Changeset 3776328

Timestamp:

10/31/2026 04:23:27 AM (14 hours ago)

Author:

mxp

Message:

Fix Unicode login logo URLs

Location:

mxp-dev-tools

Files:

• tests/login-logo-regression.sh (added)
• trunk/mxp-snippets.php (modified) (3 diffs)
• trunk/readme.txt (modified) (4 diffs)

mxp-dev-tools/trunk/mxp-snippets.php

@@ -322 +322 @@
         private $honeypot;
         private $honeypot_integrations = array();
+        private $login_logo_url = '';
 
         public function __construct() {
@@ -488 +489 @@
                         add_filter('login_redirect', array($this, 'login_redirect'), 11, 3);
                 }
-                if (!empty(MDT_LOGINPAGE_LOGO_URL) && filter_var(MDT_LOGINPAGE_LOGO_URL, FILTER_VALIDATE_URL)) {
+                $this->login_logo_url = $this->normalize_login_logo_url(MDT_LOGINPAGE_LOGO_URL);
+                if ($this->login_logo_url !== '') {
                         add_action('login_enqueue_scripts', array($this, 'login_css_enqueues'));
                 }
@@ -1682 +1684 @@
 
         public function login_css_enqueues() {
-                echo '<style type="text/css">' . $this->admin_login_page_css(MDT_LOGINPAGE_LOGO_URL) . '</style>';
-
+                $css = $this->build_admin_login_page_css($this->login_logo_url);
+                if ($css !== '') {
+                        echo '<style type="text/css">' . $css . '</style>';
+                }
         }
 
         public function admin_login_page_css($image) {
-                $headers = !empty($image) && ini_get('allow_url_fopen') ? @get_headers($image) : '';
-                if (!empty($image) && $headers && (strpos($headers[0], '404') === false) && (strpos($headers[0],
-                        '403') === false) && ini_get('allow_url_fopen')) {
-                        $img_id = attachment_url_to_postid($image);
-                        if ($img_id) {
-                                // First we check if the image has been uploaded on WordPress
-                                $img_meta = wp_get_attachment_metadata($img_id);
-                                if (isset($img_meta['width']) && isset($img_meta['height'])) {
-                                        $dimensions = array(
-                                                $img_meta['width'],
-                                                $img_meta['height'],
-                                        );
-                                } else {
-                                        $dimensions = array(
-                                                '',
-                                                '',
-                                        );
-                                }
-                        } else {
-                                // If not (could be an external URL)
-                                $dimensions = getimagesize($image);
-                        }
-                } else {
-                        $dimensions = array(
-                                '',
-                                '',
-                        );
-                }
-                list($width, $height) = $dimensions; // Get the uploaded image's width and height
-                if ($width != '' && $height != '' && $width < 321) {
-                        // If width is recognized, use it
-                        $w = $width . 'px auto';
-                        $h = 'height: ' . $height . 'px;';
-                } elseif ($width > 320) {
-                        // but if it's more than 320 pixels, force it to 320px
-                        $r = ($width / $height); // calculate ratio
-                        $w = '320px auto';
-                        $h = 'height: ' . (320 / $r) . 'px;';
-                } else {
-                        $w = 'auto 80px';
-                        $h = '';
-                }
-                $output = 'body.login div#login h1 a {
-                background-image: url(' . $image . ');
-                background-size: ' . $w . ';'
-                        . $h .
-                        'width: 100%;
-                background-position: bottom;
-            }';
+                $image = $this->normalize_login_logo_url($image);
+                return $image === '' ? '' : $this->build_admin_login_page_css($image);
+        }
+
+        private function normalize_login_logo_url($url) {
+                if (!is_string($url)) {
+                        return '';
+                }
+
+                $url = trim(wp_check_invalid_utf8($url));
+                if ($url === '' || preg_match('/[\x00-\x1F\x7F]/', $url)) {
+                        return '';
+                }
+
+                $parts = wp_parse_url($url);
+                if (!is_array($parts) || empty($parts['scheme']) || empty($parts['host']) || isset($parts['user']) || isset($parts['pass'])) {
+                        return '';
+                }
+
+                $scheme = strtolower($parts['scheme']);
+                if (!in_array($scheme, array('http', 'https'), true)) {
+                        return '';
+                }
+
+                $host = $this->normalize_login_logo_host($parts['host']);
+                if ($host === '') {
+                        return '';
+                }
+
+                $port = '';
+                if (isset($parts['port'])) {
+                        $port_number = (int) $parts['port'];
+                        if ($port_number < 1 || $port_number > 65535) {
+                                return '';
+                        }
+                        $port = ':' . $port_number;
+                }
+
+                $path = isset($parts['path']) ? $this->encode_login_logo_uri_component($parts['path'], false) : '';
+                $query = isset($parts['query']) ? '?' . $this->encode_login_logo_uri_component($parts['query'], true) : '';
+                $fragment = isset($parts['fragment']) ? '#' . $this->encode_login_logo_uri_component($parts['fragment'], true) : '';
+                $normalized = $scheme . '://' . $host . $port . $path . $query . $fragment;
+                $normalized = esc_url_raw($normalized, array('http', 'https'));
+
+                return filter_var($normalized, FILTER_VALIDATE_URL) !== false ? $normalized : '';
+        }
+
+        private function normalize_login_logo_host($host) {
+                $host = trim((string) $host);
+                if ($host === '') {
+                        return '';
+                }
+
+                $has_brackets = $host[0] === '[' && substr($host, -1) === ']';
+                $unbracketed_host = $has_brackets ? substr($host, 1, -1) : $host;
+                if (filter_var($unbracketed_host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
+                        return '[' . strtolower($unbracketed_host) . ']';
+                }
+                if ($has_brackets || strpos($host, '[') !== false || strpos($host, ']') !== false) {
+                        return '';
+                }
+                if (filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+                        return $host;
+                }
+
+                $normalizer = new \MxpDevTools\DomainExpiry\DomainNormalizer();
+                $host = $normalizer->to_ascii($host);
+                if ($host === '') {
+                        return '';
+                }
+                if ($host !== 'localhost' && !$normalizer->is_valid_ascii_domain($host)) {
+                        return '';
+                }
+
+                return $host;
+        }
+
+        private function encode_login_logo_uri_component($value, $allow_question_mark) {
+                $allowed = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~!$&\'()*+,;=:@/';
+                if ($allow_question_mark) {
+                        $allowed .= '?';
+                }
+
+                $hex = '0123456789ABCDEF';
+                $output = '';
+                $length = strlen($value);
+                for ($i = 0; $i < $length; $i++) {
+                        $character = $value[$i];
+                        if ($character === '%' && $i + 2 < $length && ctype_xdigit($value[$i + 1]) && ctype_xdigit($value[$i + 2])) {
+                                $output .= $character . $value[++$i] . $value[++$i];
+                                continue;
+                        }
+                        if (ord($character) < 128 && strpos($allowed, $character) !== false) {
+                                $output .= $character;
+                                continue;
+                        }
+
+                        $byte = ord($character);
+                        $output .= '%' . $hex[$byte >> 4] . $hex[$byte & 15];
+                }
 
                 return $output;
+        }
+
+        private function build_admin_login_page_css($image) {
+                if ($image === '') {
+                        return '';
+                }
+
+                $width = 0;
+                $height = 0;
+                $attachment_url = preg_replace('/[?#].*$/', '', $image);
+                $img_id = attachment_url_to_postid($attachment_url);
+                if ($img_id) {
+                        $img_meta = wp_get_attachment_metadata($img_id);
+                        if (is_array($img_meta) && isset($img_meta['width'], $img_meta['height'])) {
+                                $width = absint($img_meta['width']);
+                                $height = absint($img_meta['height']);
+                        }
+                }
+
+                $background_size = 'auto 80px';
+                $height_rule = '';
+                if ($width > 0 && $height > 0) {
+                        $display_width = min($width, 320);
+                        $display_height = max(1, (int) round($height * ($display_width / $width)));
+                        $background_size = $display_width . 'px auto';
+                        $height_rule = "\n\theight: " . $display_height . 'px;';
+                }
+
+                return 'body.login div#login h1 a {' .
+                        "\n\tbackground-image: url(\"" . $image . '");' .
+                        "\n\tbackground-size: " . $background_size . ';' .
+                        $height_rule .
+                        "\n\twidth: 100%;" .
+                        "\n\tbackground-position: bottom;" .
+                        "\n}";
         }
 

mxp-dev-tools/trunk/readme.txt

@@ -52 +52 @@
 * 檔案修改保護：預設啟用 `DISALLOW_FILE_MODS` / `DISALLOW_FILE_EDIT`，並保護指定管理員不被一般後台列表、編輯、刪除或降權流程影響。
 * 登入與後台調整：登入頁 Logo、登入後導向、管理信箱同步、註冊開關、封鎖使用者登入、顯示內容/分類/使用者 ID、使用者註冊時間欄位、隱藏非管理員更新提示與 Customize 選單。
+* 登入頁 Logo：在 WordPress 載入前定義 `MDT_LOGINPAGE_LOGO_URL`；只接受不含帳密的 HTTP/HTTPS URL。中文網域、路徑、查詢與 fragment 會正規化為 Punycode／percent-encoding，既有 `%XX` 編碼不會重複處理。
 * 媒體與上傳政策：可停用縮圖產生、停用大圖縮放、上傳圖片大小限制、自動填入圖片標題/alt/content，並對特權管理員與一般使用者套用不同的檔案大小與 MIME 規則。
 * Bot/垃圾防護：WordPress 公開登入、註冊、忘記/重設密碼、多站註冊、留言與文章密碼表單使用 action-bound honeypot 與短效簽章 token；WooCommerce 與 Contact Form 7 則各自提供預設關閉的獨立整合開關。
@@ -176 +177 @@
 Most Snippets behavior is controlled with `MDT_*` constants defined before WordPress loads, usually in `wp-config.php`. Some behavior also has filters documented in the source.
 
+= How do I change the WordPress login Logo? =
+
+Define `MDT_LOGINPAGE_LOGO_URL` before WordPress loads, for example `define('MDT_LOGINPAGE_LOGO_URL', 'https://example.com/uploads/品牌標誌.png');`. Snippets accepts Unicode in the host, path, query, and fragment, then normalizes the URL before emitting login-page CSS. Only HTTP/HTTPS URLs without embedded credentials are accepted. WordPress media attachments use their stored dimensions; external images use the safe default Logo size and are fetched by the browser rather than by the WordPress server.
+
 = Will observed HTTP_HOST domains be shown on the domain expiry dashboard? =
 
@@ -225 +230 @@
 
 = 3.6.12 =
-Snippets honeypot 完整保護 WordPress 公開內建表單，新增具抗快取 token 的 Contact Form 7 與 WooCommerce 獨立選用整合；表單 adapter 已透過註冊契約、registry 與共用留言路由解耦，並完成 WordPress 5.5／PHP 7.4 相容驗證。
+Snippets honeypot 完整保護 WordPress 公開內建表單，新增具抗快取 token 的 Contact Form 7 與 WooCommerce 獨立選用整合；登入頁 Logo URL 同步支援中文網域與路徑並限制為安全的 HTTP/HTTPS 輸出；全版完成 WordPress 5.5／PHP 7.4 相容驗證。
 
 = 3.6.11 =
@@ -269 +274 @@
 
 * Snippets honeypot 驗證會拒絕陣列等非字串 token 與留言文章 ID，避免畸形 POST 在 PHP 8 觸發 `explode()` TypeError 與 HTTP 500。
+* 登入頁 `MDT_LOGINPAGE_LOGO_URL` 支援中文網域、路徑、query 與 fragment，自動產生 Punycode／percent-encoding 且保留既有 `%XX`；限制 http/https、拒絕內嵌帳密、以帶引號的 CSS URL 輸出，並移除登入請求中的 server-side 外部圖片探測。
 * Snippets honeypot 重構為可註冊 action/context 的核心與表單 adapter：受保護的 WordPress 公開內建表單現在強制要求有效短效簽章 token 與空白動態誘餌欄位，補齊忘記/重設密碼、多站註冊及文章密碼流程；快取頁面會從 `no-store` 端點刷新 token，並保留 WooCommerce Classic 帳號表單保護。
 * Honeypot integrations 改由統一 contract 與 registry 註冊；共用留言 router 依優先序隔離 WordPress 留言與 WooCommerce 商品評論，即使個別 integration 關閉也不會被通用規則誤接管，後續新增表單 adapter 不必修改既有 adapter。