Changeset 3744966

Timestamp:

10/13/2026 10:04:52 PM (13 days ago)

Author:

firepixel

Message:

Release 1.2.2

Location:

firepixel-for-woocommerce/trunk

Files:

• firepixel-for-woocommerce.php (modified) (4 diffs)
• readme.txt (modified) (3 diffs)

firepixel-for-woocommerce/trunk/firepixel-for-woocommerce.php

@@ -4 +4 @@
  * Plugin URI: https://firepixel.io
  * Description: Boost ROAS by 50% with complete conversion tracking.
- * Version: 1.2.1
+ * Version: 1.2.2
  * Author: FirePixel
  * License: GPL v2 or later
@@ -20 +20 @@
 if (!defined('ABSPATH')) exit;
 
-define('FIREPIXEL_VERSION', '1.2.1');
+define('FIREPIXEL_VERSION', '1.2.2');
 
 require_once __DIR__ . '/includes/class-firepixel-identifiers.php';
@@ -225 +225 @@
         register_rest_route('firepixel/v1', '/ping', [
             'methods' => 'GET',
-            'callback' => function ($request) {
-                $key = $request->get_param('key');
-                if (!is_string($key)) {
-                    return new \WP_Error('forbidden', 'Forbidden', ['status' => 403]);
-                }
-                $key = rawurldecode($key);
-
-                $settings = self::get_settings();
-                $secret = (string) ($settings['secret'] ?? '');
-
-                if ($secret === '' || !hash_equals($secret, $key)) {
-                    return new \WP_Error('forbidden', 'Forbidden', ['status' => 403]);
-                }
-
-                if (empty($settings['access_token']) || empty($settings['kid'])) {
-                    return new \WP_Error('forbidden', 'Forbidden', ['status' => 403]);
-                }
-
-                return ['status' => 'ok'];
-            },
+            'callback' => [__CLASS__, 'ping_remotely'],
             'permission_callback' => '__return_true',
         ]);
@@ -261 +242 @@
             'permission_callback' => '__return_true',
         ]);
+    }
+
+    /**
+     * `GET /wp-json/firepixel/v1/ping`: the FirePixel server checks the store is connected and
+     * reachable. Authenticated with the shared secret; requires kid+access_token so it only
+     * passes post-connect.
+     *
+     * @param WP_REST_Request $request The ping request from the FirePixel server.
+     *
+     * @return array<string, string>|WP_Error
+     */
+    public static function ping_remotely($request) {
+        // DEV-22: the secret comes from the X-FirePixel-Key header first, so it stays out of the
+        // access logs a query string ends up in. The `?key=` fallback exists only so an API that
+        // predates the header keeps working; remove it once the API no longer sends `?key=`.
+        // A header that is present wins outright: a wrong header is not rescued by the query.
+        $key = is_object($request) && method_exists($request, 'get_header')
+            ? $request->get_header('x_firepixel_key')
+            : null;
+        if (!is_string($key) || $key === '') {
+            $key = $request->get_param('key');
+            if (!is_string($key)) {
+                return new \WP_Error('forbidden', 'Forbidden', ['status' => 403]);
+            }
+            $key = rawurldecode($key);
+        }
+
+        $settings = self::get_settings();
+        $secret = (string) ($settings['secret'] ?? '');
+
+        if ($secret === '' || !hash_equals($secret, $key)) {
+            return new \WP_Error('forbidden', 'Forbidden', ['status' => 403]);
+        }
+
+        if (empty($settings['access_token']) || empty($settings['kid'])) {
+            return new \WP_Error('forbidden', 'Forbidden', ['status' => 403]);
+        }
+
+        return ['status' => 'ok'];
     }
 

firepixel-for-woocommerce/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 1.2.1
+Stable tag: 1.2.2
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -135 +135 @@
 
 == Changelog ==
+
+= 1.2.2 =
+* FirePixel's connection check now passes your store's key in a request header instead of the URL, so the key no longer appears in server logs.
+* Various bug fixes and improvements.
 
 = 1.2.1 =
@@ -181 +185 @@
 == Upgrade Notice ==
 
+= 1.2.2 =
+Keeps your store's key out of server logs during FirePixel's connection check. Recommended for all stores.
+
 = 1.2.1 =
 Stops sending events for search engine crawlers, other bots, and non-page requests such as robots.txt, feeds and sitemaps.