Changeset 3743356

Timestamp:

10/13/2026 09:15:26 AM (11 days ago)

Author:

surf7net

Message:

Release 1.64.3

Location:

surf7-simple-catalog/trunk

Files:

• readme.txt (modified) (3 diffs)
• simple-catalog.php (modified) (2 diffs)
• src/Frontend/Assets.php (modified) (2 diffs)
• src/Meta/MetaRegistry.php (modified) (3 diffs)

surf7-simple-catalog/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 8.1
-Stable tag: 1.64.2
+Stable tag: 1.64.3
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -127 +127 @@
 == Changelog ==
 
+= 1.64.3 =
+
+Security release. Updating is recommended.
+
+**Security**
+
+* When the email channel opens the enquiry form, the address enquiries are sent to and the Email Bcc address are no longer included in the product page's source.
+* A product's own enquiry contact details (set in its Enquiry Settings box) are no longer included in the post meta returned by WordPress's REST API for products. People who can edit the product still see them in the editor.
+
+Contact details that the page already shows on its enquiry buttons are unchanged. No database changes.
+
 = 1.64.2 =
 
@@ -249 +260 @@
 == Upgrade Notice ==
 
+= 1.64.3 =
+Security release: keeps the enquiry form's recipient and Bcc addresses, and per-product enquiry contact overrides, out of the page source and public API responses. No database changes.
+
 = 1.64.2 =
 Security release, recommended if you use Hide price or Price on request: those prices are now also kept out of public API responses, option selectors and price filtering. No database changes.

surf7-simple-catalog/trunk/simple-catalog.php

@@ -3 +3 @@
  * Plugin Name:       Surf7 Simple Catalog
  * Description:       A lightweight product catalog / showcase plugin. Visitors browse products and contact you via WhatsApp, email, phone, or enquiry form — no cart, no checkout.
- * Version:           1.64.2
+ * Version:           1.64.3
  * Requires at least: 6.4
  * Requires PHP:      8.1
@@ -18 +18 @@
 defined( 'ABSPATH' ) || exit;
 
-define( 'SCAT_VERSION', '1.64.2' );
+define( 'SCAT_VERSION', '1.64.3' );
 define( 'SCAT_DB_VERSION', '103' );
 define( 'SCAT_PLUGIN_FILE', __FILE__ );

surf7-simple-catalog/trunk/src/Frontend/Assets.php

@@ -127 +127 @@
                         'loadMoreNonce'   => wp_create_nonce( 'scat_load_more' ),
                         'productId'       => $post_id,
-                        'channels'        => $channels->get_enabled( $post_id ),
+                        'channels'        => self::script_channels( $channels->get_enabled( $post_id ) ),
                         'defaultTemplate' => $builder->default_whatsapp_template(),
                         // The resolved template per channel, plus the static placeholder
@@ -327 +327 @@
                 return $tag;
         }
+
+        /**
+         * Channel configs as the front-end script receives them.
+         *
+         * In form mode the email channel's addresses never appear on the page: the
+         * button opens the inline form and the server mails the enquiry. They were
+         * still passed to the script with the rest of the config, which put the
+         * form's recipient and its Bcc copy in every product page's source. The
+         * script reads only the message template from that entry, so the addresses
+         * go out blank, in the same keys.
+         *
+         * Mailto mode is unchanged: its link carries the address by design.
+         *
+         * @param array<string,array<string,mixed>> $channels Enabled channels from ChannelRegistry.
+         * @return array<string,array<string,mixed>>
+         */
+        public static function script_channels( array $channels ): array {
+                if ( isset( $channels['email'] ) && 'form' === (string) ( $channels['email']['mode'] ?? 'form' ) ) {
+                        foreach ( [ 'to', 'bcc' ] as $key ) {
+                                if ( array_key_exists( $key, $channels['email'] ) ) {
+                                        $channels['email'][ $key ] = '';
+                                }
+                        }
+                }
+                return $channels;
+        }
 }

surf7-simple-catalog/trunk/src/Meta/MetaRegistry.php

@@ -51 +51 @@
                 add_filter( 'wp_save_post_revision_post_has_changed', [ self::class, 'revision_has_changed' ], 10, 3 );
                 add_action( 'wp_restore_post_revision', [ self::class, 'restore_revision_meta' ], 10, 2 );
-                add_filter( 'rest_prepare_' . ProductPostType::SLUG, [ self::class, 'hide_private_price_meta' ], 10, 2 );
+                add_filter( 'rest_prepare_' . ProductPostType::SLUG, [ self::class, 'hide_private_meta' ], 10, 2 );
         }
 
         /**
-         * Keep a hidden price out of the core posts endpoint's `meta` field.
-         *
-         * The price keys are registered with show_in_rest so the block editor can
-         * read and write them, and core exposes registered meta to every reader of
-         * a published post: auth_callback only governs writes. So the stored figure
-         * was readable whatever the product's price mode.
+         * Keep private product meta out of the core posts endpoint's `meta` field.
+         *
+         * Every key in Schema is registered with show_in_rest so the block editor
+         * can read and write it, and core serves registered meta to every reader of
+         * a published post: auth_callback only governs writes. Two kinds of value
+         * were readable that should not be:
+         *
+         * - a price whose mode is not "show" (the figures, and option prices);
+         * - the per-product enquiry override, whose `email_to` is the form's
+         *   recipient and is printed nowhere when the email channel is in form
+         *   mode. Its other fields are public only while their channel is enabled.
+         *   Schema has always declared this key `'auth' => 'edit_posts'`, which
+         *   was the intent, but that too only governs writes.
          *
          * Done here rather than with a prepare_callback in show_in_rest, because
          * core calls that with the value and the request but not the post, and
-         * the mode is per product.
-         *
-         * Values are blanked, not removed, so the response keeps its shape. An
-         * empty string is each key's registered default, i.e. what an unpriced
-         * product already returns.
+         * both decisions are per product.
+         *
+         * Values are blanked, not removed, so the response keeps its shape: each
+         * blank is what a product without that meta already returns.
          *
          * @param \WP_REST_Response $response Prepared response.
@@ -74 +80 @@
          * @return \WP_REST_Response
          */
-        public static function hide_private_price_meta( $response, $post ) {
+        public static function hide_private_meta( $response, $post ) {
                 if ( ! $response instanceof \WP_REST_Response || ! $post instanceof \WP_Post ) {
                         return $response;
                 }
-                if ( PriceVisibility::current_user_can_see( $post->ID ) ) {
+                if ( current_user_can( 'edit_scat_product', $post->ID ) ) {
                         return $response;
                 }
@@ -87 +93 @@
                 }
 
-                foreach ( [ '_scat_price', '_scat_price_min', '_scat_price_max' ] as $key ) {
-                        if ( array_key_exists( $key, $data['meta'] ) ) {
-                                $data['meta'][ $key ] = '';
-                        }
-                }
-                // Core returns `_scat_options` as null today: its schema declares objects
-                // with no properties, and additionalProperties defaults to false, so every
-                // stored value fails validation. Blanked anyway, so that giving the schema
-                // real properties cannot quietly expose option prices.
-                if ( isset( $data['meta']['_scat_options'] ) && is_array( $data['meta']['_scat_options'] ) ) {
-                        $data['meta']['_scat_options'] = PriceVisibility::strip_option_prices( $data['meta']['_scat_options'] );
+                if ( array_key_exists( '_scat_enquiry_override', $data['meta'] ) ) {
+                        $data['meta']['_scat_enquiry_override'] = [];
+                }
+
+                if ( ! PriceVisibility::is_public( $post->ID ) ) {
+                        foreach ( [ '_scat_price', '_scat_price_min', '_scat_price_max' ] as $key ) {
+                                if ( array_key_exists( $key, $data['meta'] ) ) {
+                                        $data['meta'][ $key ] = '';
+                                }
+                        }
+                        // Core returns `_scat_options` as null today: its schema declares objects
+                        // with no properties, and additionalProperties defaults to false, so every
+                        // stored value fails validation. Blanked anyway, so that giving the schema
+                        // real properties cannot quietly expose option prices.
+                        if ( isset( $data['meta']['_scat_options'] ) && is_array( $data['meta']['_scat_options'] ) ) {
+                                $data['meta']['_scat_options'] = PriceVisibility::strip_option_prices( $data['meta']['_scat_options'] );
+                        }
                 }