| @@ -1271,10 +1271,14 @@ | ||
| 1271 | 1271 | |
| 1272 | 1272 | // Check for XSS codes in our shortcodes submitted |
| 1273 | 1273 | function pagelayer_xss_content($data){ |
| 1274 | 1274 | |
| 1275 | + // Keep a whitespace-preserved copy for the on* event-handler scan. | |
| 1276 | + $orig = $data; | |
| 1277 | + | |
| 1275 | 1278 | $data = pagelayer_optimized_decode_entities($data); |
| 1276 | 1279 | |
| 1280 | + // Collapse all whitespace for pattern matching | |
| 1277 | 1281 | $data = preg_split('/\s/', $data); |
| 1278 | 1282 | $data = implode('', $data); |
| 1279 | 1283 | //echo $data; |
| 1280 | 1284 | |
| @@ -1297,15 +1301,12 @@ | ||
| 1297 | 1301 | if(preg_match('/\<(iframe|frame|script|style|link|applet|embed|xml|svg|object|layer|ilayer|meta)/is', $data, $matches)){ |
| 1298 | 1302 | return $matches[1]; |
| 1299 | 1303 | } |
| 1300 | 1304 | |
| 1301 | - // These events not start with on | |
| 1302 | - $not_allowed = array('click', 'dblclick', 'mousedown', 'mousemove', 'mouseout', 'mouseover', 'mouseup', 'load', 'unload', 'change', 'submit', 'reset', 'select', 'blur', 'focus', 'keydown', 'keypress', 'keyup', 'afterprint', 'beforeprint', 'beforeunload', 'error', 'hashchange', 'message', 'offline', 'online', 'pagehide', 'pageshow', 'popstate', 'resize', 'storage', 'contextmenu', 'input', 'invalid', 'search', 'mousewheel', 'wheel', 'drag', 'dragend', 'dragenter', 'dragleave', 'dragover', 'dragstart', 'drop', 'scroll', 'copy', 'cut', 'paste', 'abort', 'canplay', 'canplaythrough', 'cuechange', 'durationchange', 'emptied', 'ended', 'loadeddata', 'loadedmetadata', 'loadstart', 'pause', 'play', 'playing', 'progress', 'ratechange', 'seeked', 'seeking', 'stalled', 'suspend', 'timeupdate', 'volumechange', 'waiting', 'toggle', 'animationstart', 'animationcancel', 'animationend', 'animationiteration', 'auxclick', 'beforeinput', 'beforematch', 'beforexrselect', 'compositionend', 'compositionstart', 'compositionupdate', 'contentvisibilityautostatechange', 'focusout', 'focusin', 'fullscreenchange', 'fullscreenerror', 'gotpointercapture', 'lostpointercapture', 'mouseenter', 'mouseleave', 'pointercancel', 'pointerdown', 'pointerenter', 'pointerleave', 'pointermove', 'pointerout', 'pointerover', 'pointerrawupdate', 'pointerup', 'scrollend', 'securitypolicyviolation', 'touchcancel', 'touchend', 'touchmove', 'touchstart', 'transitioncancel', 'transitionend', 'transitionrun', 'transitionstart', 'MozMousePixelScroll', 'DOMActivate', 'afterscriptexecute', 'beforescriptexecute', 'DOMMouseScroll', 'willreveal', 'gesturechange', 'gestureend', 'gesturestart', 'mouseforcechanged', 'mouseforcedown', 'mouseforceup', 'mouseforceup', 'beforetoggle', 'selectstart', 'selectionchange'); | |
| 1303 | - | |
| 1304 | - $not_allowed = implode('|', $not_allowed); | |
| 1305 | - | |
| 1306 | - if(preg_match('/(on|onwebkit)+('.($not_allowed).')=/is', $data, $matches)){ | |
| 1307 | - return $matches[1].$matches[2]; | |
| 1305 | + // Reject ANY on* event handler attribute. Per the HTML spec every attribute | |
| 1306 | + // name beginning with "on" (optionally followed by a letter and word chars) | |
| 1307 | + if(preg_match('/\bon(?:[a-z0-9-]*)?\s*=/i', $orig, $matches)){ | |
| 1308 | + return $matches[0]; | |
| 1308 | 1309 | } |
| 1309 | 1310 | |
| 1310 | 1311 | return; |
| 1311 | 1312 | |
| @@ -1357,8 +1358,29 @@ | ||
| 1357 | 1358 | |
| 1358 | 1359 | return $block; |
| 1359 | 1360 | } |
| 1360 | 1361 | |
| 1362 | +// Walk a parsed block tree and sanitize every Pagelayer block in it, at any depth | |
| 1363 | +function pagelayer_sanitize_block_tree($block){ | |
| 1364 | + | |
| 1365 | + $block_name = isset($block['blockName']) ? $block['blockName'] : ''; | |
| 1366 | + | |
| 1367 | + // Is pagelayer block ? pagelayer_sanitize_blocks_save_pre() walks the | |
| 1368 | + // whole subtree, so we are done for this branch | |
| 1369 | + if(is_string($block_name) && 0 === strpos($block_name, 'pagelayer/')){ | |
| 1370 | + return pagelayer_sanitize_blocks_save_pre($block); | |
| 1371 | + } | |
| 1372 | + | |
| 1373 | + // Any other block can still hold Pagelayer blocks inside it | |
| 1374 | + if(!empty($block['innerBlocks']) && is_array($block['innerBlocks'])){ | |
| 1375 | + foreach($block['innerBlocks'] as $k => $inner){ | |
| 1376 | + $block['innerBlocks'][$k] = pagelayer_sanitize_block_tree($inner); | |
| 1377 | + } | |
| 1378 | + } | |
| 1379 | + | |
| 1380 | + return $block; | |
| 1381 | +} | |
| 1382 | + | |
| 1361 | 1383 | // Check for XSS codes in our shortcode attributes |
| 1362 | 1384 | function pagelayer_sanitize_shortcode_atts($content){ |
| 1363 | 1385 | |
| 1364 | 1386 | // Do we have something suspicious ? |
| @@ -1411,9 +1433,11 @@ | ||
| 1411 | 1433 | |
| 1412 | 1434 | $new_shortcode = '[' . $shortcode_name . $atts . ']'; |
| 1413 | 1435 | |
| 1414 | 1436 | if(!empty($shortcode[5])){ |
| 1415 | - $new_shortcode .= $shortcode[5].'[/' . $shortcode_name .']'; | |
| 1437 | + // Recurse into the inner content so nested shortcodes | |
| 1438 | + $inner = pagelayer_sanitize_shortcode_atts($shortcode[5]); | |
| 1439 | + $new_shortcode .= $inner.'[/' . $shortcode_name .']'; | |
| 1416 | 1440 | } |
| 1417 | 1441 | |
| 1418 | 1442 | // Replace the original shortcode with sanitized attributes |
| 1419 | 1443 | $content = str_replace($shortcode[0], $new_shortcode, $content); |
| @@ -1419,8 +1443,342 @@ | ||
| 1419 | 1443 | $content = str_replace($shortcode[0], $new_shortcode, $content); |
| 1420 | 1444 | } |
| 1421 | 1445 | |
| 1422 | 1446 | return $content; |
| 1447 | +} | |
| 1448 | + | |
| 1449 | +// Scan post content for XSS payloads and return a structured report. | |
| 1450 | +function pagelayer_xss_scan_post($post_id = 0){ | |
| 1451 | + global $post; | |
| 1452 | + | |
| 1453 | + $report = ['found' => false, 'items' => []]; | |
| 1454 | + | |
| 1455 | + if(empty($post_id)){ | |
| 1456 | + if(!empty($post->ID)){ | |
| 1457 | + $post_id = $post->ID; | |
| 1458 | + }else{ | |
| 1459 | + return $report; | |
| 1460 | + } | |
| 1461 | + } | |
| 1462 | + | |
| 1463 | + $content = get_post_field('post_content', $post_id); | |
| 1464 | + if(empty($content)){ | |
| 1465 | + return $report; | |
| 1466 | + } | |
| 1467 | + | |
| 1468 | + // Scan the raw content (shortcodes are not yet expanded here, so we | |
| 1469 | + // catch on*= attributes inside [pl_* ele_attributes="onclick=..."]) | |
| 1470 | + $found = pagelayer_xss_content($content); | |
| 1471 | + if(strlen($found) > 0){ | |
| 1472 | + $report['found'] = true; | |
| 1473 | + $report['items'][] = $found; | |
| 1474 | + } | |
| 1475 | + | |
| 1476 | + return $report; | |
| 1477 | +} | |
| 1478 | + | |
| 1479 | +// Determine whether the XSS warning should be shown for the current post/user. | |
| 1480 | +function pagelayer_should_show_xss_warning($post_id = 0){ | |
| 1481 | + global $post; | |
| 1482 | + | |
| 1483 | + if(empty($post_id)){ | |
| 1484 | + if(!empty($post->ID)){ | |
| 1485 | + $post_id = $post->ID; | |
| 1486 | + }else{ | |
| 1487 | + return false; | |
| 1488 | + } | |
| 1489 | + } | |
| 1490 | + | |
| 1491 | + // Rule 5: user already acknowledged — don't block again | |
| 1492 | + $view_token = get_transient('pagelayer_xss_view_'.$post_id.'_'.get_current_user_id()); | |
| 1493 | + if(!empty($view_token) && isset($_GET['pl_xss_view']) && $_GET['pl_xss_view'] === $view_token){ | |
| 1494 | + return false; | |
| 1495 | + } | |
| 1496 | + | |
| 1497 | + // Rule 2: the post must contain XSS | |
| 1498 | + $scan = pagelayer_xss_scan_post($post_id); | |
| 1499 | + if(empty($scan['found'])){ | |
| 1500 | + return false; | |
| 1501 | + } | |
| 1502 | + | |
| 1503 | + // Rule 3: skip if the current user is the post author | |
| 1504 | + $author_id = (int) get_post_field('post_author', $post_id); | |
| 1505 | + $current_user_id = (int) get_current_user_id(); | |
| 1506 | + if($author_id > 0 && $author_id === $current_user_id){ | |
| 1507 | + return false; | |
| 1508 | + } | |
| 1509 | + | |
| 1510 | + // Rule 4: skip if the post author has the JS/unfiltered_html capability. | |
| 1511 | + // We check this by temporarily switching to the author's context. | |
| 1512 | + $author_can_js = false; | |
| 1513 | + if($author_id > 0){ | |
| 1514 | + $author_user = get_userdata($author_id); | |
| 1515 | + if(!empty($author_user)){ | |
| 1516 | + $author_can_js = user_can($author_user, 'unfiltered_html'); | |
| 1517 | + if(!$author_can_js){ | |
| 1518 | + $author_can_js = pagelayer_user_can_add_js_content_for_user($author_user); | |
| 1519 | + } | |
| 1520 | + } | |
| 1521 | + } | |
| 1522 | + if($author_can_js){ | |
| 1523 | + return false; | |
| 1524 | + } | |
| 1525 | + | |
| 1526 | + return true; | |
| 1527 | +} | |
| 1528 | + | |
| 1529 | +// Check if a specific user (not the current user) can add JS content. | |
| 1530 | +function pagelayer_user_can_add_js_content_for_user($user){ | |
| 1531 | + if(empty($user) || !($user instanceof WP_User)){ | |
| 1532 | + return false; | |
| 1533 | + } | |
| 1534 | + | |
| 1535 | + if(user_can($user, 'unfiltered_html')){ | |
| 1536 | + return true; | |
| 1537 | + } | |
| 1538 | + | |
| 1539 | + $pagelayer_js_permission = get_option('pagelayer_js_permission'); | |
| 1540 | + if(empty($pagelayer_js_permission) || empty($user->roles)){ | |
| 1541 | + return false; | |
| 1542 | + } | |
| 1543 | + | |
| 1544 | + foreach($user->roles as $role){ | |
| 1545 | + if(in_array($role, $pagelayer_js_permission)){ | |
| 1546 | + return true; | |
| 1547 | + } | |
| 1548 | + } | |
| 1549 | + | |
| 1550 | + return false; | |
| 1551 | +} | |
| 1552 | + | |
| 1553 | +// Render the XSS warning page that completely blocks content rendering. | |
| 1554 | +function pagelayer_render_xss_warning_block($context = 'frontend'){ | |
| 1555 | + global $post; | |
| 1556 | + | |
| 1557 | + if(empty($post->ID)){ | |
| 1558 | + return; | |
| 1559 | + } | |
| 1560 | + | |
| 1561 | + if(!pagelayer_should_show_xss_warning($post->ID)){ | |
| 1562 | + return; | |
| 1563 | + } | |
| 1564 | + | |
| 1565 | + // Re-scan to get the items for display | |
| 1566 | + $scan = pagelayer_xss_scan_post($post->ID); | |
| 1567 | + if(empty($scan['found'])){ | |
| 1568 | + return; | |
| 1569 | + } | |
| 1570 | + | |
| 1571 | + $items_html = ''; | |
| 1572 | + foreach($scan['items'] as $item){ | |
| 1573 | + $items_html .= '<div class="pagelayer-xss-item">'.htmlspecialchars($item, ENT_QUOTES, 'UTF-8').'</div>'; | |
| 1574 | + } | |
| 1575 | + | |
| 1576 | + // Generate a one-time view token so the admin can explicitly consent | |
| 1577 | + $view_token = wp_generate_password(32, false); | |
| 1578 | + set_transient('pagelayer_xss_view_'.$post->ID.'_'.get_current_user_id(), $view_token, 3600); | |
| 1579 | + | |
| 1580 | + // Build the "view page" URL with the consent token | |
| 1581 | + $current_url = $_SERVER['REQUEST_URI'] ?? '/'; | |
| 1582 | + $separator = strpos($current_url, '?') !== false ? '&' : '?'; | |
| 1583 | + $view_url = htmlspecialchars($current_url.$separator.'pl_xss_view='.$view_token, ENT_QUOTES, 'UTF-8'); | |
| 1584 | + | |
| 1585 | + // Build the edit link | |
| 1586 | + $edit_link = pagelayer_livelink($post->ID); | |
| 1587 | + $edit_link = htmlspecialchars($edit_link.$separator.'pl_xss_view='.$view_token, ENT_QUOTES, 'UTF-8'); | |
| 1588 | + | |
| 1589 | + // Get author info for the warning message | |
| 1590 | + $author_id = (int) get_post_field('post_author', $post->ID); | |
| 1591 | + $author_name = ''; | |
| 1592 | + if($author_id > 0){ | |
| 1593 | + $author_data = get_userdata($author_id); | |
| 1594 | + if(!empty($author_data)){ | |
| 1595 | + $author_name = $author_data->display_name; | |
| 1596 | + } | |
| 1597 | + } | |
| 1598 | + | |
| 1599 | + $warning_title = __pl('xss_warning_title'); | |
| 1600 | + $warning_body = $author_name | |
| 1601 | + ? sprintf(__pl('xss_warning_body_author'), htmlspecialchars($author_name, ENT_QUOTES, 'UTF-8')) | |
| 1602 | + : __pl('xss_warning_body'); | |
| 1603 | + $warning_items_label = __pl('xss_warning_items'); | |
| 1604 | + $view_btn = __pl('xss_warning_view_page'); | |
| 1605 | + $edit_btn = __pl('xss_warning_edit_post'); | |
| 1606 | + $warning_blocked = __pl('xss_warning_blocked'); | |
| 1607 | + | |
| 1608 | + $dashboard_link = admin_url(); | |
| 1609 | + $go_dashboard = __pl('xss_warning_go_dashboard'); | |
| 1610 | + | |
| 1611 | + // Output the warning page and die() — the malicious post content is | |
| 1612 | + // NEVER sent to the browser, so inline <script>, <img onerror>, and | |
| 1613 | + // <iframe onload> payloads cannot execute. | |
| 1614 | + $status_code = ($context === 'editor') ? 200 : 403; | |
| 1615 | + if(!headers_sent()){ | |
| 1616 | + status_header($status_code); | |
| 1617 | + header('Content-Type: text/html; charset=utf-8'); | |
| 1618 | + } | |
| 1619 | + | |
| 1620 | + echo <<<HTML | |
| 1621 | +<!DOCTYPE html> | |
| 1622 | +<html lang="en"> | |
| 1623 | +<head> | |
| 1624 | +<meta charset="utf-8"> | |
| 1625 | +<meta name="viewport" content="width=device-width, initial-scale=1"> | |
| 1626 | +<title>{$warning_title}</title> | |
| 1627 | +<style> | |
| 1628 | +*{ margin:0; padding:0; box-sizing:border-box; } | |
| 1629 | +body{ | |
| 1630 | + background:#f0f0f1; | |
| 1631 | + font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif; | |
| 1632 | + display:flex; | |
| 1633 | + align-items:center; | |
| 1634 | + justify-content:center; | |
| 1635 | + min-height:100vh; | |
| 1636 | + padding:20px; | |
| 1637 | +} | |
| 1638 | +#pagelayer-xss-block-dialog{ | |
| 1639 | + background:#fff; | |
| 1640 | + border-radius:8px; | |
| 1641 | + max-width:640px; | |
| 1642 | + width:100%; | |
| 1643 | + max-height:90vh; | |
| 1644 | + overflow-y:auto; | |
| 1645 | + box-shadow:0 4px 24px rgba(0,0,0,0.15); | |
| 1646 | +} | |
| 1647 | +.pagelayer-xss-block-header{ | |
| 1648 | + background:#d63638; | |
| 1649 | + color:#fff; | |
| 1650 | + padding:20px 24px; | |
| 1651 | + border-radius:8px 8px 0 0; | |
| 1652 | + font-size:20px; | |
| 1653 | + font-weight:700; | |
| 1654 | + display:flex; | |
| 1655 | + align-items:center; | |
| 1656 | + gap:12px; | |
| 1657 | +} | |
| 1658 | +.pagelayer-xss-block-body{ | |
| 1659 | + padding:24px; | |
| 1660 | + color:#1d2327; | |
| 1661 | + font-size:14px; | |
| 1662 | + line-height:1.6; | |
| 1663 | +} | |
| 1664 | +.pagelayer-xss-block-body p{ | |
| 1665 | + margin:0 0 14px 0; | |
| 1666 | +} | |
| 1667 | +.pagelayer-xss-blocked-tag{ | |
| 1668 | + display:inline-block; | |
| 1669 | + background:#fff4f4; | |
| 1670 | + border:1px solid #d63638; | |
| 1671 | + color:#d63638; | |
| 1672 | + padding:3px 10px; | |
| 1673 | + border-radius:3px; | |
| 1674 | + font-size:12px; | |
| 1675 | + font-weight:600; | |
| 1676 | + margin-bottom:14px; | |
| 1677 | +} | |
| 1678 | +.pagelayer-xss-items{ | |
| 1679 | + background:#fff4f4; | |
| 1680 | + border:1px solid #d63638; | |
| 1681 | + border-radius:4px; | |
| 1682 | + padding:14px; | |
| 1683 | + margin:14px 0; | |
| 1684 | + max-height:220px; | |
| 1685 | + overflow-y:auto; | |
| 1686 | +} | |
| 1687 | +.pagelayer-xss-item{ | |
| 1688 | + font-family:monospace; | |
| 1689 | + font-size:12px; | |
| 1690 | + padding:6px 8px; | |
| 1691 | + border-bottom:1px solid #f5cccc; | |
| 1692 | + word-break:break-all; | |
| 1693 | + color:#b32d2e; | |
| 1694 | +} | |
| 1695 | +.pagelayer-xss-item:last-child{ | |
| 1696 | + border-bottom:none; | |
| 1697 | +} | |
| 1698 | +.pagelayer-xss-block-actions{ | |
| 1699 | + padding:18px 24px; | |
| 1700 | + border-top:1px solid #dcdcde; | |
| 1701 | + display:flex; | |
| 1702 | + gap:12px; | |
| 1703 | + flex-wrap:wrap; | |
| 1704 | + border-radius:0 0 8px 8px; | |
| 1705 | +} | |
| 1706 | +.pagelayer-xss-btn-view{ | |
| 1707 | + background:#2271b1; | |
| 1708 | + color:#fff; | |
| 1709 | + border:none; | |
| 1710 | + border-radius:4px; | |
| 1711 | + padding:10px 24px; | |
| 1712 | + font-size:14px; | |
| 1713 | + cursor:pointer; | |
| 1714 | + font-weight:600; | |
| 1715 | + text-decoration:none; | |
| 1716 | + display:inline-block; | |
| 1717 | +} | |
| 1718 | +.pagelayer-xss-btn-view:hover{ | |
| 1719 | + background:#135e96; | |
| 1720 | +} | |
| 1721 | +.pagelayer-xss-btn-edit{ | |
| 1722 | + background:#fff; | |
| 1723 | + color:#2271b1; | |
| 1724 | + border:1px solid #2271b1; | |
| 1725 | + border-radius:4px; | |
| 1726 | + padding:10px 24px; | |
| 1727 | + font-size:14px; | |
| 1728 | + cursor:pointer; | |
| 1729 | + font-weight:600; | |
| 1730 | + text-decoration:none; | |
| 1731 | + display:inline-block; | |
| 1732 | +} | |
| 1733 | +.pagelayer-xss-btn-edit:hover{ | |
| 1734 | + background:#f0f6fc; | |
| 1735 | +} | |
| 1736 | +.pagelayer-xss-btn-dashboard{ | |
| 1737 | + background:transparent; | |
| 1738 | + color:#646970; | |
| 1739 | + border:none; | |
| 1740 | + border-radius:4px; | |
| 1741 | + padding:10px 16px; | |
| 1742 | + font-size:13px; | |
| 1743 | + cursor:pointer; | |
| 1744 | + text-decoration:none; | |
| 1745 | + display:inline-block; | |
| 1746 | + margin-left:auto; | |
| 1747 | +} | |
| 1748 | +.pagelayer-xss-btn-dashboard:hover{ | |
| 1749 | + color:#1d2327; | |
| 1750 | +} | |
| 1751 | +</style> | |
| 1752 | +</head> | |
| 1753 | +<body> | |
| 1754 | + <div id="pagelayer-xss-block-dialog"> | |
| 1755 | + <div class="pagelayer-xss-block-header"> | |
| 1756 | + <span style="font-size:28px;">⚠</span> | |
| 1757 | + {$warning_title} | |
| 1758 | + </div> | |
| 1759 | + <div class="pagelayer-xss-block-body"> | |
| 1760 | + <span class="pagelayer-xss-blocked-tag">{$warning_blocked}</span> | |
| 1761 | + <p>{$warning_body}</p> | |
| 1762 | + <p style="font-weight:600; margin-bottom:6px;">{$warning_items_label}:</p> | |
| 1763 | + <div class="pagelayer-xss-items">{$items_html}</div> | |
| 1764 | + </div> | |
| 1765 | + <div class="pagelayer-xss-block-actions"> | |
| 1766 | + <a href="{$view_url}" class="pagelayer-xss-btn-view">{$view_btn}</a> | |
| 1767 | + <a href="{$edit_link}" class="pagelayer-xss-btn-edit">{$edit_btn}</a> | |
| 1768 | + <a href="{$dashboard_link}" class="pagelayer-xss-btn-dashboard">{$go_dashboard}</a> | |
| 1769 | + </div> | |
| 1770 | + </div> | |
| 1771 | +</body> | |
| 1772 | +</html> | |
| 1773 | +HTML; | |
| 1774 | + | |
| 1775 | + // CRITICAL: die() here ensures the malicious post content (the_content, | |
| 1776 | + // do_shortcode output, block rendering) is NEVER sent to the browser. | |
| 1777 | + // Without die(), WordPress would continue rendering the template and | |
| 1778 | + // output the post body — including any <script>/<img onerror>/<iframe | |
| 1779 | + // onload> payloads — which would execute even if hidden with CSS. | |
| 1780 | + die(); | |
| 1423 | 1781 | } |
| 1424 | 1782 | |
| 1425 | 1783 | function pagelayer_getting_started_notice(){ |
| 1426 | 1784 | |
