Changeset 3799773

Timestamp:

11/13/2026 06:38:04 AM (37 hours ago)

Author:

gatecraftjp

Message:

2026.1.3.12: security and reliability improvements

Location:

gatecraft

Files:

• tags/2026.1.3.12 (copied) (copied from gatecraft/trunk )
• tags/2026.1.3.12/gatecraft.php (modified) (2 diffs)
• tags/2026.1.3.12/includes/eventclone.php (modified) (1 diff)
• tags/2026.1.3.12/includes/eventpack.php (modified) (1 diff)
• tags/2026.1.3.12/includes/helpers.php (modified) (1 diff)
• tags/2026.1.3.12/includes/http/admin.php (modified) (1 diff)
• tags/2026.1.3.12/includes/http/public.php (modified) (1 diff)
• tags/2026.1.3.12/includes/orders.php (modified) (1 diff)
• tags/2026.1.3.12/includes/router.php (modified) (1 diff)
• tags/2026.1.3.12/includes/security.php (modified) (1 diff)
• tags/2026.1.3.12/languages/ja.php (modified) (1 diff)
• tags/2026.1.3.12/readme.txt (modified) (2 diffs)
• tags/2026.1.3.12/templates/admin/event_form.php (modified) (1 diff)
• trunk/gatecraft.php (modified) (2 diffs)
• trunk/includes/eventclone.php (modified) (1 diff)
• trunk/includes/eventpack.php (modified) (1 diff)
• trunk/includes/helpers.php (modified) (1 diff)
• trunk/includes/http/admin.php (modified) (1 diff)
• trunk/includes/http/public.php (modified) (1 diff)
• trunk/includes/orders.php (modified) (1 diff)
• trunk/includes/router.php (modified) (1 diff)
• trunk/includes/security.php (modified) (1 diff)
• trunk/languages/ja.php (modified) (1 diff)
• trunk/readme.txt (modified) (2 diffs)
• trunk/templates/admin/event_form.php (modified) (1 diff)

gatecraft/tags/2026.1.3.12/gatecraft.php

@@ -3 +3 @@
  * Plugin Name:       Gatecraft
  * Description:       Sell tickets for your own events: priced categories, card and offline payments, QR tickets by email, and a phone camera door scanner.
- * Version:           2026.1.3.11
+ * Version:           2026.1.3.12
  * Requires at least: 6.7
  * Requires PHP:      8.1
@@ -26 +26 @@
 }
 
-define('GATECRAFT_VERSION', '2026.1.3.11');
+define('GATECRAFT_VERSION', '2026.1.3.12');
 define('GATECRAFT_DB_VERSION', 18);
 define('GATECRAFT_FILE', __FILE__);

gatecraft/tags/2026.1.3.12/includes/eventclone.php

@@ -45 +45 @@
     $row['title'] = mb_substr((string)($o['title'] ?? $src['title']), 0, 190);
     $row['slug'] = eventpack_unique_slug((string)($o['slug'] ?? $src['slug']));
+    // A copy of an unlisted event gets its own private address part, never the original's.
+    if (($row['visibility'] ?? 'public') === 'unlisted') $row['slug'] = event_private_slug(event_slug_base(event_slug_base($row['slug'])));
     $row['status'] = in_array($o['status'] ?? 'draft', ['draft', 'published'], true) ? ($o['status'] ?? 'draft') : 'draft';
     $row['starts_at'] = ldate('Y-m-d H:i:s', lstrtotime((string)$o['starts_at']));

gatecraft/tags/2026.1.3.12/includes/eventpack.php

@@ -257 +257 @@
         if (isset($e['description'])) $e['description'] = rich_clean((string)$e['description']);
         $e['slug'] = eventpack_unique_slug((string)($e['slug'] ?? $e['title']));
+        if (($e['visibility'] ?? 'public') === 'unlisted') $e['slug'] = event_private_slug(event_slug_base($e['slug']));
         if ($e['slug'] !== ($pkg['event']['slug'] ?? '')) $notes[] = 'The page address was already in use, so this event is at "' . $e['slug'] . '".';
         $e['status'] = 'draft'; $e['venue_id'] = $venueId; $e['cover_image'] = eventpack_save_image($pkg, $e['cover_image'] ?? null);

gatecraft/tags/2026.1.3.12/includes/helpers.php

@@ -687 +687 @@
 }
 
+/**
+ * Unlisted events are reached only by their address, so the address must not be guessable from the title.
+ * event_private_slug() ends it with 12 random hex characters (48 bits); event_slug_base() removes that part again,
+ * so a copy of an unlisted event never carries the original's private part.
+ */
+function event_slug_base(string $slug): string
+{
+    return (string)preg_replace('/-[a-f0-9]{12}$/', '', $slug);
+}
+
+function event_private_slug(string $slug): string
+{
+    if (preg_match('/-[a-f0-9]{12}$/', $slug)) return $slug;
+    return rtrim(substr($slug, 0, 100), '-') . '-' . bin2hex(random_bytes(6));
+}
+
 /** Crockford base32 (no I, L, O, U): readable, unambiguous codes. */
 function random_code(int $len): string

gatecraft/tags/2026.1.3.12/includes/http/admin.php

@@ -227 +227 @@
     $title = str_in('title', 190, true, 'Title');
     $slug = slugify(str_in('slug', 120) ?: $title);
-    if (qv('SELECT 1 FROM {events} WHERE slug = ? AND id <> ?', [$slug, $id])) $slug = substr($slug, 0, 110) . '-' . strtolower(random_code(4));
+    // An unlisted event's address gets a private part, so it cannot be guessed from the title.
+    if (post('visibility') === 'unlisted') $slug = event_private_slug($slug);
+    if (qv('SELECT 1 FROM {events} WHERE slug = ? AND id <> ?', [$slug, $id])) $slug = post('visibility') === 'unlisted' ? event_private_slug(event_slug_base($slug)) : substr($slug, 0, 110) . '-' . strtolower(random_code(4));
     $start = dt_in(post('starts_at'));
     if (!$start) fail('Start date and time are required.');

gatecraft/tags/2026.1.3.12/includes/http/public.php

@@ -125 +125 @@
     $data = event_page_data($slug) ?? abort(404, 'This event could not be found.');
     language_context($data['ev']['language'] ?? null, true);
+    if (($data['ev']['visibility'] ?? 'public') === 'unlisted') {
+        // Unlisted: keep the page out of search engines, and do not pass its private address on to other sites.
+        header('X-Robots-Tag: noindex, nofollow');
+        header('Referrer-Policy: no-referrer');
+        add_filter('wp_robots', fn(array $r) => ['noindex' => true, 'nofollow' => true] + $r);
+        $data['noindex'] = true;
+    }
     render('public/event', $data);
 }

gatecraft/tags/2026.1.3.12/includes/orders.php

@@ -102 +102 @@
         if ($event['starts_at'] <= now()) fail('Ticket sales for this event have closed.');
 
-        // Limit open (unpaid or unapproved) orders per email, so one person cannot hold the whole event.
-        $open = (int)qv("SELECT COUNT(*) FROM {orders} WHERE event_id = ? AND buyer_email = ? AND status IN ('awaiting_approval','pending_payment') AND expires_at > ?", [$eventId, $buyer['email'], now()]);
+        // Limit open (unpaid or unapproved) orders per email, so one person cannot hold the whole event. Only bookings
+        // from this visitor count (same connection, or same signed-in account): bookings someone else made with this
+        // email cannot lock its owner out, and the message reveals nothing about bookings made elsewhere.
+        $open = (int)qv("SELECT COUNT(*) FROM {orders} WHERE event_id = ? AND buyer_email = ? AND status IN ('awaiting_approval','pending_payment') AND expires_at > ?
+                         AND (ip_hash = ? OR (user_id IS NOT NULL AND user_id = ?))", [$eventId, $buyer['email'], now(), $ipHash, (int)($user['id'] ?? 0)]);
         if ($open >= 2) fail('You already have open bookings for this event. Complete or cancel them first, or wait for them to expire.');
         // And per network address (hashed, never stored as an address), so changing the email does not let one person hold every seat.

gatecraft/tags/2026.1.3.12/includes/router.php

@@ -48 +48 @@
         // 2. Routes limited to staff check the capability with current_user_can() (require_perm()).
         if ($perm !== null) require_perm($perm);
-        $args = array_map(fn($v) => ctype_digit($v) ? (int)$v : $v, array_slice($mm, 1));
+        // Only {id} parts become numbers. A slug or token can be all digits ("2027") and must stay text.
+        preg_match_all('/\{([a-z]+)\}/', $pattern, $names);
+        $args = [];
+        foreach (array_slice($mm, 1) as $i => $v) $args[] = ($names[1][$i] ?? '') === 'id' ? (int)$v : $v;
         try {
             $fn = str_contains($handler, '\\') ? $handler : __NAMESPACE__ . '\\' . $handler;

gatecraft/tags/2026.1.3.12/includes/security.php

@@ -162 +162 @@
     header('Cross-Origin-Opener-Policy: same-origin');
     header('Cross-Origin-Resource-Policy: same-origin');
-    if (is_https()) header('Strict-Transport-Security: max-age=63072000; includeSubDomains');
+    // This site only: a plugin must not set the HTTPS rule for the owner's other subdomains.
+    if (is_https()) header('Strict-Transport-Security: max-age=31536000');
     header_remove('X-Powered-By');
 }

gatecraft/tags/2026.1.3.12/languages/ja.php

@@ -2676 +2676 @@
         'Unlimited' => '無制限',
         'Unlisted, link only' => '非公開（リンクを知っている人のみ）',
+        'Unlisted events get a private code at the end of their address, so only people with the link can find them. Share the address shown after you save.' => '非公開のイベントでは、アドレスの末尾に推測できないコードが付き、リンクを知っている人だけが開けます。保存後に表示されるアドレスを共有してください。',
         'Unmatched card payment for booking' => '予約と一致しないクレジットカード支払い：',
         'Unread' => '未読',

gatecraft/tags/2026.1.3.12/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 8.1
-Stable tag: 2026.1.3.11
+Stable tag: 2026.1.3.12
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -129 +129 @@
 == Changelog ==
 
+= 2026.1.3.12 =
+* Changed: Unlisted events get a private code at the end of their address, so only people with the link can find them. They are also kept out of search engines.
+* Fixed: An event whose address was only numbers could not be opened.
+* Improved: Security and reliability improvements.
+
 = 2026.1.3.11 =
 * Improved: Gatecraft now runs in WordPress Playground, so you can try it in your browser with Live Preview.

gatecraft/tags/2026.1.3.12/templates/admin/event_form.php

@@ -38 +38 @@
     <div class="card stack">
       <?php echo wp_kses( field('select', 'status', 'Status', $ev['status'], ['options' => ['draft' => 'Draft (hidden)', 'published' => 'Published', 'archived' => 'Archived'] + ($ev['status'] === 'cancelled' ? ['cancelled' => 'Cancelled'] : [])]), allowed_html() ); ?>
-      <?php echo wp_kses( field('select', 'visibility', 'Visibility', $ev['visibility'], ['options' => ['public' => 'Public, listed on the home page', 'unlisted' => 'Unlisted, link only']]), allowed_html() ); ?>
+      <?php echo wp_kses( field('select', 'visibility', 'Visibility', $ev['visibility'], ['options' => ['public' => 'Public, listed on the home page', 'unlisted' => 'Unlisted, link only'], 'help' => 'Unlisted events get a private code at the end of their address, so only people with the link can find them. Share the address shown after you save.']), allowed_html() ); ?>
       <?php slot('event_form_visibility', ['ev' => $ev]); ?>
     </div>

gatecraft/trunk/gatecraft.php

@@ -3 +3 @@
  * Plugin Name:       Gatecraft
  * Description:       Sell tickets for your own events: priced categories, card and offline payments, QR tickets by email, and a phone camera door scanner.
- * Version:           2026.1.3.11
+ * Version:           2026.1.3.12
  * Requires at least: 6.7
  * Requires PHP:      8.1
@@ -26 +26 @@
 }
 
-define('GATECRAFT_VERSION', '2026.1.3.11');
+define('GATECRAFT_VERSION', '2026.1.3.12');
 define('GATECRAFT_DB_VERSION', 18);
 define('GATECRAFT_FILE', __FILE__);

gatecraft/trunk/includes/eventclone.php

@@ -45 +45 @@
     $row['title'] = mb_substr((string)($o['title'] ?? $src['title']), 0, 190);
     $row['slug'] = eventpack_unique_slug((string)($o['slug'] ?? $src['slug']));
+    // A copy of an unlisted event gets its own private address part, never the original's.
+    if (($row['visibility'] ?? 'public') === 'unlisted') $row['slug'] = event_private_slug(event_slug_base(event_slug_base($row['slug'])));
     $row['status'] = in_array($o['status'] ?? 'draft', ['draft', 'published'], true) ? ($o['status'] ?? 'draft') : 'draft';
     $row['starts_at'] = ldate('Y-m-d H:i:s', lstrtotime((string)$o['starts_at']));

gatecraft/trunk/includes/eventpack.php

@@ -257 +257 @@
         if (isset($e['description'])) $e['description'] = rich_clean((string)$e['description']);
         $e['slug'] = eventpack_unique_slug((string)($e['slug'] ?? $e['title']));
+        if (($e['visibility'] ?? 'public') === 'unlisted') $e['slug'] = event_private_slug(event_slug_base($e['slug']));
         if ($e['slug'] !== ($pkg['event']['slug'] ?? '')) $notes[] = 'The page address was already in use, so this event is at "' . $e['slug'] . '".';
         $e['status'] = 'draft'; $e['venue_id'] = $venueId; $e['cover_image'] = eventpack_save_image($pkg, $e['cover_image'] ?? null);

gatecraft/trunk/includes/helpers.php

@@ -687 +687 @@
 }
 
+/**
+ * Unlisted events are reached only by their address, so the address must not be guessable from the title.
+ * event_private_slug() ends it with 12 random hex characters (48 bits); event_slug_base() removes that part again,
+ * so a copy of an unlisted event never carries the original's private part.
+ */
+function event_slug_base(string $slug): string
+{
+    return (string)preg_replace('/-[a-f0-9]{12}$/', '', $slug);
+}
+
+function event_private_slug(string $slug): string
+{
+    if (preg_match('/-[a-f0-9]{12}$/', $slug)) return $slug;
+    return rtrim(substr($slug, 0, 100), '-') . '-' . bin2hex(random_bytes(6));
+}
+
 /** Crockford base32 (no I, L, O, U): readable, unambiguous codes. */
 function random_code(int $len): string

gatecraft/trunk/includes/http/admin.php

@@ -227 +227 @@
     $title = str_in('title', 190, true, 'Title');
     $slug = slugify(str_in('slug', 120) ?: $title);
-    if (qv('SELECT 1 FROM {events} WHERE slug = ? AND id <> ?', [$slug, $id])) $slug = substr($slug, 0, 110) . '-' . strtolower(random_code(4));
+    // An unlisted event's address gets a private part, so it cannot be guessed from the title.
+    if (post('visibility') === 'unlisted') $slug = event_private_slug($slug);
+    if (qv('SELECT 1 FROM {events} WHERE slug = ? AND id <> ?', [$slug, $id])) $slug = post('visibility') === 'unlisted' ? event_private_slug(event_slug_base($slug)) : substr($slug, 0, 110) . '-' . strtolower(random_code(4));
     $start = dt_in(post('starts_at'));
     if (!$start) fail('Start date and time are required.');

gatecraft/trunk/includes/http/public.php

@@ -125 +125 @@
     $data = event_page_data($slug) ?? abort(404, 'This event could not be found.');
     language_context($data['ev']['language'] ?? null, true);
+    if (($data['ev']['visibility'] ?? 'public') === 'unlisted') {
+        // Unlisted: keep the page out of search engines, and do not pass its private address on to other sites.
+        header('X-Robots-Tag: noindex, nofollow');
+        header('Referrer-Policy: no-referrer');
+        add_filter('wp_robots', fn(array $r) => ['noindex' => true, 'nofollow' => true] + $r);
+        $data['noindex'] = true;
+    }
     render('public/event', $data);
 }

gatecraft/trunk/includes/orders.php

@@ -102 +102 @@
         if ($event['starts_at'] <= now()) fail('Ticket sales for this event have closed.');
 
-        // Limit open (unpaid or unapproved) orders per email, so one person cannot hold the whole event.
-        $open = (int)qv("SELECT COUNT(*) FROM {orders} WHERE event_id = ? AND buyer_email = ? AND status IN ('awaiting_approval','pending_payment') AND expires_at > ?", [$eventId, $buyer['email'], now()]);
+        // Limit open (unpaid or unapproved) orders per email, so one person cannot hold the whole event. Only bookings
+        // from this visitor count (same connection, or same signed-in account): bookings someone else made with this
+        // email cannot lock its owner out, and the message reveals nothing about bookings made elsewhere.
+        $open = (int)qv("SELECT COUNT(*) FROM {orders} WHERE event_id = ? AND buyer_email = ? AND status IN ('awaiting_approval','pending_payment') AND expires_at > ?
+                         AND (ip_hash = ? OR (user_id IS NOT NULL AND user_id = ?))", [$eventId, $buyer['email'], now(), $ipHash, (int)($user['id'] ?? 0)]);
         if ($open >= 2) fail('You already have open bookings for this event. Complete or cancel them first, or wait for them to expire.');
         // And per network address (hashed, never stored as an address), so changing the email does not let one person hold every seat.

gatecraft/trunk/includes/router.php

@@ -48 +48 @@
         // 2. Routes limited to staff check the capability with current_user_can() (require_perm()).
         if ($perm !== null) require_perm($perm);
-        $args = array_map(fn($v) => ctype_digit($v) ? (int)$v : $v, array_slice($mm, 1));
+        // Only {id} parts become numbers. A slug or token can be all digits ("2027") and must stay text.
+        preg_match_all('/\{([a-z]+)\}/', $pattern, $names);
+        $args = [];
+        foreach (array_slice($mm, 1) as $i => $v) $args[] = ($names[1][$i] ?? '') === 'id' ? (int)$v : $v;
         try {
             $fn = str_contains($handler, '\\') ? $handler : __NAMESPACE__ . '\\' . $handler;

gatecraft/trunk/includes/security.php

@@ -162 +162 @@
     header('Cross-Origin-Opener-Policy: same-origin');
     header('Cross-Origin-Resource-Policy: same-origin');
-    if (is_https()) header('Strict-Transport-Security: max-age=63072000; includeSubDomains');
+    // This site only: a plugin must not set the HTTPS rule for the owner's other subdomains.
+    if (is_https()) header('Strict-Transport-Security: max-age=31536000');
     header_remove('X-Powered-By');
 }

gatecraft/trunk/languages/ja.php

@@ -2676 +2676 @@
         'Unlimited' => '無制限',
         'Unlisted, link only' => '非公開（リンクを知っている人のみ）',
+        'Unlisted events get a private code at the end of their address, so only people with the link can find them. Share the address shown after you save.' => '非公開のイベントでは、アドレスの末尾に推測できないコードが付き、リンクを知っている人だけが開けます。保存後に表示されるアドレスを共有してください。',
         'Unmatched card payment for booking' => '予約と一致しないクレジットカード支払い：',
         'Unread' => '未読',

gatecraft/trunk/readme.txt

@@ -5 +5 @@
 Tested up to: 7.1
 Requires PHP: 8.1
-Stable tag: 2026.1.3.11
+Stable tag: 2026.1.3.12
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -129 +129 @@
 == Changelog ==
 
+= 2026.1.3.12 =
+* Changed: Unlisted events get a private code at the end of their address, so only people with the link can find them. They are also kept out of search engines.
+* Fixed: An event whose address was only numbers could not be opened.
+* Improved: Security and reliability improvements.
+
 = 2026.1.3.11 =
 * Improved: Gatecraft now runs in WordPress Playground, so you can try it in your browser with Live Preview.

gatecraft/trunk/templates/admin/event_form.php

@@ -38 +38 @@
     <div class="card stack">
       <?php echo wp_kses( field('select', 'status', 'Status', $ev['status'], ['options' => ['draft' => 'Draft (hidden)', 'published' => 'Published', 'archived' => 'Archived'] + ($ev['status'] === 'cancelled' ? ['cancelled' => 'Cancelled'] : [])]), allowed_html() ); ?>
-      <?php echo wp_kses( field('select', 'visibility', 'Visibility', $ev['visibility'], ['options' => ['public' => 'Public, listed on the home page', 'unlisted' => 'Unlisted, link only']]), allowed_html() ); ?>
+      <?php echo wp_kses( field('select', 'visibility', 'Visibility', $ev['visibility'], ['options' => ['public' => 'Public, listed on the home page', 'unlisted' => 'Unlisted, link only'], 'help' => 'Unlisted events get a private code at the end of their address, so only people with the link can find them. Share the address shown after you save.']), allowed_html() ); ?>
       <?php slot('event_form_visibility', ['ev' => $ev]); ?>
     </div>