'ajax-nonce' ),
'restNonce' => wp_create_nonce( 'wp_rest' ),
'userCanFix' => current_user_can( apply_filters( 'edac_filter_settings_capability', 'manage_options' ) ),
'userCanEdit' => current_user_can( 'edit_post', $post_id ),
'edacUrl' => esc_url_raw( get_site_url() ),
'ajaxurl' => admin_url( 'admin-ajax.php' ),
'loggedIn' => is_user_logged_in(),
Expand Down
41 changes: 32 additions & 9 deletions includes/classes/class-rest-api.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,13 +79,15 @@ function () use ( $ns, $version ) {
'callback' => [ $this, 'set_post_scan_results' ],
'args' => [
'id' => [
'required' => true,
'validate_callback' => function ( $param ) {
return is_numeric( $param );
},
'sanitize_callback' => 'absint',
],
],
'permission_callback' => function () {
return current_user_can( 'edit_posts' );
'permission_callback' => function ( $request ) {
return $this->user_can_edit_passed_post_id( $request );
},
]
);
Expand All @@ -102,7 +104,7 @@ function () use ( $ns, $version ) {
'methods' => 'GET',
'callback' => [ $this, 'get_scans_stats' ],
'permission_callback' => function () {
return current_user_can( 'read' ); // able to access the admin dashboard.
return current_user_can( 'edit_posts' );
},
]
);
Expand All @@ -119,7 +121,7 @@ function () use ( $ns, $version ) {
'methods' => 'POST',
'callback' => [ $this, 'clear_cached_scans_stats' ],
'permission_callback' => function () {
return current_user_can( 'read' ); // able to access the admin dashboard.
return current_user_can( 'publish_posts' );
},
]
);
Expand All @@ -136,7 +138,7 @@ function () use ( $ns, $version ) {
'methods' => 'GET',
'callback' => [ $this, 'get_scans_stats_by_post_type' ],
'permission_callback' => function () {
return current_user_can( 'read' ); // able to access the admin dashboard.
return current_user_can( 'edit_posts' );
},
]
);
Expand All @@ -153,7 +155,7 @@ function () use ( $ns, $version ) {
'methods' => 'GET',
'callback' => [ $this, 'get_scans_stats_by_post_types' ],
'permission_callback' => function () {
return current_user_can( 'read' ); // able to access the admin dashboard.
return current_user_can( 'edit_posts' );
},
]
);
Expand All @@ -171,13 +173,15 @@ function () use ( $ns, $version ) {
'callback' => [ $this, 'clear_issues_for_post' ],
'args' => [
'id' => [
'required' => true,
'validate_callback' => function ( $param ) {
return is_numeric( $param );
},
'sanitize_callback' => 'absint',
],
],
'permission_callback' => function () {
return current_user_can( 'edit_posts' );
'permission_callback' => function ( $request ) {
return $this->user_can_edit_passed_post_id( $request );
},
]
);
Expand All @@ -203,10 +207,29 @@ function () use ( $ns, $version ) {
);
}

/**
* Check if the user can edit a post.
*
* This is a permission callback to replace several places where we check if the user can edit a post.
*
* @since 1.30.1
*
* @param \WP_REST_Request $request The request object passed from the REST call. This should contain the 'id' of the post to check permissions for.
*
* @return bool|\WP_Error
*/
public function user_can_edit_passed_post_id( $request ) {
if ( ! isset( $request['id'] ) ) {
return new \WP_Error( 'rest_post_invalid_id', __( 'A required parameter is missing.', 'accessibility-checker' ), [ 'status' => 400 ] );
}
$post_id = (int) $request['id'];
return current_user_can( 'edit_post', $post_id ); // able to edit the post.
}
Comment on lines +221 to +227

@gemini-code-assist gemini-code-assist Bot Aug 22, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The if ( ! isset( $request['id'] ) ) check is redundant. The REST API routes using this permission callback (/post-scan-results and /clear-issues) define the id parameter as required. WordPress's REST API automatically handles missing required parameters and returns an error before this callback is executed. Removing this check will make the code cleaner and rely on the framework's validation.

public function user_can_edit_passed_post_id( $request ) {
	$post_id = (int) $request['id'];
	return current_user_can( 'edit_post', $post_id ); // able to edit the post.
}


/**
* REST handler to clear issues results for a given post ID.
*
* @param WP_REST_Request $request The request passed from the REST call.
* @param \WP_REST_Request $request The request passed from the REST call.

Copilot AI Aug 22, 2025

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The docblock parameter type should use the fully qualified class name \WP_REST_Request to match the pattern used elsewhere in the function (line 217 uses \WP_REST_Request).

Copilot uses AI. Check for mistakes.
*
* @return \WP_REST_Response
*/
Expand Down
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "accessibility-checker",
"version": "1.30.0",
"version": "1.30.1",

@coderabbitai coderabbitai Bot Aug 22, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Version bump looks clean; keep the release numbers in lockstep.

1.30.1 here matches the PR intent. Make sure the plugin header, EDAC_VERSION, and readme stable tag all say 1.30.1 so no one gets tripped up by mismatched versions.

Run this to verify all the version surfaces are in sync (expected: 1.30.1):

🏁 Script executed:

#!/bin/bash
set -euo pipefail
expected="1.30.1"

echo "Checking versions…"
pkg=$(jq -r .version package.json)
php_header=$(rg -nP '^\s*\*\s*Version:\s*([0-9.]+)' -or '$1' accessibility-checker.php | head -n1)
php_const=$(rg -nP "define\(\s*'EDAC_VERSION'\s*,\s*'([^']+)'\s*\)" -or '$1' accessibility-checker.php | head -n1)
readme=$(rg -nP '^Stable tag:\s*([0-9.]+)' -or '$1' readme.txt | head -n1)

printf "package.json: %s\nplugin header: %s\nEDAC_VERSION: %s\nreadme stable tag: %s\n" \
  "$pkg" "$php_header" "$php_const" "$readme"

test "$pkg" = "$expected" && test "$php_header" = "$expected" && test "$php_const" = "$expected" && test "$readme" = "$expected" \
  && echo "OK: versions match $expected" || { echo "Mismatch detected"; exit 1; }

Length of output: 797

Update version-check script to strip line numbers
The actual version strings in package.json, the plugin header (accessibility-checker.php), the EDAC_VERSION constant, and the readme.txt stable tag are all set to 1.30.1, but the verification script is pulling in line-number prefixes (e.g. 13:1.30.1), causing a false “Mismatch detected.”

• Remove the -n flag from each rg invocation so it only emits the captured group. For example:

- php_header=$(rg -nP '^\s*\*\s*Version:\s*([0-9.]+)' -or '$1' accessibility-checker.php | head -n1)
+ php_header=$(rg -P  '^\s*\*\s*Version:\s*([0-9.]+)' -or '$1' accessibility-checker.php | head -n1)

- php_const=$(rg -nP "define\(\s*'EDAC_VERSION'\s*,\s*'([^']+)'\s*\)" -or '$1' accessibility-checker.php | head -n1)
+ php_const=$(rg -P  "define\(\s*'EDAC_VERSION'\s*,\s*'([^']+)'\s*\)" -or '$1' accessibility-checker.php | head -n1)

- readme=$(rg -nP '^Stable tag:\s*([0-9.]+)' -or '$1' readme.txt                  | head -n1)
+ readme=$(rg -P  '^Stable tag:\s*([0-9.]+)' -or '$1' readme.txt                  | head -n1)

• After this change, re-run the script to confirm you get:

OK: versions match 1.30.1

With that tweak, your version bump verification will be rock-solid, fool!

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"version": "1.30.1",
# In your version-check script, replace these lines:
- php_header=$(rg -nP '^\s*\*\s*Version:\s*([0-9.]+)' -or '$1' accessibility-checker.php | head -n1)
- php_const=$(rg -nP "define\(\s*'EDAC_VERSION'\s*,\s*'([^']+)'\s*\)" -or '$1' accessibility-checker.php | head -n1)
- readme=$(rg -nP '^Stable tag:\s*([0-9.]+)' -or '$1' readme.txt | head -n1)
# with these lines:
php_header=$(rg -P '^\s*\*\s*Version:\s*([0-9.]+)' -or '$1' accessibility-checker.php | head -n1)
php_const=$(rg -P "define\(\s*'EDAC_VERSION'\s*,\s*'([^']+)'\s*\)" -or '$1' accessibility-checker.php | head -n1)
readme=$(rg -P '^Stable tag:\s*([0-9.]+)' -or '$1' readme.txt | head -n1)
🤖 Prompt for AI Agents 
In package.json around line 3, the version-check script is failing because
ripgrep (rg) is invoked with the -n flag which prefixes results with line
numbers (e.g. "13:1.30.1") causing false mismatches; edit the script(s) that
extract versions to remove the -n flag from each rg invocation so rg outputs
only the captured group (the version string), then re-run the verification to
confirm it reports "OK: versions match 1.30.1".

"description": "Audit and check your website for accessibility before you hit publish. In-post accessibility scanner and guidance.",
"author": "Equalize Digital",
"license": "GPL-2.0+",
Expand Down
6 changes: 5 additions & 1 deletion readme.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ Contributors: equalizedigital, alh0319, stevejonesdev
Tags: accessibility, accessible, wcag, ada, WP accessibility
Requires at least: 6.6
Tested up to: 6.8
Stable tag: 1.30.0
Stable tag: 1.30.1
License: GPLv2 or later
License URI: http://www.gnu.org/licenses/gpl-2.0.html

Expand Down Expand Up @@ -211,6 +211,10 @@ You can report security bugs through the Patchstack Vulnerability Disclosure Pro

== Changelog ==

= 1.30.1 =
* Improved: The rescan and clear buttons in the frontend highlighter are now only shown when they can be used.
* Improved: Issue saving and clearing now has more robust capability checking.

= 1.30.0 =
* Added: Ability to clear issues on a post or page from the frontend highlighter.
* Added: More accessibility checker details in the site health check.
Expand Down
8 changes: 4 additions & 4 deletions src/frontendHighlighterApp/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -394,12 +394,12 @@ class AccessibilityCheckerHighlight {
addHighlightPanel() {
const widgetPosition = edacFrontendHighlighterApp?.widgetPosition || 'right';

const isLoggedInUser = edacFrontendHighlighterApp && edacFrontendHighlighterApp?.loggedIn;
const clearButtonMarkup = isLoggedInUser
const userCanEdit = edacFrontendHighlighterApp && edacFrontendHighlighterApp?.userCanEdit && edacFrontendHighlighterApp?.loggedIn;
const clearButtonMarkup = userCanEdit
? `<button id="edac-highlight-clear-issues" class="edac-highlight-clear-issues">${ __( 'Clear Issues', 'accessibility-checker' ) }</button>`
: '';

const rescanButton = isLoggedInUser
const rescanButton = userCanEdit
? `<button id="edac-highlight-rescan" class="edac-highlight-rescan">${ __( 'Rescan This Page', 'accessibility-checker' ) }</button>`
: '';

Expand All @@ -416,7 +416,7 @@ class AccessibilityCheckerHighlight {
<button id="edac-highlight-panel-controls-close" class="edac-highlight-panel-controls-close" aria-label="Close">×</button>
<div class="edac-highlight-panel-controls-title">Accessibility Checker</div>
<div class="edac-highlight-panel-controls-summary">Loading...</div>
<div class="edac-highlight-panel-controls-buttons ${ ! isLoggedInUser ? ' single_button' : '' }">
<div class="edac-highlight-panel-controls-buttons ${ ! userCanEdit ? ' single_button' : '' }">
<div>
<button id="edac-highlight-previous" disabled="true"><span aria-hidden="true">« </span>Previous</button>
<button id="edac-highlight-next" disabled="true">Next<span aria-hidden="true"> »</span></button><br />
Expand Down
Loading