Skip to content
This repository was archived by the owner on Dec 27, 2022. It is now read-only.

Commit d72775f

Browse files
valendesignsvalendesigns
committed
Merge pull request #11 from xwp/hotfix/0.3.1
v0.3.1
2 parents a879bee + dc7af75 commit d72775f

13 files changed

+55
-47
lines changed

‎.jshintignore

-1
This file was deleted.

‎.jshintignore

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
**/*.min.js
2+
**/node_modules/**
3+
**/vendor/**

‎composer.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
{
22
"name": "xwp/wp-customize-snapshots",
33
"description": "Allow Customizer states to be drafted, and previewed with a private URL.",
4-
"version": "0.3.0",
4+
"version": "0.3.1",
55
"type": "wordpress-plugin",
66
"homepage": "https://github.com/xwp/wp-customize-snapshots",
77
"license": "GPL-2.0+",
88
"require": {
99
"php": ">=5.3.0"
1010
},
1111
"require-dev": {
12-
"satooshi/php-coveralls": "~1.0"
12+
"satooshi/php-coveralls": "dev-master"
1313
}
1414
}

‎contributing.md

+1-7
Original file line numberDiff line numberDiff line change
@@ -58,13 +58,7 @@ To check the text domain:
5858
$ grunt checktextdomain
5959
```
6060

61-
To create a pot file:
62-
63-
``` bash
64-
$ grunt makepot
65-
```
66-
67-
The default task (simply running `grunt`) will do the following: `jshint -> checktextdomain`.
61+
The default task (simply running `grunt`) will do the following: `jshint -> uglify -> cssmin -> checktextdomain`.
6862

6963
### PHPUnit Testing
7064

‎customize-snapshots.php

+1-1
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
* Plugin Name: Customize Snapshots
44
* Plugin URI: https://github.com/xwp/wp-customize-snapshots
55
* Description: Allow Customizer states to be drafted, and previewed with a private URL.
6-
* Version: 0.3.0
6+
* Version: 0.3.1
77
* Author: XWP
88
* Author URI: https://xwp.co/
99
* License: GPLv2+

‎dev-lib

‎js/customize-snapshots.js

+3-3
Original file line numberDiff line numberDiff line change
@@ -225,15 +225,15 @@ var customizeSnapshots = ( function( $ ) {
225225
snapshotDialogShareLink = wp.template( id );
226226

227227
if ( url.match( regex ) ) {
228-
url = url.replace( regex, '$1' + 'customize_snapshot_uuid=' + response.customize_snapshot_uuid + '$2' );
228+
url = url.replace( regex, '$1' + 'customize_snapshot_uuid=' + encodeURIComponent( response.customize_snapshot_uuid ) + '$2' );
229229
} else {
230-
url = url + separator + 'customize_snapshot_uuid=' + response.customize_snapshot_uuid;
230+
url = url + separator + 'customize_snapshot_uuid=' + encodeURIComponent( response.customize_snapshot_uuid );
231231
}
232232

233233
if ( 'dirty' !== scope ) {
234234
scope = 'full';
235235
}
236-
url += '&scope=' + scope;
236+
url += '&scope=' + encodeURIComponent( scope );
237237

238238
// Write over the UUID
239239
if ( ! isPreview ) {

‎js/customize-snapshots.min.js

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

+6-6
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,12 @@
1111
"devDependencies": {
1212
"grunt": "~0.4.5",
1313
"grunt-checktextdomain": "~1.0.0",
14-
"grunt-contrib-clean": "^0.7.0",
15-
"grunt-contrib-copy": "~0.8.2",
16-
"grunt-contrib-cssmin": "^0.14.0",
17-
"grunt-contrib-jshint": "~0.11.3",
18-
"grunt-contrib-uglify": "^0.11.0",
19-
"grunt-shell": "~1.1.2",
14+
"grunt-contrib-clean": "~1.0.0",
15+
"grunt-contrib-copy": "~1.0.0",
16+
"grunt-contrib-cssmin": "~1.0.1",
17+
"grunt-contrib-jshint": "~1.0.0",
18+
"grunt-contrib-uglify": "~1.0.1",
19+
"grunt-shell": "~1.2.1",
2020
"grunt-wp-deploy": "^1.1.0"
2121
}
2222
}

‎php/class-customize-snapshot-manager.php

+17-15
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,14 @@ class Customize_Snapshot_Manager {
1818

1919
/**
2020
* Post type.
21+
*
2122
* @type string
2223
*/
2324
const POST_TYPE = 'customize_snapshot';
2425

2526
/**
2627
* Action nonce.
28+
*
2729
* @type string
2830
*/
2931
const AJAX_ACTION = 'customize_update_snapshot';
@@ -90,14 +92,16 @@ public function __construct( Plugin $plugin ) {
9092
$this->capture_unsanitized_snapshot_post_data();
9193
}
9294

93-
$uuid = isset( $_REQUEST['customize_snapshot_uuid'] ) ? sanitize_key( wp_unslash( $_REQUEST['customize_snapshot_uuid'] ) ) : null; // WPCS: input var ok.
94-
$scope = isset( $_REQUEST['scope'] ) ? sanitize_key( wp_unslash( $_REQUEST['scope'] ) ) : 'dirty'; // WPCS: input var ok.
95+
$uuid = isset( $_REQUEST['customize_snapshot_uuid'] ) ? sanitize_text_field( sanitize_key( wp_unslash( $_REQUEST['customize_snapshot_uuid'] ) ) ) : null; // WPCS: input var ok.
96+
$scope = isset( $_REQUEST['scope'] ) ? sanitize_text_field( sanitize_key( wp_unslash( $_REQUEST['scope'] ) ) ) : 'dirty'; // WPCS: input var ok.
9597
$apply_dirty = ( 'dirty' === $scope );
9698

9799
// Bootstrap the Customizer.
98100
if ( empty( $GLOBALS['wp_customize'] ) || ! ( $GLOBALS['wp_customize'] instanceof \WP_Customize_Manager ) && $uuid ) {
99101
require_once( ABSPATH . WPINC . '/class-wp-customize-manager.php' );
102+
// @codingStandardsIgnoreStart
100103
$GLOBALS['wp_customize'] = new \WP_Customize_Manager();
104+
// @codingStandardsIgnoreEnd
101105
}
102106
$this->customize_manager = $GLOBALS['wp_customize'];
103107

@@ -146,7 +150,7 @@ public function set_return_url() {
146150
'customize_snapshot_uuid' => $this->snapshot->uuid(),
147151
'scope' => $this->snapshot->apply_dirty ? 'dirty' : 'full',
148152
);
149-
$return_url = add_query_arg( $args, $this->customize_manager->get_return_url() );
153+
$return_url = add_query_arg( array_map( 'rawurlencode', $args ), $this->customize_manager->get_return_url() );
150154
$this->customize_manager->set_return_url( $return_url );
151155
}
152156
}
@@ -159,7 +163,7 @@ public function set_return_url() {
159163
public function current_url() {
160164
$http_host = isset( $_SERVER['HTTP_HOST'] ) ? wp_unslash( $_SERVER['HTTP_HOST'] ) : parse_url( home_url(), PHP_URL_HOST ); // WPCS: input var ok; sanitization ok.
161165
$request_uri = isset( $_SERVER['REQUEST_URI'] ) ? wp_unslash( $_SERVER['REQUEST_URI'] ) : '/'; // WPCS: input var ok; sanitization ok.
162-
return esc_url_raw( ( is_ssl() ? 'https://' : 'http://' ) . $http_host . $request_uri );
166+
return ( is_ssl() ? 'https://' : 'http://' ) . $http_host . $request_uri;
163167
}
164168

165169
/**
@@ -168,15 +172,15 @@ public function current_url() {
168172
* @return string
169173
*/
170174
public function clean_current_url() {
171-
return esc_url( remove_query_arg( array( 'customize_snapshot_uuid', 'scope' ), $this->current_url() ) );
175+
return remove_query_arg( array( 'customize_snapshot_uuid', 'scope' ), $this->current_url() );
172176
}
173177

174178
/**
175179
* Redirect when preview is not allowed for the current theme.
176180
*/
177181
public function maybe_force_redirect() {
178182
if ( false === $this->snapshot->is_preview() && isset( $_GET['customize_snapshot_uuid'] ) ) { // WPCS: input var ok.
179-
wp_safe_redirect( $this->clean_current_url() );
183+
wp_safe_redirect( esc_url_raw( $this->clean_current_url() ) );
180184
exit;
181185
}
182186
}
@@ -242,7 +246,7 @@ public function enqueue_scripts() {
242246
'is_preview' => $this->snapshot->is_preview(),
243247
'current_user_can_publish' => current_user_can( 'customize_publish' ),
244248
'snapshot_theme' => $snapshot_theme,
245-
'scope' => ( isset( $_GET['scope'] ) ? sanitize_key( wp_unslash( $_GET['scope'] ) ) : 'dirty' ), // WPCS: input var ok.
249+
'scope' => ( isset( $_GET['scope'] ) ? sanitize_text_field( sanitize_key( wp_unslash( $_GET['scope'] ) ) ) : 'dirty' ), // WPCS: input var ok.
246250
'i18n' => array(
247251
'saveButton' => __( 'Save', 'customize-snapshots' ),
248252
'saveDraftButton' => __( 'Save Draft', 'customize-snapshots' ),
@@ -322,7 +326,7 @@ public function set_snapshot_uuid() {
322326
}
323327
false && check_ajax_referer(); // Note: This is a workaround for PHPCS nonce verification check.
324328

325-
$uuid = ! empty( $_POST['snapshot_uuid'] ) ? sanitize_key( wp_unslash( $_POST['snapshot_uuid'] ) ) : null; // WPCS: input var ok.
329+
$uuid = ! empty( $_POST['snapshot_uuid'] ) ? sanitize_text_field( sanitize_key( wp_unslash( $_POST['snapshot_uuid'] ) ) ) : null; // WPCS: input var ok.
326330
if ( current_user_can( 'customize' ) && $uuid && $this->snapshot->is_valid_uuid( $uuid ) ) {
327331
$this->snapshot_uuid = $uuid;
328332
}
@@ -383,7 +387,7 @@ public function update_snapshot() {
383387
}
384388

385389
// Set the snapshot UUID.
386-
$this->snapshot->set_uuid( sanitize_key( wp_unslash( $_POST['customize_snapshot_uuid'] ) ) ); // WPCS: input var ok.
390+
$this->snapshot->set_uuid( sanitize_text_field( sanitize_key( wp_unslash( $_POST['customize_snapshot_uuid'] ) ) ) ); // WPCS: input var ok.
387391
$uuid = $this->snapshot->uuid();
388392
$next_uuid = $uuid;
389393

@@ -430,19 +434,17 @@ public function customize_menu( $wp_admin_bar ) {
430434
return;
431435
}
432436

433-
$current_url = remove_query_arg( array( 'customize_snapshot_uuid', 'scope' ), $this->current_url() );
434-
435437
$args = array();
436-
$uuid = isset( $_GET['customize_snapshot_uuid'] ) ? sanitize_key( wp_unslash( $_GET['customize_snapshot_uuid'] ) ) : null; // WPCS: input var ok.
437-
$scope = isset( $_GET['scope'] ) ? sanitize_key( wp_unslash( $_GET['scope'] ) ) : 'dirty'; // WPCS: input var ok.
438+
$uuid = isset( $_GET['customize_snapshot_uuid'] ) ? sanitize_text_field( sanitize_key( wp_unslash( $_GET['customize_snapshot_uuid'] ) ) ) : null; // WPCS: input var ok.
439+
$scope = isset( $_GET['scope'] ) ? sanitize_text_field( sanitize_key( wp_unslash( $_GET['scope'] ) ) ) : 'dirty'; // WPCS: input var ok.
438440

439441
if ( $uuid && $this->snapshot->is_valid_uuid( $uuid ) ) {
440442
$args['customize_snapshot_uuid'] = $uuid;
441443
$args['scope'] = ( 'dirty' !== $scope ? 'full' : 'dirty' );
442444
}
443445

444-
$args['url'] = urlencode( $current_url );
445-
$customize_url = add_query_arg( $args, wp_customize_url() );
446+
$args['url'] = esc_url_raw( $this->clean_current_url() );
447+
$customize_url = add_query_arg( array_map( 'rawurlencode', $args ), wp_customize_url() );
446448

447449
$wp_admin_bar->add_menu(
448450
array(

‎php/class-customize-snapshot.php

+4-1
Original file line numberDiff line numberDiff line change
@@ -228,8 +228,11 @@ public function post( $refresh = false ) {
228228
'posts_per_page' => 1,
229229
'post_type' => Customize_Snapshot_Manager::POST_TYPE,
230230
'post_status' => array( 'draft', 'publish' ),
231+
'no_found_rows' => true,
232+
'ignore_sticky_posts' => true,
233+
'cache_results' => false,
231234
) );
232-
$posts = $query->get_posts();
235+
$posts = $query->posts;
233236
remove_action( 'pre_get_posts', array( $this, '_override_wp_query_is_single' ) );
234237

235238
if ( empty( $posts ) ) {

‎php/class-plugin.php

+4-7
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ public function __construct() {
4343
public function init() {
4444
add_action( 'wp_default_scripts', array( $this, 'register_scripts' ), 11 );
4545
add_action( 'wp_default_styles', array( $this, 'register_styles' ), 11 );
46-
add_action( 'user_has_cap', array( $this, 'filter_user_has_cap' ), 10, 4 );
46+
add_action( 'user_has_cap', array( $this, 'filter_user_has_cap' ), 10 );
4747

4848
$this->customize_snapshot_manager = new Customize_Snapshot_Manager( $this );
4949
}
@@ -77,17 +77,14 @@ public function register_styles( \WP_Styles $wp_styles ) {
7777
/**
7878
* Add the customize_publish capability to users who can edit_theme_options by default.
7979
*
80-
* @param array $allcaps An array of all the user's capabilities.
81-
* @param array $caps Actual capabilities for meta capability.
82-
* @param array $args Optional parameters passed to has_cap(), typically object ID.
83-
* @param \WP_User $user The user object.
80+
* @param array $allcaps An array of all the user's capabilities.
8481
* @return array All caps.
8582
*/
86-
public function filter_user_has_cap( $allcaps, $caps, $args, $user ) {
87-
unset( $caps, $args, $user );
83+
public function filter_user_has_cap( $allcaps ) {
8884
if ( ! empty( $allcaps['edit_theme_options'] ) ) {
8985
$allcaps['customize_publish'] = true;
9086
}
87+
9188
return $allcaps;
9289
}
9390
}

‎readme.md

+6-1
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Allow Customizer states to be drafted, and previewed with a private URL.
77
**Tags:** [customizer](https://wordpress.org/plugins/tags/customizer), [customize](https://wordpress.org/plugins/tags/customize), [snapshots](https://wordpress.org/plugins/tags/snapshots)
88
**Requires at least:** 4.3
99
**Tested up to:** trunk
10-
**Stable tag:** 0.3.0
10+
**Stable tag:** 0.3.1
1111
**License:** [GPLv2 or later](http://www.gnu.org/licenses/gpl-2.0.html)
1212

1313
[![Build Status](https://travis-ci.org/xwp/wp-customize-snapshots.svg?branch=master)](https://travis-ci.org/xwp/wp-customize-snapshots) [![Coverage Status](https://coveralls.io/repos/xwp/wp-customize-snapshots/badge.svg?branch=master)](https://coveralls.io/github/xwp/wp-customize-snapshots) [![Built with Grunt](https://cdn.gruntjs.com/builtwith.png)](http://gruntjs.com) [![devDependency Status](https://david-dm.org/xwp/wp-customize-snapshots/dev-status.svg)](https://david-dm.org/xwp/wp-customize-snapshots#info=devDependencies)
@@ -24,6 +24,11 @@ Requires PHP 5.3+.
2424

2525
## Changelog ##
2626

27+
### 0.3.1 ###
28+
* Fix additional WordPress VIP issues.
29+
* Update `dev-lib`.
30+
* Update Coveralls.
31+
2732
### 0.3.0 ###
2833
* Initialize Snapshots before Widget Posts so that `$wp_customize` will be set on the front-end.
2934
* Fix WordPress VIP PHPCS issues.

0 commit comments

Comments
 (0)