You've already forked wc-licensed-product
Release v0.7.0 - Security Hardening
Security Fixes: - Fixed XSS vulnerability in checkout blocks DOM injection (replaced innerHTML with safe DOM methods) - Unified IP detection for rate limiting across all API endpoints (new IpDetectionTrait) - Added rate limiting to license transfers (5/hour) and downloads (30/hour) (new RateLimitTrait) - Added file size limit (2MB), row limit (1000), and rate limiting to CSV import - Added JSON decode error handling in StoreApiExtension - Added license ID validation in frontend.js to prevent selector injection New Files: - src/Api/IpDetectionTrait.php - Shared IP detection with proxy support - src/Common/RateLimitTrait.php - Reusable rate limiting for frontend operations Breaking Changes: - None Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
This commit is contained in:
@@ -367,64 +367,90 @@
|
||||
container.className = 'wc-block-components-licensed-product-wrapper';
|
||||
container.style.cssText = 'margin: 20px 0; padding: 16px; background: #f0f0f0; border-radius: 4px;';
|
||||
|
||||
if (settings.isMultiDomainEnabled && settings.licensedProducts) {
|
||||
container.innerHTML = `
|
||||
<h4 style="margin: 0 0 8px 0;">${settings.sectionTitle || 'License Domains'}</h4>
|
||||
<p style="margin-bottom: 12px; color: #666; font-size: 0.9em;">
|
||||
${settings.fieldDescription || 'Enter a unique domain for each license.'}
|
||||
</p>
|
||||
${settings.licensedProducts.map(product => {
|
||||
const productKey = product.variation_id && product.variation_id > 0
|
||||
? `${product.product_id}_${product.variation_id}`
|
||||
: product.product_id;
|
||||
const durationLabel = product.duration_label || '';
|
||||
const displayName = durationLabel
|
||||
? `${product.name} (${durationLabel})`
|
||||
: product.name;
|
||||
// Helper function to create elements with text content (XSS-safe)
|
||||
function createEl(tag, textContent, styles) {
|
||||
var el = document.createElement(tag);
|
||||
if (textContent) el.textContent = textContent;
|
||||
if (styles) el.style.cssText = styles;
|
||||
return el;
|
||||
}
|
||||
|
||||
return `
|
||||
<div style="margin-bottom: 16px; padding: 12px; background: #fff; border-radius: 4px;">
|
||||
<strong style="display: block; margin-bottom: 8px;">
|
||||
${displayName}${product.quantity > 1 ? ` ×${product.quantity}` : ''}
|
||||
</strong>
|
||||
${Array.from({ length: product.quantity }, (_, i) => `
|
||||
<div style="margin-bottom: 8px;">
|
||||
<label style="display: block; margin-bottom: 4px;">
|
||||
${(settings.licenseLabel || 'License %d:').replace('%d', i + 1)}
|
||||
</label>
|
||||
<input type="text"
|
||||
name="licensed_domains[${productKey}][${i}]"
|
||||
placeholder="${settings.fieldPlaceholder || 'example.com'}"
|
||||
style="width: 100%; padding: 8px; border: 1px solid #ccc; border-radius: 4px;"
|
||||
/>
|
||||
${product.variation_id && product.variation_id > 0 ? `
|
||||
<input type="hidden"
|
||||
name="licensed_variation_ids[${productKey}]"
|
||||
value="${product.variation_id}"
|
||||
/>
|
||||
` : ''}
|
||||
</div>
|
||||
`).join('')}
|
||||
</div>
|
||||
`}).join('')}
|
||||
`;
|
||||
if (settings.isMultiDomainEnabled && settings.licensedProducts) {
|
||||
// Build header safely using DOM methods
|
||||
var header = createEl('h4', settings.sectionTitle || 'License Domains', 'margin: 0 0 8px 0;');
|
||||
container.appendChild(header);
|
||||
|
||||
var desc = createEl('p', settings.fieldDescription || 'Enter a unique domain for each license.',
|
||||
'margin-bottom: 12px; color: #666; font-size: 0.9em;');
|
||||
container.appendChild(desc);
|
||||
|
||||
// Build product sections
|
||||
settings.licensedProducts.forEach(function(product) {
|
||||
var productKey = product.variation_id && product.variation_id > 0
|
||||
? product.product_id + '_' + product.variation_id
|
||||
: String(product.product_id);
|
||||
var durationLabel = product.duration_label || '';
|
||||
var displayName = durationLabel
|
||||
? product.name + ' (' + durationLabel + ')'
|
||||
: product.name;
|
||||
|
||||
var productDiv = createEl('div', null, 'margin-bottom: 16px; padding: 12px; background: #fff; border-radius: 4px;');
|
||||
|
||||
var nameEl = createEl('strong', displayName + (product.quantity > 1 ? ' ×' + product.quantity : ''),
|
||||
'display: block; margin-bottom: 8px;');
|
||||
productDiv.appendChild(nameEl);
|
||||
|
||||
// Create input fields for each quantity
|
||||
for (var i = 0; i < product.quantity; i++) {
|
||||
var fieldDiv = createEl('div', null, 'margin-bottom: 8px;');
|
||||
|
||||
var label = createEl('label', (settings.licenseLabel || 'License %d:').replace('%d', i + 1),
|
||||
'display: block; margin-bottom: 4px;');
|
||||
fieldDiv.appendChild(label);
|
||||
|
||||
var input = document.createElement('input');
|
||||
input.type = 'text';
|
||||
input.name = 'licensed_domains[' + productKey + '][' + i + ']';
|
||||
input.placeholder = settings.fieldPlaceholder || 'example.com';
|
||||
input.style.cssText = 'width: 100%; padding: 8px; border: 1px solid #ccc; border-radius: 4px;';
|
||||
fieldDiv.appendChild(input);
|
||||
|
||||
// Hidden variation ID if applicable
|
||||
if (product.variation_id && product.variation_id > 0) {
|
||||
var hiddenInput = document.createElement('input');
|
||||
hiddenInput.type = 'hidden';
|
||||
hiddenInput.name = 'licensed_variation_ids[' + productKey + ']';
|
||||
hiddenInput.value = String(product.variation_id);
|
||||
fieldDiv.appendChild(hiddenInput);
|
||||
}
|
||||
|
||||
productDiv.appendChild(fieldDiv);
|
||||
}
|
||||
|
||||
container.appendChild(productDiv);
|
||||
});
|
||||
} else {
|
||||
container.innerHTML = `
|
||||
<h4 style="margin: 0 0 8px 0;">${settings.sectionTitle || 'License Domain'}</h4>
|
||||
<p style="margin-bottom: 12px; color: #666; font-size: 0.9em;">
|
||||
${settings.fieldDescription || 'Enter the domain where you will use the license.'}
|
||||
</p>
|
||||
<div style="margin-bottom: 8px;">
|
||||
<label style="display: block; margin-bottom: 4px;">
|
||||
${settings.singleDomainLabel || 'Domain'}
|
||||
</label>
|
||||
<input type="text"
|
||||
name="licensed_product_domain"
|
||||
placeholder="${settings.fieldPlaceholder || 'example.com'}"
|
||||
style="width: 100%; padding: 8px; border: 1px solid #ccc; border-radius: 4px;"
|
||||
/>
|
||||
</div>
|
||||
`;
|
||||
// Single domain mode - build safely using DOM methods
|
||||
var header = createEl('h4', settings.sectionTitle || 'License Domain', 'margin: 0 0 8px 0;');
|
||||
container.appendChild(header);
|
||||
|
||||
var desc = createEl('p', settings.fieldDescription || 'Enter the domain where you will use the license.',
|
||||
'margin-bottom: 12px; color: #666; font-size: 0.9em;');
|
||||
container.appendChild(desc);
|
||||
|
||||
var fieldDiv = createEl('div', null, 'margin-bottom: 8px;');
|
||||
|
||||
var label = createEl('label', settings.singleDomainLabel || 'Domain', 'display: block; margin-bottom: 4px;');
|
||||
fieldDiv.appendChild(label);
|
||||
|
||||
var input = document.createElement('input');
|
||||
input.type = 'text';
|
||||
input.name = 'licensed_product_domain';
|
||||
input.placeholder = settings.fieldPlaceholder || 'example.com';
|
||||
input.style.cssText = 'width: 100%; padding: 8px; border: 1px solid #ccc; border-radius: 4px;';
|
||||
fieldDiv.appendChild(input);
|
||||
|
||||
container.appendChild(fieldDiv);
|
||||
}
|
||||
|
||||
if (contactInfo) {
|
||||
|
||||
Reference in New Issue
Block a user