Skip to content

Commit a9c597d

Browse files
john-shafferjohn-shaffer
committed
Add cache page GET nonces
Add nonces for GET requests to cache pages in WP.org build. These don't serve any security purpose, but are required by WP.org.
1 parent 9d276aa commit a9c597d

5 files changed

Lines changed: 106 additions & 8 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@
1212
"Crawled Files" page with less detail.
1313
- Improve consistency and screen reader text on
1414
admin cache pages.
15+
- Add nonces for GET requests to cache pages in WP.org
16+
build. These don't serve any security purpose, but
17+
are required by WP.org.
1518

1619
## 9.4.1 (2025-10-20)
1720

‎src/Controller.php‎

Lines changed: 30 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -286,7 +286,14 @@ public static function adminDetectedFilesDelete(): void {
286286
public static function adminDetectedFilesShow(): void {
287287
check_admin_referer( self::getHookName( 'caches_page' ) );
288288

289-
wp_safe_redirect( self::getAdminUrl( 'detected_files' ) );
289+
$nonce = filter_input(
290+
INPUT_POST,
291+
'_wpnonce',
292+
FILTER_SANITIZE_URL,
293+
);
294+
$admin_url = self::getAdminUrl( 'detected_files' ) . '&_wpnonce=' . $nonce;
295+
296+
wp_safe_redirect( $admin_url );
290297
exit;
291298
}
292299

@@ -357,7 +364,12 @@ public static function adminDeployCacheShow(): void {
357364
FILTER_SANITIZE_URL,
358365
)
359366
);
360-
$admin_url = self::getAdminUrl( 'deploy_cache' );
367+
$nonce = filter_input(
368+
INPUT_POST,
369+
'_wpnonce',
370+
FILTER_SANITIZE_URL,
371+
);
372+
$admin_url = self::getAdminUrl( 'deploy_cache' ) . '&_wpnonce=' . $nonce;
361373
if ( $deploy_namespace !== '' ) {
362374
wp_safe_redirect(
363375
$admin_url . '&deploy_namespace=' . urlencode( $deploy_namespace )
@@ -381,7 +393,14 @@ public static function adminCrawledFilesDelete(): void {
381393
public static function adminCrawledFilesShow(): void {
382394
check_admin_referer( self::getHookName( 'caches_page' ) );
383395

384-
wp_safe_redirect( self::getAdminUrl( 'crawled_files' ) );
396+
$nonce = filter_input(
397+
INPUT_POST,
398+
'_wpnonce',
399+
FILTER_SANITIZE_URL,
400+
);
401+
$admin_url = self::getAdminUrl( 'crawled_files' ) . '&_wpnonce=' . $nonce;
402+
403+
wp_safe_redirect( $admin_url );
385404
exit;
386405
}
387406

@@ -397,7 +416,14 @@ public static function adminPostProcessedSiteDelete(): void {
397416
public static function adminPostProcessedSiteShow(): void {
398417
check_admin_referer( self::getHookName( 'caches_page' ) );
399418

400-
wp_safe_redirect( self::getAdminUrl( 'post_processed_site' ) );
419+
$nonce = filter_input(
420+
INPUT_POST,
421+
'_wpnonce',
422+
FILTER_SANITIZE_URL,
423+
);
424+
$admin_url = self::getAdminUrl( 'post_processed_site' ) . '&_wpnonce=' . $nonce;
425+
426+
wp_safe_redirect( $admin_url );
401427
exit;
402428
}
403429

‎src/ViewRenderer.php‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,20 @@ public static function renderDetectedFiles(): void {
6868
die( 'Forbidden' );
6969
}
7070

71+
if ( defined( 'STATIC_DEPLOY_WP_ORG_MODE' )
72+
&& STATIC_DEPLOY_WP_ORG_MODE
73+
&& ! wp_verify_nonce(
74+
filter_input(
75+
INPUT_GET,
76+
'_wpnonce',
77+
FILTER_SANITIZE_URL
78+
),
79+
Controller::getHookName( 'caches_page' )
80+
)
81+
) {
82+
wp_die( 'Invalid nonce' );
83+
}
84+
7185
$action = filter_input( INPUT_GET, 'action', FILTER_SANITIZE_URL );
7286
/**
7387
* @var string[] $url_id
@@ -121,6 +135,20 @@ public static function renderCrawledFiles(): void {
121135
die( 'Forbidden' );
122136
}
123137

138+
if ( defined( 'STATIC_DEPLOY_WP_ORG_MODE' )
139+
&& STATIC_DEPLOY_WP_ORG_MODE
140+
&& ! wp_verify_nonce(
141+
filter_input(
142+
INPUT_GET,
143+
'_wpnonce',
144+
FILTER_SANITIZE_URL
145+
),
146+
Controller::getHookName( 'caches_page' )
147+
)
148+
) {
149+
wp_die( 'Invalid nonce' );
150+
}
151+
124152
$action = filter_input( INPUT_GET, 'action', FILTER_SANITIZE_URL );
125153
/**
126154
* @var string[] $url_id
@@ -176,6 +204,20 @@ public static function renderPostProcessedSitePaths(): void {
176204
die( 'Forbidden' );
177205
}
178206

207+
if ( defined( 'STATIC_DEPLOY_WP_ORG_MODE' )
208+
&& STATIC_DEPLOY_WP_ORG_MODE
209+
&& ! wp_verify_nonce(
210+
filter_input(
211+
INPUT_GET,
212+
'_wpnonce',
213+
FILTER_SANITIZE_URL
214+
),
215+
Controller::getHookName( 'caches_page' )
216+
)
217+
) {
218+
wp_die( 'Invalid nonce' );
219+
}
220+
179221
$paths = ProcessedSite::getPaths();
180222

181223
// Apply search
@@ -220,6 +262,20 @@ public static function renderDeployCache(): void {
220262
die( 'Forbidden' );
221263
}
222264

265+
if ( defined( 'STATIC_DEPLOY_WP_ORG_MODE' )
266+
&& STATIC_DEPLOY_WP_ORG_MODE
267+
&& ! wp_verify_nonce(
268+
filter_input(
269+
INPUT_GET,
270+
'_wpnonce',
271+
FILTER_SANITIZE_URL
272+
),
273+
Controller::getHookName( 'caches_page' )
274+
)
275+
) {
276+
wp_die( 'Invalid nonce' );
277+
}
278+
223279
$deploy_namespace = strval(
224280
filter_input(
225281
INPUT_GET,

‎views/caches-page.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
}
99

1010
use StaticDeploy\Controller;
11+
use StaticDeploy\URLHelper;
1112

1213
/**
1314
* @var mixed[] $view
@@ -67,6 +68,11 @@
6768
}'
6869
);
6970

71+
$uri = URLHelper::getCurrent();
72+
if ( defined( 'STATIC_DEPLOY_WP_ORG_MODE' ) && STATIC_DEPLOY_WP_ORG_MODE ) {
73+
$uri = URLHelper::modifyUrl( [ '_wpnonce' => wp_create_nonce( strval( $view['nonce_action'] ) ) ], $uri );
74+
}
75+
7076
?>
7177

7278
<div class="wrap">

‎views/files-paginated-page.php‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
exit;
88
}
99

10+
use StaticDeploy\Controller;
1011
use StaticDeploy\URLHelper;
1112

1213
/**
@@ -43,6 +44,12 @@
4344
*/
4445
$paginator_last_page = $view['paginatorLastPage'];
4546

47+
$uri = URLHelper::getCurrent();
48+
if ( defined( 'STATIC_DEPLOY_WP_ORG_MODE' ) && STATIC_DEPLOY_WP_ORG_MODE ) {
49+
$nonce = wp_create_nonce( Controller::getHookName( 'caches_page' ) );
50+
$uri = URLHelper::modifyUrl( [ '_wpnonce' => $nonce ], $uri );
51+
}
52+
4653
?>
4754

4855
<div class="wrap">
@@ -77,8 +84,8 @@
7784
<span class="tablenav-pages-navspan button disabled" aria-hidden="true">«</span>
7885
<span class="tablenav-pages-navspan button disabled" aria-hidden="true">‹</span>
7986
<?php else : ?>
80-
<a class="first-page button" href="<?php echo esc_url( URLHelper::modifyUrl( [ 'paged' => 1 ] ) ); ?>"><span class="screen-reader-text">First page</span><span aria-hidden="true">«</span></a>
81-
<a class="prev-page button" href="<?php echo esc_url( URLHelper::modifyUrl( [ 'paged' => $paginator_page - 1 ] ) ); ?>"><span class="screen-reader-text">Previous page</span><span aria-hidden="true">‹</span></a>
87+
<a class="first-page button" href="<?php echo esc_url( URLHelper::modifyUrl( [ 'paged' => 1 ], $uri ) ); ?>"><span class="screen-reader-text">First page</span><span aria-hidden="true">«</span></a>
88+
<a class="prev-page button" href="<?php echo esc_url( URLHelper::modifyUrl( [ 'paged' => $paginator_page - 1 ], $uri ) ); ?>"><span class="screen-reader-text">Previous page</span><span aria-hidden="true">‹</span></a>
8289
<?php endif; ?>
8390
<span class="paging-input">
8491
<label for="current-page-selector" class="screen-reader-text">Current Page</label>
@@ -91,8 +98,8 @@
9198
<span class="tablenav-pages-navspan button disabled" aria-hidden="true">›</span>
9299
<span class="tablenav-pages-navspan button disabled" aria-hidden="true">»</span>
93100
<?php else : ?>
94-
<a class="next-page button" href="<?php echo esc_url( URLHelper::modifyUrl( [ 'paged' => $paginator_page + 1 ] ) ); ?>"><span class="screen-reader-text">Next page</span><span aria-hidden="true">›</span></a>
95-
<a class="last-page button" href="<?php echo esc_url( URLHelper::modifyUrl( [ 'paged' => $paginator_last_page ] ) ); ?>"><span class="screen-reader-text">Last page</span><span aria-hidden="true">»</span></a>
101+
<a class="next-page button" href="<?php echo esc_url( URLHelper::modifyUrl( [ 'paged' => $paginator_page + 1 ], $uri ) ); ?>"><span class="screen-reader-text">Next page</span><span aria-hidden="true">›</span></a>
102+
<a class="last-page button" href="<?php echo esc_url( URLHelper::modifyUrl( [ 'paged' => $paginator_last_page ], $uri ) ); ?>"><span class="screen-reader-text">Last page</span><span aria-hidden="true">»</span></a>
96103
<?php endif; ?>
97104
</span>
98105
</div>

0 commit comments

Comments
 (0)