Repository navigation
Fix security audit findings: auth-check bypass, path and error-detail disclosure, fatal on bad settings - #277
Merged
Merged
Conversation
… disclosure, fatal on bad settings - "Show to Logged In Users" now uses is_user_logged_in() instead of checking that a forgeable wordpress_logged_in cookie merely exists. - Default error mode is show-logged-in instead of show, so compile errors (which include server paths) no longer render for anonymous visitors on installs that never saved the setting. - Errors in "Print to Log" mode go to the PHP error log via error_log() instead of a web-readable error_log.log inside the SCSS directory; the 1MB rotation code goes with it. - Unknown sourcemap or output-style values no longer fatal every page load: the sourcemap constant is checked with defined() and the output style falls back to compressed. - SCSS, CSS and cache paths reject ".." so they stay inside the chosen Base Location. - Compiled CSS moves from cache to the CSS directory with rename() (atomic) with a copy fallback across filesystems. - Directory paths in admin notices are escaped; the error overlay's allowed-tag list had "string" where it meant "strong". Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Collaborator
Author
|
@codex review |
Merged
shadoath
added a commit
that referenced
this pull request
Oct 31, 2026
Ships scssphp 1.13.0 (#275), the PHP 8.4 nullable fixes (#276) and the security audit fixes (#277). Updates the Stable tag, Tested up to (WordPress 7.1, PHP 8.4), the bundled ScssPHP version in the readme, and adds the 5.0.0 changelog entry to readme.txt and readme.md. Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
wordpress_logged_in_*cookie no longer sees the compile-error overlay, and setting the SCSS Location to/../../xis refused with a settings error.error_log.logfile in the SCSS directory exposed server paths and SCSS error context to anonymous visitors; an unknown sourcemap or output-style value fataled every page load; path settings accepted..; admin notices echoed unescaped paths; cache-to-CSS copies were not atomic.error_log.log, and the error default (when the option was never saved) is "Show to Logged In Users". Readme and CLAUDE.md updated.rename()replaces the CSS file's inode, so on hosts where a separate deploy user used to overwrite a PHP-writable CSS file in place, that user now needs write permission on the CSS directory to replace it; they notice on the next deploy, loudly.🤖 Generated with Claude Code