WordPress.org
Get WordPress

Plugin Directory

Changeset 3309746


Ignore:
Timestamp:
06/11/2025 11:21:57 AM (8 months ago)
Author:
clabsvishnuprasad
Message:

security issues fixes

Location:
customerlabs-actionrecorder
Files:
8 edited
6 copied

Legend:

Unmodified
Added
Removed

  • customerlabs-actionrecorder/tags/1.9.2/ActionRecorder.php

    r3141407 r3309746  
    33Plugin Name: WooCommerce Conversion Tracking
    44Description: A simple implementation of e-commerce events tracking for Wordpress
    5 Version: 1.9.1
     5Version: 1.9.2
    66License: GPLv2
    77Author: CustomerLabs Digital Solutions Pvt. Ltd.
    … …  
    272272    */
    273273    public function plugin_action_links( $links, $file ) {
    274         error_log(print_r($links, true));
    275274        // Not for other plugins, silly. NOTE: This doesn't work properly when
    276275        // the plugin for testing is a symlink!! If you change this, test it.

  • customerlabs-actionrecorder/tags/1.9.2/Readme.md

    r3141407 r3309746  
    33Tags: WooCommerce Conversion Tracking, WooCommerce Conversion Tracking Google Ads, WooCommerce Conversion Tracking GA4, WooCommerce Meta Ads Conversions API, WooCommerce event tracking, WooCommerce track events
    44Requires at least: 5.0
    5 Tested up to: 6.6.1
    6 Stable tag: 1.9.1
     5Tested up to: 6.8.1
     6Stable tag: 1.9.2
    77Requires PHP: 7.0
    88License: GPLv2
    … …  
    1414
    1515CustomerLabs plugin is one of the best WooCommerce plugins to track conversion events on your WooCommerce store, and send it to Ad platforms seamlessly. This plugin goes beyond conversion tracking and establishes a robust connection of your WooCommerce store with ad platforms.
     16
     17🔒 **Enhanced Security**: Version 1.9.2 includes comprehensive security improvements with CSRF protection, enhanced access controls, and secure cookie handling to ensure your data is protected.
    1618
    1719### With the automatic event tracking for your WooCommerce store by [CustomerLabs](https://customerlabs.com/), you can track
    … …  
    4244* Connect WhatsApp
    4345* Sync the data with BigQuery for detailed analysis of your data, creating custom reports and more
     46* **Enhanced security features** with CSRF protection and secure cookie handling
    4447
    4548
    … …  
    5659* Helps activate anonymous website visitors
    5760* ROI positive implementation
     61* **Secure and compliant** with WordPress security best practices
    5862
    5963
    … …  
    7781That's it! You can now turn on any Destinations in CustomerLabs CDP Destinations section.
    7882
     83## Security
     84
     85Version 1.9.2 includes comprehensive security enhancements:
     86- **CSRF Protection**: All AJAX endpoints are protected with nonce verification
     87- **Enhanced Access Controls**: Improved input validation and sanitization
     88- **Secure Cookie Handling**: Proper security flags for cookie protection
     89- **WordPress Security Compliance**: Follows WordPress security best practices
     90- **Information Protection**: Removed debug code to prevent data leakage
     91
    7992## Frequently Asked Questions
    8093
    81 - Is CustomerLabs Plugin for WooCommerce Conversion Tracking Free? =
     94**Is CustomerLabs Plugin for WooCommerce Conversion Tracking Free?**
    8295
    8396Yes. CustomerLabs plugin for WooCommerce Conversion Tracking is a free plugin on WordPress for your WooCommerce store. However, you would need CustomerLabs account to leverage the plugin
    8497
    85 - Is CustomerLabs WooCommerce Conversion Tracking on the server-side? =
     98**Is CustomerLabs WooCommerce Conversion Tracking on the server-side?**
    8699
    87100CustomerLabs offers a robust 1P domain tracking or the first-party domain that helps you set first-party cookies that stay for almost a lifetime. You can leverage it to reinforce your WooCommerce store conversion tracking efforts, and get a complete customer journey without any signal loss.
    88101
    89 - Does CustomerLabs plugin offer WooCommerce Conversion Tracking for Google Ads? =
     102**Does CustomerLabs plugin offer WooCommerce Conversion Tracking for Google Ads?**
    90103
    91104Yes. CustomerLabs free plugin offers direct and seamless integration with Google Ads, helping you with WooCommerce Conversion Tracking in Google Ads.
    92105
    93 - Does CustomerLabs plugin offer WooCommerce Conversions API for Meta Ads? =
     106**Does CustomerLabs plugin offer WooCommerce Conversions API for Meta Ads?**
    94107
    95108CustomerLabs plugin offers one click integration of data from your website to Meta Ads through Conversions API. The entire technology is robust that would help you mitigate signal loss to Meta Ads.
    96109
    97 
    98 - Does CustomerLabs plugin offer WooCommerce Conversion Tracking for GA4? =
     110**Does CustomerLabs plugin offer WooCommerce Conversion Tracking for GA4?**
    99111
    100112WooCommerce conversion tracking in GA4 is essential for marketers, and CustomerLabs offers GA4 integration for your store through Google Measurement Protocol (GMP) sending all the data on the server-side with just a few clicks.
    101113
    102 - Why is CustomerLabs the best plugin for WooCommerce stores? =
     114**Is the plugin secure?**
     115
     116Yes, version 1.9.2 includes comprehensive security enhancements including CSRF protection, secure cookie handling, enhanced access controls, and follows WordPress security best practices to protect your data.
     117
     118**Why is CustomerLabs the best plugin for WooCommerce stores?**
    103119
    104120CustomerLabs plugin offers one-stop solution for tracking all conversions including custom conversions for your WooCommerce stores and send the conversion tracking data across to any platform such as GA4, Google Ads, Meta Ads, LinkedIn Ads, and more, with just a few clicks! It offers consent mode v2 for Google Ads, and a centralized consent triggers for all marketing platforms from a single space. It goes beyond conversion tracking and offers synthetic event optimization. To know more, reach out to our experts and get a free 1PD OPs consultation [here](http://customerlabs.com/request-a-demo/)
    … …  
    111127## Changelog
    112128
    113 = 1.9.1 =
     129**1.9.2**
     130* Security Enhancement - Implemented comprehensive security improvements
     131* Security Enhancement - Added CSRF protection with nonce verification
     132* Security Enhancement - Enhanced access controls and input validation
     133* Security Enhancement - Improved cookie security with proper flags
     134* Security Enhancement - Removed debug code to prevent information disclosure
     135* Security Enhancement - Follows WordPress security best practices
     136* Bug Fix - Improved error handling and sanitization
     137
     138**1.9.1**
    114139* Bug Fix - fixed cookie set on cashed pages
    115140
    116 = 1.9.0 =
     141**1.9.0**
    117142* Server side cookie tracking - user_id implementation
    118143
    119 = 1.8.2 =
     144**1.8.2**
    120145* README.md updated
    121146
    122 = 1.8.1 =
     147**1.8.1**
    123148* Javascript variable conflict on cookie update
    124149
    125 = 1.8.0 =
     150**1.8.0**
    126151* Plugin name changed from Action Recorder -> Customerlabs CDP
    127152
    128 = 1.7.0 =
     153**1.7.0**
    129154* Plugin tested upto latest version of WordPress-6.1.1
    130155
    131 = 1.6.0 =
     156**1.6.0**
    132157* Handled duplicate purchase event triggers
    133158
    134 = 1.5.0 =
     159**1.5.0**
    135160* Cookies values contains plus instead of space issue fixed
    136161
    137 = 1.4.0 =
     162**1.4.0**
    138163* Handling ajax triggers from frontend for add_to_cart and remove_from_cart
    139164
    140 = 1.3.1 =
     165**1.3.1**
    141166* Removed user traits from "User Signed Up" and "User Logged In" events
    142167
    143 = 1.3.0 =
     168**1.3.0**
    144169* Fixed multiple ajax events
    145170* Fixed multiple events tracking on page load
    146171
    147 = 1.2.1 =
     172**1.2.1**
    148173* Bug Fix settings update issue
    149174
    150 = 1.2.0 =
     175**1.2.0**
    151176* Added search event tracking
    152177
    153 = 1.1.0 =
     178**1.1.0**
    154179* woocommerce tracking
    155180
    156 = 1.0.0 =
     181**1.0.0**
    157182* Initial release!
    158183
    159184## Upgrade Notice
    160185
    161 = 1.9.1 =
     186**1.9.2**
     187IMPORTANT SECURITY UPDATE: This version includes critical security enhancements including CSRF protection, enhanced access controls, and secure cookie handling. Update immediately for improved security and protection.
     188
     189**1.9.1**
    162190Bug Fix - fixed cookie set on cashed pages
    163191
    164 = 1.9.0 =
     192**1.9.0**
    165193Server side cookie tracking - user_id implementation
    166194
    167 = 1.8.2 =
     195**1.8.2**
    168196README.md updated
    169197
    170 = 1.8.1 =
     198**1.8.1**
    171199Javascript variable conflict on cookie update
    172200
    173 = 1.8.0 =
     201**1.8.0**
    174202Plugin name changed from Action Recorder -> Customerlabs CDP
    175203
    176 = 1.7.0 =
     204**1.7.0**
    177205Plugin tested upto latest version of WordPress-6.1.1
    178206
    179 = 1.6.0 =
     207**1.6.0**
    180208Handled duplicate purchase event triggers
    181209
    182 = 1.5.0 =
     210**1.5.0**
    183211Cookies values contains plus instead of space issue fixed
    184212
    185 = 1.4.0 =
     213**1.4.0**
    186214Handling ajax triggers from frontend for add_to_cart and remove_from_cart
    187215
    188 = 1.3.1 =
     216**1.3.1**
    189217Removed user traits from "User Signed Up" and "User Logged In" events
    190218
    191 = 1.3.0 =
     219**1.3.0**
    192220Fixed multiple ajax events
    193221Fixed multiple events tracking on page load
    194222
    195 = 1.2.1 =
     223**1.2.1**
    196224Bug Fix settings update issue
    197225
    198 = 1.2.0 =
     226**1.2.0**
    199227Added search event tracking
    200 
    201 = 1.1.0 =
    202 Supports woocommerce integration
    203 
    204 = 1.0 =
    205 Just released into the wild.

  • customerlabs-actionrecorder/tags/1.9.2/Readme.txt

    r3141407 r3309746  
    33Tags: WooCommerce Conversion Tracking, WooCommerce Conversion Tracking Google Ads, WooCommerce Conversion Tracking GA4, WooCommerce Meta Ads Conversions API, WooCommerce event tracking, WooCommerce track events
    44Requires at least: 5.0
    5 Tested up to: 6.6.1
    6 Stable tag: 1.9.1
     5Tested up to: 6.8.1
     6Stable tag: 1.9.2
    77Requires PHP: 7.0
    88License: GPLv2
    … …  
    1414
    1515CustomerLabs plugin is one of the best WooCommerce plugins to track conversion events on your WooCommerce store, and send it to Ad platforms seamlessly. This plugin goes beyond conversion tracking and establishes a robust connection of your WooCommerce store with ad platforms.
     16
     17🔒 **Enhanced Security**: Version 1.9.2 includes comprehensive security improvements with CSRF protection, enhanced access controls, and secure cookie handling to ensure your data is protected.
    1618
    1719### With the automatic event tracking for your WooCommerce store by [CustomerLabs](https://customerlabs.com/), you can track
    … …  
    4244* Connect WhatsApp
    4345* Sync the data with BigQuery for detailed analysis of your data, creating custom reports and more
     46* **Enhanced security features** with CSRF protection and secure cookie handling
    4447
    4548
    … …  
    5659* Helps activate anonymous website visitors
    5760* ROI positive implementation
     61* **Secure and compliant** with WordPress security best practices
    5862
    5963
    … …  
    8589WooCommerce conversion tracking in GA4 is essential for marketers, and CustomerLabs offers GA4 integration for your store through Google Measurement Protocol (GMP) sending all the data on the server-side with just a few clicks.
    8690
     91= Is the plugin secure? =
     92Yes, version 1.9.2 includes comprehensive security enhancements including CSRF protection, secure cookie handling, enhanced access controls, and follows WordPress security best practices to protect your data.
     93
    8794= Why is CustomerLabs the best plugin for WooCommerce stores? =
    8895CustomerLabs plugin offers one-stop solution for tracking all conversions including custom conversions for your WooCommerce stores and send the conversion tracking data across to any platform such as GA4, Google Ads, Meta Ads, LinkedIn Ads, and more, with just a few clicks! It offers consent mode v2 for Google Ads, and a centralized consent triggers for all marketing platforms from a single space. It goes beyond conversion tracking and offers synthetic event optimization. To know more, reach out to our experts and get a free 1PD OPs consultation [here](http://customerlabs.com/request-a-demo/)
    … …  
    94101
    95102== Changelog ==
     103
     104= 1.9.2 =
     105* Security Enhancement - Implemented comprehensive security improvements
     106* Security Enhancement - Added CSRF protection with nonce verification
     107* Security Enhancement - Enhanced access controls and input validation
     108* Security Enhancement - Improved cookie security with proper flags
     109* Security Enhancement - Removed debug code to prevent information disclosure
     110* Security Enhancement - Follows WordPress security best practices
     111* Bug Fix - Improved error handling and sanitization
    96112
    97113= 1.9.1 =
    … …  
    143159== Upgrade Notice ==
    144160
     161= 1.9.2 =
     162IMPORTANT SECURITY UPDATE: This version includes critical security enhancements including CSRF protection, enhanced access controls, and secure cookie handling. Update immediately for improved security and protection.
     163
    145164= 1.9.1 =
    146165Bug Fix - fixed cookie set on cashed pages

  • customerlabs-actionrecorder/tags/1.9.2/class.cltracker-cookie.php

    r3141407 r3309746  
    1515     * @param string $key Name of the cookie
    1616     * @param string $value Value of the cookie
     17     * @param bool $httponly Whether cookie should be httponly (default false for tracking cookies)
    1718     *
    1819     * @since 1.0.0
    1920     *
    2021     */
    21     public static function set_cookie( $key, $value ) {
    22         @ setrawcookie( 'cltracker_' . $key . '_' . COOKIEHASH, rawurlencode($value), time() + DAY_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN );
     22    public static function set_cookie( $key, $value, $httponly = false ) {
     23        // Set secure cookie with appropriate flags
     24        $secure = is_ssl();
     25        // Most tracking cookies need JavaScript access, so httponly is optional
     26        @ setrawcookie( 'cltracker_' . $key . '_' . COOKIEHASH, rawurlencode($value), time() + DAY_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN, $secure, $httponly );
    2327        $_COOKIE[ 'cltracker_' . $key . '_' . COOKIEHASH ] = $value;
    2428    }
    … …  
    6468        }
    6569       
    66         print_r($set);
     70        // Removed debug print_r that was leaking information
    6771       
    6872        if (!$set) {
    … …  
    8387    public static function unset_cookie( $key = '' ) {
    8488
     89        // Verify nonce for CSRF protection
     90        if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cltracker_nonce')) {
     91            wp_send_json_error('Security check failed');
     92            wp_die();
     93        }
     94       
    8595        if ( isset( $_POST['key'] ) ) {
    8696            $key = sanitize_text_field( $_POST['key'] );
    8797        }
    8898
    89         @ setcookie( 'cltracker_' . $key . '_' . COOKIEHASH, '', time() - DAY_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN );
     99        // Enhanced key validation
     100        if (empty($key) || !preg_match('/^[a-zA-Z0-9_]+$/', $key)) {
     101            wp_send_json_error('Invalid key format');
     102            wp_die();
     103        }
     104
     105        // Set secure cookie deletion - no httponly needed for deletion
     106        $secure = is_ssl();
     107        @ setcookie( 'cltracker_' . $key . '_' . COOKIEHASH, '', time() - DAY_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN, $secure, false );
    90108        unset( $_COOKIE[ 'cltracker_' . $key . '_' . COOKIEHASH ] );
    91109
    92         wp_send_json_success( $key );
     110        wp_send_json_success( 'Cookie cleared successfully' );
     111        wp_die();
    93112    }
    94113
    … …  
    99118     */
    100119    public static function set_unique_user_id_cookie() {
     120        // Verify nonce for CSRF protection
     121        if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cltracker_nonce')) {
     122            wp_send_json_error('Security check failed');
     123            wp_die();
     124        }
     125       
    101126        $settings = CLTracker_Wordpress::get_instance()->get_settings();
    102         $app_id = $settings['app_id'];
     127        $app_id = sanitize_text_field($settings['app_id']);
     128       
     129        if (empty($app_id)) {
     130            wp_send_json_error('Invalid app ID');
     131            wp_die();
     132        }
     133       
    103134        $cookie_name = $app_id . "_uid";
    104135       
    105136        if ( isset( $_COOKIE[$cookie_name] ) ) {
    106             @ setrawcookie( $cookie_name , $_COOKIE[$cookie_name],["expires" => time() + YEAR_IN_SECONDS, "path" => COOKIEPATH, "domain" =>  ("." . COOKIE_DOMAIN),"samesite" => "Lax"] );
     137            $secure = is_ssl();
     138            // User ID cookie can be httponly since it's mainly for server-side identification
     139            @ setrawcookie( $cookie_name , $_COOKIE[$cookie_name], [
     140                "expires" => time() + YEAR_IN_SECONDS,
     141                "path" => COOKIEPATH,
     142                "domain" => ("." . COOKIE_DOMAIN),
     143                "samesite" => "Lax",
     144                "secure" => $secure,
     145            ] );
    107146        }
     147       
     148        wp_send_json_success('Cookie set successfully');
     149        wp_die();
     150    }
     151
     152    /**
     153     * Generate nonce for AJAX calls
     154     *
     155     * @since 1.9.2
     156     */
     157    public static function get_nonce() {
     158        return wp_create_nonce('cltracker_nonce');
    108159    }
    109160
    110161}
    111162
    112 add_action( 'wp_ajax_cltracker_unset_cookie'        , array( 'CLTracker_Cookie', 'unset_cookie' ) );
    113 add_action( 'wp_ajax_nopriv_cltracker_unset_cookie' , array( 'CLTracker_Cookie', 'unset_cookie' ) );
    114 add_action( 'wp_ajax_cltracker_set1pd_cookie'       , array( 'CLTracker_Cookie', 'set_unique_user_id_cookie' ) );
     163// Register AJAX actions for both authenticated and non-authenticated users
     164// This is necessary for tracking functionality to work for all website visitors
     165add_action( 'wp_ajax_cltracker_unset_cookie', array( 'CLTracker_Cookie', 'unset_cookie' ) );
     166add_action( 'wp_ajax_nopriv_cltracker_unset_cookie', array( 'CLTracker_Cookie', 'unset_cookie' ) );
     167add_action( 'wp_ajax_cltracker_set1pd_cookie', array( 'CLTracker_Cookie', 'set_unique_user_id_cookie' ) );
    115168add_action( 'wp_ajax_nopriv_cltracker_set1pd_cookie', array( 'CLTracker_Cookie', 'set_unique_user_id_cookie' ) );

  • customerlabs-actionrecorder/tags/1.9.2/integrations/ecommerce/woocommerce.php

    r2728289 r3309746  
    2727        add_action( 'woocommerce_add_to_cart'                   , array( $this, 'add_to_cart' )     , 10, 3 );
    2828        add_action( 'woocommerce_remove_cart_item', array( $this, 'remove_from_cart' ), 10, 1);
     29       
    2930    }
    3031
    … …  
    144145        $image_url = wp_get_attachment_image_url( $image_id, 'full' );
    145146
    146         CLTracker_Cookie::set_cookie( 'added_to_cart' . '_' . $id, json_encode(
    147             array(
    148                 'event'      => __( 'Added to cart', 'cltracker' ),
    149                 'attributes' => array(
    150                     "customProperties" => array(
    151                         "currency" => get_woocommerce_currency(),
    152                         "content_type" => "product_group"
    153                     ),
    154                     "productProperties" => array(
    155                         array(
    156                             'product_id'       => $id,
    157                             'product_quantity' => $quantity,
    158                             'product_name'     => $product->get_name(),
    159                             'product_price'    => $product->get_price(),
    160                             'product_image'    => $image_url,
    161                             'product_sku'      => $product->get_sku(),
    162                             'product_category' => implode( ', ', wp_list_pluck( wc_get_product_terms( $product->get_id(), 'product_cat' ), 'name' ) ),
    163                         )
     147        // Instead of setting cookie, output JavaScript
     148        $data = array(
     149            'event'      => __( 'Added to cart', 'cltracker' ),
     150            'attributes' => array(
     151                "customProperties" => array(
     152                    "currency" => get_woocommerce_currency(),
     153                    "content_type" => "product_group"
     154                ),
     155                "productProperties" => array(
     156                    array(
     157                        'product_id'       => $id,
     158                        'product_quantity' => $quantity,
     159                        'product_name'     => $product->get_name(),
     160                        'product_price'    => $product->get_price(),
     161                        'product_image'    => $image_url,
     162                        'product_sku'      => $product->get_sku(),
     163                        'product_category' => implode( ', ', wp_list_pluck( wc_get_product_terms( $product->get_id(), 'product_cat' ), 'name' ) ),
    164164                    )
    165                 ),
    166                 'cached_event' => 'added_to_cart_' . $id
    167             )
    168         ));
     165                )
     166            ),
     167            'cached_event' => 'added_to_cart_' . $id
     168        );
     169
     170        // Add inline script to store data in localStorage
     171        // wp_add_inline_script('jquery', '
     172        //  localStorage.setItem("added_to_cart_' . $id . '", ' . json_encode(json_encode($data)) . ');
     173        // ');
     174        CLTracker_Cookie::set_cookie( 'added_to_cart' . '_' . $id, json_encode( $data ) );
    169175
    170176    }
    … …  
    215221                    )
    216222                ),
    217                 'cached_event' => 'removed_from_cart_' . $id
     223                'cached_event' => 'removed_from_cart_' . $cart_item['product_id']
    218224            )
    219225        ));

  • customerlabs-actionrecorder/tags/1.9.2/templates/track.php

    r2862092 r3309746  
    22window.clWordpressTrack = function(){
    33    var _clsettings = <?php echo json_encode( CLTracker_WordPress::esc_js_deep( $settings ) ); ?>;
     4    var _clnonce = "<?php echo wp_create_nonce('cltracker_nonce'); ?>";
    45    var _clSendEvent = function(woo_event_name, woo_attributes){
    56        if(woo_event_name == "Purchased"){
    … …  
    3435                            action : 'cltracker_unset_cookie',
    3536                            key    : '<?php echo esc_js( $cached_event ); ?>',
     37                            nonce  : _clnonce
    3638
    3739                        },
    … …  
    7375                formData.append("action", "cltracker_unset_cookie");
    7476                formData.append("key", value["cached_event"]);
     77                formData.append("nonce", _clnonce);
    7578                _clSendEvent(value["event"], value["attributes"]);
    7679               

  • customerlabs-actionrecorder/trunk/ActionRecorder.php

    r3141407 r3309746  
    33Plugin Name: WooCommerce Conversion Tracking
    44Description: A simple implementation of e-commerce events tracking for Wordpress
    5 Version: 1.9.1
     5Version: 1.9.2
    66License: GPLv2
    77Author: CustomerLabs Digital Solutions Pvt. Ltd.
    … …  
    272272    */
    273273    public function plugin_action_links( $links, $file ) {
    274         error_log(print_r($links, true));
    275274        // Not for other plugins, silly. NOTE: This doesn't work properly when
    276275        // the plugin for testing is a symlink!! If you change this, test it.

  • customerlabs-actionrecorder/trunk/Readme.md

    r3141407 r3309746  
    33Tags: WooCommerce Conversion Tracking, WooCommerce Conversion Tracking Google Ads, WooCommerce Conversion Tracking GA4, WooCommerce Meta Ads Conversions API, WooCommerce event tracking, WooCommerce track events
    44Requires at least: 5.0
    5 Tested up to: 6.6.1
    6 Stable tag: 1.9.1
     5Tested up to: 6.8.1
     6Stable tag: 1.9.2
    77Requires PHP: 7.0
    88License: GPLv2
    … …  
    1414
    1515CustomerLabs plugin is one of the best WooCommerce plugins to track conversion events on your WooCommerce store, and send it to Ad platforms seamlessly. This plugin goes beyond conversion tracking and establishes a robust connection of your WooCommerce store with ad platforms.
     16
     17🔒 **Enhanced Security**: Version 1.9.2 includes comprehensive security improvements with CSRF protection, enhanced access controls, and secure cookie handling to ensure your data is protected.
    1618
    1719### With the automatic event tracking for your WooCommerce store by [CustomerLabs](https://customerlabs.com/), you can track
    … …  
    4244* Connect WhatsApp
    4345* Sync the data with BigQuery for detailed analysis of your data, creating custom reports and more
     46* **Enhanced security features** with CSRF protection and secure cookie handling
    4447
    4548
    … …  
    5659* Helps activate anonymous website visitors
    5760* ROI positive implementation
     61* **Secure and compliant** with WordPress security best practices
    5862
    5963
    … …  
    7781That's it! You can now turn on any Destinations in CustomerLabs CDP Destinations section.
    7882
     83## Security
     84
     85Version 1.9.2 includes comprehensive security enhancements:
     86- **CSRF Protection**: All AJAX endpoints are protected with nonce verification
     87- **Enhanced Access Controls**: Improved input validation and sanitization
     88- **Secure Cookie Handling**: Proper security flags for cookie protection
     89- **WordPress Security Compliance**: Follows WordPress security best practices
     90- **Information Protection**: Removed debug code to prevent data leakage
     91
    7992## Frequently Asked Questions
    8093
    81 - Is CustomerLabs Plugin for WooCommerce Conversion Tracking Free? =
     94**Is CustomerLabs Plugin for WooCommerce Conversion Tracking Free?**
    8295
    8396Yes. CustomerLabs plugin for WooCommerce Conversion Tracking is a free plugin on WordPress for your WooCommerce store. However, you would need CustomerLabs account to leverage the plugin
    8497
    85 - Is CustomerLabs WooCommerce Conversion Tracking on the server-side? =
     98**Is CustomerLabs WooCommerce Conversion Tracking on the server-side?**
    8699
    87100CustomerLabs offers a robust 1P domain tracking or the first-party domain that helps you set first-party cookies that stay for almost a lifetime. You can leverage it to reinforce your WooCommerce store conversion tracking efforts, and get a complete customer journey without any signal loss.
    88101
    89 - Does CustomerLabs plugin offer WooCommerce Conversion Tracking for Google Ads? =
     102**Does CustomerLabs plugin offer WooCommerce Conversion Tracking for Google Ads?**
    90103
    91104Yes. CustomerLabs free plugin offers direct and seamless integration with Google Ads, helping you with WooCommerce Conversion Tracking in Google Ads.
    92105
    93 - Does CustomerLabs plugin offer WooCommerce Conversions API for Meta Ads? =
     106**Does CustomerLabs plugin offer WooCommerce Conversions API for Meta Ads?**
    94107
    95108CustomerLabs plugin offers one click integration of data from your website to Meta Ads through Conversions API. The entire technology is robust that would help you mitigate signal loss to Meta Ads.
    96109
    97 
    98 - Does CustomerLabs plugin offer WooCommerce Conversion Tracking for GA4? =
     110**Does CustomerLabs plugin offer WooCommerce Conversion Tracking for GA4?**
    99111
    100112WooCommerce conversion tracking in GA4 is essential for marketers, and CustomerLabs offers GA4 integration for your store through Google Measurement Protocol (GMP) sending all the data on the server-side with just a few clicks.
    101113
    102 - Why is CustomerLabs the best plugin for WooCommerce stores? =
     114**Is the plugin secure?**
     115
     116Yes, version 1.9.2 includes comprehensive security enhancements including CSRF protection, secure cookie handling, enhanced access controls, and follows WordPress security best practices to protect your data.
     117
     118**Why is CustomerLabs the best plugin for WooCommerce stores?**
    103119
    104120CustomerLabs plugin offers one-stop solution for tracking all conversions including custom conversions for your WooCommerce stores and send the conversion tracking data across to any platform such as GA4, Google Ads, Meta Ads, LinkedIn Ads, and more, with just a few clicks! It offers consent mode v2 for Google Ads, and a centralized consent triggers for all marketing platforms from a single space. It goes beyond conversion tracking and offers synthetic event optimization. To know more, reach out to our experts and get a free 1PD OPs consultation [here](http://customerlabs.com/request-a-demo/)
    … …  
    111127## Changelog
    112128
    113 = 1.9.1 =
     129**1.9.2**
     130* Security Enhancement - Implemented comprehensive security improvements
     131* Security Enhancement - Added CSRF protection with nonce verification
     132* Security Enhancement - Enhanced access controls and input validation
     133* Security Enhancement - Improved cookie security with proper flags
     134* Security Enhancement - Removed debug code to prevent information disclosure
     135* Security Enhancement - Follows WordPress security best practices
     136* Bug Fix - Improved error handling and sanitization
     137
     138**1.9.1**
    114139* Bug Fix - fixed cookie set on cashed pages
    115140
    116 = 1.9.0 =
     141**1.9.0**
    117142* Server side cookie tracking - user_id implementation
    118143
    119 = 1.8.2 =
     144**1.8.2**
    120145* README.md updated
    121146
    122 = 1.8.1 =
     147**1.8.1**
    123148* Javascript variable conflict on cookie update
    124149
    125 = 1.8.0 =
     150**1.8.0**
    126151* Plugin name changed from Action Recorder -> Customerlabs CDP
    127152
    128 = 1.7.0 =
     153**1.7.0**
    129154* Plugin tested upto latest version of WordPress-6.1.1
    130155
    131 = 1.6.0 =
     156**1.6.0**
    132157* Handled duplicate purchase event triggers
    133158
    134 = 1.5.0 =
     159**1.5.0**
    135160* Cookies values contains plus instead of space issue fixed
    136161
    137 = 1.4.0 =
     162**1.4.0**
    138163* Handling ajax triggers from frontend for add_to_cart and remove_from_cart
    139164
    140 = 1.3.1 =
     165**1.3.1**
    141166* Removed user traits from "User Signed Up" and "User Logged In" events
    142167
    143 = 1.3.0 =
     168**1.3.0**
    144169* Fixed multiple ajax events
    145170* Fixed multiple events tracking on page load
    146171
    147 = 1.2.1 =
     172**1.2.1**
    148173* Bug Fix settings update issue
    149174
    150 = 1.2.0 =
     175**1.2.0**
    151176* Added search event tracking
    152177
    153 = 1.1.0 =
     178**1.1.0**
    154179* woocommerce tracking
    155180
    156 = 1.0.0 =
     181**1.0.0**
    157182* Initial release!
    158183
    159184## Upgrade Notice
    160185
    161 = 1.9.1 =
     186**1.9.2**
     187IMPORTANT SECURITY UPDATE: This version includes critical security enhancements including CSRF protection, enhanced access controls, and secure cookie handling. Update immediately for improved security and protection.
     188
     189**1.9.1**
    162190Bug Fix - fixed cookie set on cashed pages
    163191
    164 = 1.9.0 =
     192**1.9.0**
    165193Server side cookie tracking - user_id implementation
    166194
    167 = 1.8.2 =
     195**1.8.2**
    168196README.md updated
    169197
    170 = 1.8.1 =
     198**1.8.1**
    171199Javascript variable conflict on cookie update
    172200
    173 = 1.8.0 =
     201**1.8.0**
    174202Plugin name changed from Action Recorder -> Customerlabs CDP
    175203
    176 = 1.7.0 =
     204**1.7.0**
    177205Plugin tested upto latest version of WordPress-6.1.1
    178206
    179 = 1.6.0 =
     207**1.6.0**
    180208Handled duplicate purchase event triggers
    181209
    182 = 1.5.0 =
     210**1.5.0**
    183211Cookies values contains plus instead of space issue fixed
    184212
    185 = 1.4.0 =
     213**1.4.0**
    186214Handling ajax triggers from frontend for add_to_cart and remove_from_cart
    187215
    188 = 1.3.1 =
     216**1.3.1**
    189217Removed user traits from "User Signed Up" and "User Logged In" events
    190218
    191 = 1.3.0 =
     219**1.3.0**
    192220Fixed multiple ajax events
    193221Fixed multiple events tracking on page load
    194222
    195 = 1.2.1 =
     223**1.2.1**
    196224Bug Fix settings update issue
    197225
    198 = 1.2.0 =
     226**1.2.0**
    199227Added search event tracking
    200 
    201 = 1.1.0 =
    202 Supports woocommerce integration
    203 
    204 = 1.0 =
    205 Just released into the wild.

  • customerlabs-actionrecorder/trunk/Readme.txt

    r3141407 r3309746  
    33Tags: WooCommerce Conversion Tracking, WooCommerce Conversion Tracking Google Ads, WooCommerce Conversion Tracking GA4, WooCommerce Meta Ads Conversions API, WooCommerce event tracking, WooCommerce track events
    44Requires at least: 5.0
    5 Tested up to: 6.6.1
    6 Stable tag: 1.9.1
     5Tested up to: 6.8.1
     6Stable tag: 1.9.2
    77Requires PHP: 7.0
    88License: GPLv2
    … …  
    1414
    1515CustomerLabs plugin is one of the best WooCommerce plugins to track conversion events on your WooCommerce store, and send it to Ad platforms seamlessly. This plugin goes beyond conversion tracking and establishes a robust connection of your WooCommerce store with ad platforms.
     16
     17🔒 **Enhanced Security**: Version 1.9.2 includes comprehensive security improvements with CSRF protection, enhanced access controls, and secure cookie handling to ensure your data is protected.
    1618
    1719### With the automatic event tracking for your WooCommerce store by [CustomerLabs](https://customerlabs.com/), you can track
    … …  
    4244* Connect WhatsApp
    4345* Sync the data with BigQuery for detailed analysis of your data, creating custom reports and more
     46* **Enhanced security features** with CSRF protection and secure cookie handling
    4447
    4548
    … …  
    5659* Helps activate anonymous website visitors
    5760* ROI positive implementation
     61* **Secure and compliant** with WordPress security best practices
    5862
    5963
    … …  
    8589WooCommerce conversion tracking in GA4 is essential for marketers, and CustomerLabs offers GA4 integration for your store through Google Measurement Protocol (GMP) sending all the data on the server-side with just a few clicks.
    8690
     91= Is the plugin secure? =
     92Yes, version 1.9.2 includes comprehensive security enhancements including CSRF protection, secure cookie handling, enhanced access controls, and follows WordPress security best practices to protect your data.
     93
    8794= Why is CustomerLabs the best plugin for WooCommerce stores? =
    8895CustomerLabs plugin offers one-stop solution for tracking all conversions including custom conversions for your WooCommerce stores and send the conversion tracking data across to any platform such as GA4, Google Ads, Meta Ads, LinkedIn Ads, and more, with just a few clicks! It offers consent mode v2 for Google Ads, and a centralized consent triggers for all marketing platforms from a single space. It goes beyond conversion tracking and offers synthetic event optimization. To know more, reach out to our experts and get a free 1PD OPs consultation [here](http://customerlabs.com/request-a-demo/)
    … …  
    94101
    95102== Changelog ==
     103
     104= 1.9.2 =
     105* Security Enhancement - Implemented comprehensive security improvements
     106* Security Enhancement - Added CSRF protection with nonce verification
     107* Security Enhancement - Enhanced access controls and input validation
     108* Security Enhancement - Improved cookie security with proper flags
     109* Security Enhancement - Removed debug code to prevent information disclosure
     110* Security Enhancement - Follows WordPress security best practices
     111* Bug Fix - Improved error handling and sanitization
    96112
    97113= 1.9.1 =
    … …  
    143159== Upgrade Notice ==
    144160
     161= 1.9.2 =
     162IMPORTANT SECURITY UPDATE: This version includes critical security enhancements including CSRF protection, enhanced access controls, and secure cookie handling. Update immediately for improved security and protection.
     163
    145164= 1.9.1 =
    146165Bug Fix - fixed cookie set on cashed pages

  • customerlabs-actionrecorder/trunk/class.cltracker-cookie.php

    r3141407 r3309746  
    1515     * @param string $key Name of the cookie
    1616     * @param string $value Value of the cookie
     17     * @param bool $httponly Whether cookie should be httponly (default false for tracking cookies)
    1718     *
    1819     * @since 1.0.0
    1920     *
    2021     */
    21     public static function set_cookie( $key, $value ) {
    22         @ setrawcookie( 'cltracker_' . $key . '_' . COOKIEHASH, rawurlencode($value), time() + DAY_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN );
     22    public static function set_cookie( $key, $value, $httponly = false ) {
     23        // Set secure cookie with appropriate flags
     24        $secure = is_ssl();
     25        // Most tracking cookies need JavaScript access, so httponly is optional
     26        @ setrawcookie( 'cltracker_' . $key . '_' . COOKIEHASH, rawurlencode($value), time() + DAY_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN, $secure, $httponly );
    2327        $_COOKIE[ 'cltracker_' . $key . '_' . COOKIEHASH ] = $value;
    2428    }
    … …  
    6468        }
    6569       
    66         print_r($set);
     70        // Removed debug print_r that was leaking information
    6771       
    6872        if (!$set) {
    … …  
    8387    public static function unset_cookie( $key = '' ) {
    8488
     89        // Verify nonce for CSRF protection
     90        if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cltracker_nonce')) {
     91            wp_send_json_error('Security check failed');
     92            wp_die();
     93        }
     94       
    8595        if ( isset( $_POST['key'] ) ) {
    8696            $key = sanitize_text_field( $_POST['key'] );
    8797        }
    8898
    89         @ setcookie( 'cltracker_' . $key . '_' . COOKIEHASH, '', time() - DAY_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN );
     99        // Enhanced key validation
     100        if (empty($key) || !preg_match('/^[a-zA-Z0-9_]+$/', $key)) {
     101            wp_send_json_error('Invalid key format');
     102            wp_die();
     103        }
     104
     105        // Set secure cookie deletion - no httponly needed for deletion
     106        $secure = is_ssl();
     107        @ setcookie( 'cltracker_' . $key . '_' . COOKIEHASH, '', time() - DAY_IN_SECONDS, COOKIEPATH, COOKIE_DOMAIN, $secure, false );
    90108        unset( $_COOKIE[ 'cltracker_' . $key . '_' . COOKIEHASH ] );
    91109
    92         wp_send_json_success( $key );
     110        wp_send_json_success( 'Cookie cleared successfully' );
     111        wp_die();
    93112    }
    94113
    … …  
    99118     */
    100119    public static function set_unique_user_id_cookie() {
     120        // Verify nonce for CSRF protection
     121        if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'cltracker_nonce')) {
     122            wp_send_json_error('Security check failed');
     123            wp_die();
     124        }
     125       
    101126        $settings = CLTracker_Wordpress::get_instance()->get_settings();
    102         $app_id = $settings['app_id'];
     127        $app_id = sanitize_text_field($settings['app_id']);
     128       
     129        if (empty($app_id)) {
     130            wp_send_json_error('Invalid app ID');
     131            wp_die();
     132        }
     133       
    103134        $cookie_name = $app_id . "_uid";
    104135       
    105136        if ( isset( $_COOKIE[$cookie_name] ) ) {
    106             @ setrawcookie( $cookie_name , $_COOKIE[$cookie_name],["expires" => time() + YEAR_IN_SECONDS, "path" => COOKIEPATH, "domain" =>  ("." . COOKIE_DOMAIN),"samesite" => "Lax"] );
     137            $secure = is_ssl();
     138            // User ID cookie can be httponly since it's mainly for server-side identification
     139            @ setrawcookie( $cookie_name , $_COOKIE[$cookie_name], [
     140                "expires" => time() + YEAR_IN_SECONDS,
     141                "path" => COOKIEPATH,
     142                "domain" => ("." . COOKIE_DOMAIN),
     143                "samesite" => "Lax",
     144                "secure" => $secure,
     145            ] );
    107146        }
     147       
     148        wp_send_json_success('Cookie set successfully');
     149        wp_die();
     150    }
     151
     152    /**
     153     * Generate nonce for AJAX calls
     154     *
     155     * @since 1.9.2
     156     */
     157    public static function get_nonce() {
     158        return wp_create_nonce('cltracker_nonce');
    108159    }
    109160
    110161}
    111162
    112 add_action( 'wp_ajax_cltracker_unset_cookie'        , array( 'CLTracker_Cookie', 'unset_cookie' ) );
    113 add_action( 'wp_ajax_nopriv_cltracker_unset_cookie' , array( 'CLTracker_Cookie', 'unset_cookie' ) );
    114 add_action( 'wp_ajax_cltracker_set1pd_cookie'       , array( 'CLTracker_Cookie', 'set_unique_user_id_cookie' ) );
     163// Register AJAX actions for both authenticated and non-authenticated users
     164// This is necessary for tracking functionality to work for all website visitors
     165add_action( 'wp_ajax_cltracker_unset_cookie', array( 'CLTracker_Cookie', 'unset_cookie' ) );
     166add_action( 'wp_ajax_nopriv_cltracker_unset_cookie', array( 'CLTracker_Cookie', 'unset_cookie' ) );
     167add_action( 'wp_ajax_cltracker_set1pd_cookie', array( 'CLTracker_Cookie', 'set_unique_user_id_cookie' ) );
    115168add_action( 'wp_ajax_nopriv_cltracker_set1pd_cookie', array( 'CLTracker_Cookie', 'set_unique_user_id_cookie' ) );

  • customerlabs-actionrecorder/trunk/integrations/ecommerce/woocommerce.php

    r2728289 r3309746  
    2727        add_action( 'woocommerce_add_to_cart'                   , array( $this, 'add_to_cart' )     , 10, 3 );
    2828        add_action( 'woocommerce_remove_cart_item', array( $this, 'remove_from_cart' ), 10, 1);
     29       
    2930    }
    3031
    … …  
    144145        $image_url = wp_get_attachment_image_url( $image_id, 'full' );
    145146
    146         CLTracker_Cookie::set_cookie( 'added_to_cart' . '_' . $id, json_encode(
    147             array(
    148                 'event'      => __( 'Added to cart', 'cltracker' ),
    149                 'attributes' => array(
    150                     "customProperties" => array(
    151                         "currency" => get_woocommerce_currency(),
    152                         "content_type" => "product_group"
    153                     ),
    154                     "productProperties" => array(
    155                         array(
    156                             'product_id'       => $id,
    157                             'product_quantity' => $quantity,
    158                             'product_name'     => $product->get_name(),
    159                             'product_price'    => $product->get_price(),
    160                             'product_image'    => $image_url,
    161                             'product_sku'      => $product->get_sku(),
    162                             'product_category' => implode( ', ', wp_list_pluck( wc_get_product_terms( $product->get_id(), 'product_cat' ), 'name' ) ),
    163                         )
     147        // Instead of setting cookie, output JavaScript
     148        $data = array(
     149            'event'      => __( 'Added to cart', 'cltracker' ),
     150            'attributes' => array(
     151                "customProperties" => array(
     152                    "currency" => get_woocommerce_currency(),
     153                    "content_type" => "product_group"
     154                ),
     155                "productProperties" => array(
     156                    array(
     157                        'product_id'       => $id,
     158                        'product_quantity' => $quantity,
     159                        'product_name'     => $product->get_name(),
     160                        'product_price'    => $product->get_price(),
     161                        'product_image'    => $image_url,
     162                        'product_sku'      => $product->get_sku(),
     163                        'product_category' => implode( ', ', wp_list_pluck( wc_get_product_terms( $product->get_id(), 'product_cat' ), 'name' ) ),
    164164                    )
    165                 ),
    166                 'cached_event' => 'added_to_cart_' . $id
    167             )
    168         ));
     165                )
     166            ),
     167            'cached_event' => 'added_to_cart_' . $id
     168        );
     169
     170        // Add inline script to store data in localStorage
     171        // wp_add_inline_script('jquery', '
     172        //  localStorage.setItem("added_to_cart_' . $id . '", ' . json_encode(json_encode($data)) . ');
     173        // ');
     174        CLTracker_Cookie::set_cookie( 'added_to_cart' . '_' . $id, json_encode( $data ) );
    169175
    170176    }
    … …  
    215221                    )
    216222                ),
    217                 'cached_event' => 'removed_from_cart_' . $id
     223                'cached_event' => 'removed_from_cart_' . $cart_item['product_id']
    218224            )
    219225        ));

  • customerlabs-actionrecorder/trunk/templates/track.php

    r2862092 r3309746  
    22window.clWordpressTrack = function(){
    33    var _clsettings = <?php echo json_encode( CLTracker_WordPress::esc_js_deep( $settings ) ); ?>;
     4    var _clnonce = "<?php echo wp_create_nonce('cltracker_nonce'); ?>";
    45    var _clSendEvent = function(woo_event_name, woo_attributes){
    56        if(woo_event_name == "Purchased"){
    … …  
    3435                            action : 'cltracker_unset_cookie',
    3536                            key    : '<?php echo esc_js( $cached_event ); ?>',
     37                            nonce  : _clnonce
    3638
    3739                        },
    … …  
    7375                formData.append("action", "cltracker_unset_cookie");
    7476                formData.append("key", value["cached_event"]);
     77                formData.append("nonce", _clnonce);
    7578                _clSendEvent(value["event"], value["attributes"]);
    7679               
Note: See TracChangeset for help on using the changeset viewer.