@automattic/newspack-blocks 4.28.0 → 4.28.1-hotfix-blocks-input-validation.1

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## @automattic/newspack-blocks [4.28.1-hotfix-blocks-input-validation.1](https://github.com/Automattic/newspack-workspace/compare/newspack-blocks@4.28.0...newspack-blocks@4.28.1-hotfix-blocks-input-validation.1) (2026-07-31)
+
+
+### Bug Fixes
+
+* **blocks:** keep author list and checkout fallbacks intact ([53012be](https://github.com/Automattic/newspack-workspace/commit/53012be987c2001aa8a855dfbf6b857b70c4463b))
+* **blocks:** keep iframe imports inside the uploads directory ([a0118cc](https://github.com/Automattic/newspack-workspace/commit/a0118cc501ca0bfbb851c9e0fdb0f005702b99da))
+* **blocks:** restrict author contact fields to user managers ([c872eb9](https://github.com/Automattic/newspack-workspace/commit/c872eb90589d056a354228adc0a2a65afa6245d3))
+* **blocks:** validate post-checkout redirect destinations ([f418142](https://github.com/Automattic/newspack-workspace/commit/f418142055e14fc6e8fe82726996c7a7028452d5))
+
 # @automattic/newspack-blocks [4.28.0](https://github.com/Automattic/newspack-workspace/compare/newspack-blocks@4.27.1...newspack-blocks@4.28.0) (2026-07-20)
 
 

package/includes/class-modal-checkout.php

@@ -1188,6 +1188,27 @@ final class Modal_Checkout {
 		ob_end_flush();
 	}
 
+	/**
+	 * Reduce a post-checkout destination to one this site is willing to send readers to.
+	 *
+	 * The destination reaches the thank-you page through the request, whether it came from
+	 * the block's own settings or from the link the reader followed, and by that point the
+	 * two are indistinguishable. Core's redirect validation decides: this site's host is
+	 * always allowed, and a publisher who wants to send readers somewhere else adds that
+	 * host through the standard `allowed_redirect_hosts` filter.
+	 *
+	 * @param string $url The requested destination.
+	 *
+	 * @return string The destination, or an empty string if it is not allowed.
+	 */
+	public static function sanitize_after_success_url( $url ) {
+		if ( empty( $url ) ) {
+			return '';
+		}
+
+		return (string) wp_validate_redirect( $url, '' );
+	}
+
 	/**
 	 * Get after success button params.
 	 */
@@ -1201,14 +1222,22 @@ final class Modal_Checkout {
 				\wp_parse_str( $referrer_query, $request_params );
 			}
 		}
-		return array_filter(
+		$params = array_filter(
 			[
 				'after_success_behavior'     => isset( $request_params['after_success_behavior'] ) ? sanitize_text_field( wp_unslash( $request_params['after_success_behavior'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-				'after_success_url'          => isset( $request_params['after_success_url'] ) ? sanitize_url( wp_unslash( $request_params['after_success_url'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+				'after_success_url'          => isset( $request_params['after_success_url'] ) ? self::sanitize_after_success_url( sanitize_url( wp_unslash( $request_params['after_success_url'] ) ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 				'after_success_button_label' => isset( $request_params['after_success_button_label'] ) ? sanitize_text_field( wp_unslash( $request_params['after_success_button_label'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 				'action_type'                => isset( $request_params['action_type'] ) ? sanitize_text_field( wp_unslash( $request_params['action_type'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 			]
 		);
+
+		// A custom destination this site won't redirect to falls back to closing the modal, so
+		// the reader gets a finished checkout rather than an empty destination.
+		if ( 'custom' === ( $params['after_success_behavior'] ?? '' ) && empty( $params['after_success_url'] ) ) {
+			unset( $params['after_success_behavior'] );
+		}
+
+		return $params;
 	}
 
 	/**

package/newspack-blocks.php

@@ -7,7 +7,7 @@
  * Author URI:      https://newspack.com/
  * Text Domain:     newspack-blocks
  * Domain Path:     /languages
- * Version:         4.28.0
+ * Version:         4.28.1-hotfix-blocks-input-validation.1
  *
  * @package         Newspack_Blocks
  */
@@ -15,7 +15,7 @@
 define( 'NEWSPACK_BLOCKS__PLUGIN_FILE', __FILE__ );
 define( 'NEWSPACK_BLOCKS__BLOCKS_DIRECTORY', 'dist/' );
 define( 'NEWSPACK_BLOCKS__PLUGIN_DIR', plugin_dir_path( NEWSPACK_BLOCKS__PLUGIN_FILE ) );
-define( 'NEWSPACK_BLOCKS__VERSION', '4.28.0' );
+define( 'NEWSPACK_BLOCKS__VERSION', '4.28.1-hotfix-blocks-input-validation.1' );
 
 require_once NEWSPACK_BLOCKS__PLUGIN_DIR . 'includes/class-newspack-blocks.php';
 require_once NEWSPACK_BLOCKS__PLUGIN_DIR . 'includes/class-newspack-blocks-api.php';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@automattic/newspack-blocks",
-	"version": "4.28.0",
+	"version": "4.28.1-hotfix-blocks-input-validation.1",
 	"author": "Automattic",
 	"description": "=== Newspack Blocks === Contributors: (this should be a list of wordpress.org userid's) Donate link: https://example.com/ Tags: comments, spam Requires at least: 4.5 Tested up to: 5.1.1 Stable tag: 0.1.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html",
 	"repository": {

package/src/blocks/author-list/class-wp-rest-newspack-author-list-controller.php

@@ -12,6 +12,13 @@
 class WP_REST_Newspack_Author_List_Controller extends WP_REST_Newspack_Authors_Controller {
 // phpcs:enable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound
 
+	/**
+	 * Fields returned when a caller doesn't ask for a specific set.
+	 *
+	 * @var string[]
+	 */
+	const DEFAULT_FIELDS = [ 'id', 'name', 'bio', 'email', 'social', 'avatar', 'url' ];
+
 	/**
 	 * Constructs the controller.
 	 *
@@ -136,6 +143,10 @@ class WP_REST_Newspack_Author_List_Controller extends WP_REST_Newspack_Authors_C
 			$options['fields'] = explode( ',', $request->get_param( 'fields' ) );
 		}
 
+		// Restricted here rather than in get_all_authors(), which also renders the block on
+		// the front end for visitors and must keep returning whatever a publisher publishes.
+		$options['fields'] = self::restrict_fields( $options['fields'] ?? self::DEFAULT_FIELDS );
+
 		$combined_authors = $this->get_all_authors( $options );
 		$response         = new \WP_REST_Response( $combined_authors );
 		$response->header( 'x-wp-total', count( $combined_authors ) );
@@ -157,7 +168,7 @@ class WP_REST_Newspack_Author_List_Controller extends WP_REST_Newspack_Authors_C
 			'avatar_hide_default' => false,
 			'exclude'             => [], // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude
 			'exclude_empty'       => false,
-			'fields'              => [ 'id', 'name', 'bio', 'email', 'social', 'avatar', 'url' ],
+			'fields'              => self::DEFAULT_FIELDS,
 			'per_page'            => 10,
 		];
 		$options         = wp_parse_args( $options, $default_options );

package/src/blocks/author-profile/class-wp-rest-newspack-authors-controller.php

@@ -12,6 +12,14 @@
 class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 // phpcs:enable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound
 
+	/**
+	 * Fields carrying contact details that WordPress reserves for people who manage users.
+	 *
+	 * These endpoints are open to anyone who can edit posts, which is a much wider audience
+	 * than core allows to read an address.
+	 */
+	const USER_MANAGEMENT_FIELDS = [ 'email' ];
+
 	/**
 	 * Constructs the controller.
 	 *
@@ -22,6 +30,39 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 		$this->rest_base = 'authors';
 	}
 
+	/**
+	 * Whether the current user may read author contact details.
+	 *
+	 * Matches the capabilities core requires before exposing a user's address.
+	 *
+	 * @return boolean
+	 */
+	public static function can_read_user_management_fields() {
+		return current_user_can( 'list_users' ) || current_user_can( 'edit_users' );
+	}
+
+	/**
+	 * Drop any requested fields the current user is not allowed to read.
+	 *
+	 * Applied per request rather than inside the formatting helpers, which also render the
+	 * front-end author blocks for visitors and must keep returning whatever a publisher has
+	 * chosen to publish there.
+	 *
+	 * `false` is the helpers' "every field" convention, used by the front-end blocks; it is
+	 * passed through untouched so those renders are unaffected.
+	 *
+	 * @param array|false $fields Requested fields, or false for every field.
+	 *
+	 * @return array|false Fields the current user may receive.
+	 */
+	public static function restrict_fields( $fields ) {
+		if ( ! is_array( $fields ) || self::can_read_user_management_fields() ) {
+			return $fields;
+		}
+
+		return array_values( array_diff( $fields, self::USER_MANAGEMENT_FIELDS ) );
+	}
+
 	/**
 	 * Registers the necessary REST API routes.
 	 *
@@ -84,6 +125,7 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 		$per_page            = ! empty( $request->get_param( 'perPage' ) ) ? $request->get_param( 'perPage' ) : 10; // Number of results to return per page. This is applied to each query, so the actual number of results returned may be up to 2x this number.
 		$avatar_hide_default = ! empty( $request->get_param( 'avatar_hide_default' ) ) ? true : false; // Hide the default avatar if the user has no custom avatar.
 		$fields              = ! empty( $request->get_param( 'fields' ) ) ? explode( ',', $request->get_param( 'fields' ) ) : [ 'id' ]; // Fields to get. Will return at least id.
+		$fields              = self::restrict_fields( $fields );
 		$include             = ! empty( $request->get_param( 'include' ) ) ? explode( ',', $request->get_param( 'include' ) ) : null; // Fetch authors by multiple IDs.
 		$post_id             = ! empty( $request->get_param( 'post_id' ) ) ? $request->get_param( 'post_id' ) : 0; // Fetch authors for a specific post (contextual mode).
 

package/src/blocks/iframe/class-wp-rest-newspack-iframe-controller.php

@@ -246,6 +246,88 @@ class WP_REST_Newspack_Iframe_Controller extends WP_REST_Controller {
 		return in_array( $mime_type, array_keys( self::iframe_archive_accepted_file_mimes() ), true );
 	}
 
+	/**
+	 * Reduce a caller-supplied name to a single safe path segment.
+	 *
+	 * Used for names this plugin generates but builds out of caller-supplied parts, such as
+	 * the destination folder derived from an attachment title.
+	 *
+	 * @param string $segment The name to reduce.
+	 *
+	 * @return string|false The safe segment, or false if nothing usable is left.
+	 */
+	private function sanitize_path_segment( $segment ) {
+		$segment = sanitize_file_name( basename( str_replace( '\\', '/', (string) $segment ) ) );
+
+		if ( '' === $segment || '.' === $segment || '..' === $segment ) {
+			return false;
+		}
+
+		return $segment;
+	}
+
+	/**
+	 * Reduce a caller-supplied relative path to safe segments, keeping subdirectories.
+	 *
+	 * Archive entries may legitimately sit in subdirectories and are referenced by name from
+	 * the archive's own markup, so the segments are checked rather than rewritten: renaming
+	 * them would break those references. Anything that could point outside the destination —
+	 * an upward segment, an absolute path, a drive letter or a null byte — is refused
+	 * outright rather than stripped, since stripping is what makes layered payloads such as
+	 * `....//` work.
+	 *
+	 * @param string $path The relative path to reduce.
+	 *
+	 * @return string|false The safe relative path, or false if it is not usable.
+	 */
+	private function sanitize_relative_path( $path ) {
+		$path = str_replace( '\\', '/', (string) $path );
+
+		if ( '' === $path || false !== strpos( $path, "\0" ) ) {
+			return false;
+		}
+
+		// Absolute paths, including Windows drive letters.
+		if ( '/' === $path[0] || preg_match( '#^[a-zA-Z]:#', $path ) ) {
+			return false;
+		}
+
+		$segments = [];
+		foreach ( explode( '/', $path ) as $segment ) {
+			if ( '' === $segment || '.' === $segment ) {
+				continue;
+			}
+			if ( '..' === $segment ) {
+				return false;
+			}
+			$segments[] = $segment;
+		}
+
+		return empty( $segments ) ? false : implode( '/', $segments );
+	}
+
+	/**
+	 * Confirm that a destination resolves inside a directory.
+	 *
+	 * A last check on the resolved paths, after the destination's parent exists, so that a
+	 * symlink or a gap in the checks above still cannot place a file outside the directory.
+	 *
+	 * @param string $directory   Absolute path to the directory the write must stay inside.
+	 * @param string $destination Absolute path to the intended destination.
+	 *
+	 * @return boolean
+	 */
+	private function is_inside_directory( $directory, $destination ) {
+		$directory   = realpath( $directory );
+		$destination = realpath( dirname( $destination ) );
+
+		if ( ! $directory || ! $destination ) {
+			return false;
+		}
+
+		return 0 === strpos( trailingslashit( $destination ), trailingslashit( $directory ) );
+	}
+
 	/**
 	 * Receive the iframe content, handle it, and returns the URL and the folder name.
 	 *
@@ -363,7 +445,11 @@ class WP_REST_Newspack_Iframe_Controller extends WP_REST_Controller {
 	 * @return WP_REST_Response
 	 */
 	private function process_iframe_document( $request, $document_filename, $media_source_path ) {
-		if ( ! $this->validate_file_extension( $document_filename, false ) ) {
+		// The filename is built from the source attachment's title, so it is only a name once
+		// it has been reduced to a single segment.
+		$document_filename = $this->sanitize_path_segment( $document_filename );
+
+		if ( ! $document_filename || ! $this->validate_file_extension( $document_filename, false ) ) {
 			return new WP_Error(
 				'newspack_blocks',
 				sprintf(
@@ -393,6 +479,14 @@ class WP_REST_Newspack_Iframe_Controller extends WP_REST_Controller {
 			}
 		}
 
+		if ( ! $this->is_inside_directory( $iframe_upload_dir, $iframe_path ) ) {
+			return new WP_Error(
+				'newspack_blocks',
+				__( 'Could not upload your document.', 'newspack-blocks' ),
+				[ 'status' => '400' ]
+			);
+		}
+
 		// Copy uploaded document file to destination.
 		if ( copy( $media_source_path, $iframe_path ) ) {
 			return [
@@ -434,6 +528,13 @@ class WP_REST_Newspack_Iframe_Controller extends WP_REST_Controller {
 		}
 		global $wp_filesystem;
 
+		// The folder is built from the source attachment's title, so it is only a name once it
+		// has been reduced to a single segment.
+		$iframe_folder = $this->sanitize_path_segment( $iframe_folder );
+		if ( ! $iframe_folder ) {
+			return $invalid_file_error;
+		}
+
 		$wp_upload_dir     = wp_upload_dir();
 		$iframe_upload_dir = $wp_upload_dir['path'] . self::IFRAME_UPLOAD_DIR;
 		$iframe_path       = trailingslashit( $iframe_upload_dir . $iframe_folder );
@@ -464,10 +565,21 @@ class WP_REST_Newspack_Iframe_Controller extends WP_REST_Controller {
 			}
 			$stat = $zip->statIndex( $file_index );
 			if ( $stat && isset( $stat['name'] ) ) {
-				if ( ! file_exists( dirname( $iframe_path . $stat['name'] ) ) ) {
-					wp_mkdir_p( dirname( $iframe_path . $stat['name'] ) );
+				// An entry names its own destination, so it decides where the write lands.
+				$entry_relative_path = $this->sanitize_relative_path( $stat['name'] );
+				if ( ! $entry_relative_path ) {
+					return $invalid_file_error;
+				}
+
+				$destination = $iframe_path . $entry_relative_path;
+				if ( ! file_exists( dirname( $destination ) ) ) {
+					wp_mkdir_p( dirname( $destination ) );
 				}
-				$put = $wp_filesystem->put_contents( $iframe_path . $stat['name'], $contents );
+				if ( ! $this->is_inside_directory( $iframe_upload_dir, $destination ) ) {
+					return $invalid_file_error;
+				}
+
+				$put = $wp_filesystem->put_contents( $destination, $contents );
 				if ( ! $put ) {
 					return $invalid_file_error;
 				}

package/src/modal-checkout/templates/thankyou.php

@@ -47,9 +47,15 @@ if ( ! $is_valid ) {
 
 $is_success             = ! $order->has_status( 'failed' );
 $after_success_behavior = isset( $_GET['after_success_behavior'] ) ? \sanitize_text_field( \wp_unslash( $_GET['after_success_behavior'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-$after_success_url      = isset( $_GET['after_success_url'] ) ? esc_url( \sanitize_url( \wp_unslash( $_GET['after_success_url'] ) ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+$after_success_url      = isset( $_GET['after_success_url'] ) ? esc_url( \Newspack_Blocks\Modal_Checkout::sanitize_after_success_url( \sanitize_url( \wp_unslash( $_GET['after_success_url'] ) ) ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 $after_success_label    = isset( $_GET['after_success_button_label'] ) ? \sanitize_text_field( \wp_unslash( $_GET['after_success_button_label'] ) ) : \Newspack_Blocks\Modal_Checkout::get_modal_checkout_labels( 'after_success' ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 $checkout_data          = Checkout_Data::get_checkout_data( $order );
+
+// A custom destination this site won't redirect to falls back to closing the modal, so the
+// reader gets a finished checkout rather than an empty destination.
+if ( 'custom' === $after_success_behavior && empty( $after_success_url ) ) {
+	$after_success_behavior = '';
+}
 ?>
 <div class="woocommerce-order">
 <?php if ( $is_success ) : ?>

package/vendor/composer/installed.php

@@ -3,7 +3,7 @@
         'name' => 'automattic/newspack-blocks',
         'pretty_version' => 'dev-main',
         'version' => 'dev-main',
-        'reference' => 'f937e9f691dbdb938f7478a05bc22d51b771311f',
+        'reference' => '53012be987c2001aa8a855dfbf6b857b70c4463b',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         'automattic/newspack-blocks' => array(
             'pretty_version' => 'dev-main',
             'version' => 'dev-main',
-            'reference' => 'f937e9f691dbdb938f7478a05bc22d51b771311f',
+            'reference' => '53012be987c2001aa8a855dfbf6b857b70c4463b',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),