@automattic/newspack-blocks 4.28.0 → 4.28.1-hotfix-blocks-input-validation.2

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## @automattic/newspack-blocks [4.28.1-hotfix-blocks-input-validation.2](https://github.com/Automattic/newspack-workspace/compare/newspack-blocks@4.28.1-hotfix-blocks-input-validation.1...newspack-blocks@4.28.1-hotfix-blocks-input-validation.2) (2026-07-31)
+
+
+### Bug Fixes
+
+* **blocks:** close after-success dead ends and tighten write checks ([12e6bd8](https://github.com/Automattic/newspack-workspace/commit/12e6bd898d28eaf4fb6a59633f99b297febc308f))
+
 # @automattic/newspack-blocks [4.28.0](https://github.com/Automattic/newspack-workspace/compare/newspack-blocks@4.27.1...newspack-blocks@4.28.0) (2026-07-20)
 
 

package/includes/class-modal-checkout.php

@@ -1188,6 +1188,80 @@ final class Modal_Checkout {
 		ob_end_flush();
 	}
 
+	/**
+	 * Behaviors that have somewhere to go once checkout finishes.
+	 *
+	 * Anything else leaves the reader in a modal that won't move and won't close, so it is
+	 * treated as "close the modal" instead.
+	 *
+	 * @var string[]
+	 */
+	const AFTER_SUCCESS_BEHAVIORS = [ 'custom', 'referrer' ];
+
+	/**
+	 * Reduce a post-checkout destination to one this site is willing to send readers to.
+	 *
+	 * The destination reaches the thank-you page through the request, whether it came from
+	 * the block's own settings or from the link the reader followed, and by that point the
+	 * two are indistinguishable. Core's redirect validation decides, so the destinations
+	 * this site accepts are the ones `allowed_redirect_hosts` reports. That's this site's
+	 * own host, plus whatever a publisher adds through that filter, plus anything another
+	 * plugin has added (`Newspack\NRH` registers one).
+	 *
+	 * @param string $url The requested destination.
+	 *
+	 * @return string The destination, or an empty string if it is not allowed.
+	 */
+	public static function sanitize_after_success_url( $url ) {
+		$url = sanitize_url( (string) $url );
+
+		if ( empty( $url ) ) {
+			return '';
+		}
+
+		// Core compares hosts case-sensitively; host names aren't. Normalise first so this
+		// site's own host typed in capitals isn't read as somewhere else.
+		$host = wp_parse_url( $url, PHP_URL_HOST );
+		if ( $host && strtolower( $host ) !== $host ) {
+			$url = str_replace( '://' . $host, '://' . strtolower( $host ), $url );
+		}
+
+		return (string) wp_validate_redirect( $url, '' );
+	}
+
+	/**
+	 * Drop an after-success behavior the reader can't act on.
+	 *
+	 * A behavior with nowhere to go renders a modal that neither navigates nor closes, so
+	 * the destination, the behavior and its button label all fall away together and the
+	 * reader gets the ordinary "close" button instead of one labelled for a page they
+	 * won't be taken to.
+	 *
+	 * @param array $params After-success params.
+	 *
+	 * @return array The params, less any the reader can't act on.
+	 */
+	public static function filter_after_success_params( $params ) {
+		$behavior = $params['after_success_behavior'] ?? '';
+
+		if ( '' === $behavior ) {
+			return $params;
+		}
+
+		$is_unknown  = ! in_array( $behavior, self::AFTER_SUCCESS_BEHAVIORS, true );
+		$has_nowhere = 'custom' === $behavior && empty( $params['after_success_url'] );
+
+		if ( $is_unknown || $has_nowhere ) {
+			unset(
+				$params['after_success_behavior'],
+				$params['after_success_url'],
+				$params['after_success_button_label']
+			);
+		}
+
+		return $params;
+	}
+
 	/**
 	 * Get after success button params.
 	 */
@@ -1201,14 +1275,16 @@ final class Modal_Checkout {
 				\wp_parse_str( $referrer_query, $request_params );
 			}
 		}
-		return array_filter(
+		$params = array_filter(
 			[
 				'after_success_behavior'     => isset( $request_params['after_success_behavior'] ) ? sanitize_text_field( wp_unslash( $request_params['after_success_behavior'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-				'after_success_url'          => isset( $request_params['after_success_url'] ) ? sanitize_url( wp_unslash( $request_params['after_success_url'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+				'after_success_url'          => isset( $request_params['after_success_url'] ) ? self::sanitize_after_success_url( wp_unslash( $request_params['after_success_url'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 				'after_success_button_label' => isset( $request_params['after_success_button_label'] ) ? sanitize_text_field( wp_unslash( $request_params['after_success_button_label'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 				'action_type'                => isset( $request_params['action_type'] ) ? sanitize_text_field( wp_unslash( $request_params['action_type'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 			]
 		);
+
+		return self::filter_after_success_params( $params );
 	}
 
 	/**

package/newspack-blocks.php

@@ -7,7 +7,7 @@
  * Author URI:      https://newspack.com/
  * Text Domain:     newspack-blocks
  * Domain Path:     /languages
- * Version:         4.28.0
+ * Version:         4.28.1-hotfix-blocks-input-validation.2
  *
  * @package         Newspack_Blocks
  */
@@ -15,7 +15,7 @@
 define( 'NEWSPACK_BLOCKS__PLUGIN_FILE', __FILE__ );
 define( 'NEWSPACK_BLOCKS__BLOCKS_DIRECTORY', 'dist/' );
 define( 'NEWSPACK_BLOCKS__PLUGIN_DIR', plugin_dir_path( NEWSPACK_BLOCKS__PLUGIN_FILE ) );
-define( 'NEWSPACK_BLOCKS__VERSION', '4.28.0' );
+define( 'NEWSPACK_BLOCKS__VERSION', '4.28.1-hotfix-blocks-input-validation.2' );
 
 require_once NEWSPACK_BLOCKS__PLUGIN_DIR . 'includes/class-newspack-blocks.php';
 require_once NEWSPACK_BLOCKS__PLUGIN_DIR . 'includes/class-newspack-blocks-api.php';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@automattic/newspack-blocks",
-	"version": "4.28.0",
+	"version": "4.28.1-hotfix-blocks-input-validation.2",
 	"author": "Automattic",
 	"description": "=== Newspack Blocks === Contributors: (this should be a list of wordpress.org userid's) Donate link: https://example.com/ Tags: comments, spam Requires at least: 4.5 Tested up to: 5.1.1 Stable tag: 0.1.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html",
 	"repository": {

package/src/blocks/author-list/class-wp-rest-newspack-author-list-controller.php

@@ -12,6 +12,13 @@
 class WP_REST_Newspack_Author_List_Controller extends WP_REST_Newspack_Authors_Controller {
 // phpcs:enable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound
 
+	/**
+	 * Fields returned when a caller doesn't ask for a specific set.
+	 *
+	 * @var string[]
+	 */
+	const DEFAULT_FIELDS = [ 'id', 'name', 'bio', 'email', 'social', 'avatar', 'url' ];
+
 	/**
 	 * Constructs the controller.
 	 *
@@ -136,6 +143,10 @@ class WP_REST_Newspack_Author_List_Controller extends WP_REST_Newspack_Authors_C
 			$options['fields'] = explode( ',', $request->get_param( 'fields' ) );
 		}
 
+		// Restricted here rather than in get_all_authors(), which also renders the block on
+		// the front end for visitors and must keep returning whatever a publisher publishes.
+		$options['fields'] = self::restrict_fields( $options['fields'] ?? self::DEFAULT_FIELDS );
+
 		$combined_authors = $this->get_all_authors( $options );
 		$response         = new \WP_REST_Response( $combined_authors );
 		$response->header( 'x-wp-total', count( $combined_authors ) );
@@ -157,7 +168,7 @@ class WP_REST_Newspack_Author_List_Controller extends WP_REST_Newspack_Authors_C
 			'avatar_hide_default' => false,
 			'exclude'             => [], // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude
 			'exclude_empty'       => false,
-			'fields'              => [ 'id', 'name', 'bio', 'email', 'social', 'avatar', 'url' ],
+			'fields'              => self::DEFAULT_FIELDS,
 			'per_page'            => 10,
 		];
 		$options         = wp_parse_args( $options, $default_options );

package/src/blocks/author-list/view.php

@@ -57,7 +57,7 @@ function newspack_blocks_render_block_author_list( $attributes ) {
 		'author_type'  => $author_type,
 		'author_roles' => $author_roles,
 		'exclude'      => $attributes['exclude'], // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude
-		'fields'       => [ 'id', 'name', 'bio', 'email', 'social', 'avatar', 'url' ],
+		'fields'       => WP_REST_Newspack_Author_List_Controller::DEFAULT_FIELDS,
 	];
 
 	if ( $exclude_empty ) {

package/src/blocks/author-profile/class-wp-rest-newspack-authors-controller.php

@@ -12,6 +12,14 @@
 class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 // phpcs:enable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound
 
+	/**
+	 * Fields carrying contact details that WordPress reserves for people who manage users.
+	 *
+	 * These endpoints are open to anyone who can edit posts, which is a much wider audience
+	 * than core allows to read an address.
+	 */
+	const USER_MANAGEMENT_FIELDS = [ 'email' ];
+
 	/**
 	 * Constructs the controller.
 	 *
@@ -22,6 +30,41 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 		$this->rest_base = 'authors';
 	}
 
+	/**
+	 * Whether the current user may read author contact details.
+	 *
+	 * Matches the capabilities core requires before exposing a user's address.
+	 *
+	 * @return boolean
+	 */
+	public static function can_read_user_management_fields() {
+		// Keep `list_users` first: on multisite, core maps `edit_users` through
+		// `manage_network_users`, so a site administrator passes only on `list_users`.
+		return current_user_can( 'list_users' ) || current_user_can( 'edit_users' );
+	}
+
+	/**
+	 * Drop any requested fields the current user is not allowed to read.
+	 *
+	 * Applied per request rather than inside the formatting helpers, which also render the
+	 * front-end author blocks for visitors and must keep returning whatever a publisher has
+	 * chosen to publish there.
+	 *
+	 * `false` is the helpers' "every field" convention, used by the front-end blocks; it is
+	 * passed through untouched so those renders are unaffected.
+	 *
+	 * @param array|false $fields Requested fields, or false for every field.
+	 *
+	 * @return array|false Fields the current user may receive.
+	 */
+	public static function restrict_fields( $fields ) {
+		if ( ! is_array( $fields ) || self::can_read_user_management_fields() ) {
+			return $fields;
+		}
+
+		return array_values( array_diff( $fields, self::USER_MANAGEMENT_FIELDS ) );
+	}
+
 	/**
 	 * Registers the necessary REST API routes.
 	 *
@@ -84,6 +127,7 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 		$per_page            = ! empty( $request->get_param( 'perPage' ) ) ? $request->get_param( 'perPage' ) : 10; // Number of results to return per page. This is applied to each query, so the actual number of results returned may be up to 2x this number.
 		$avatar_hide_default = ! empty( $request->get_param( 'avatar_hide_default' ) ) ? true : false; // Hide the default avatar if the user has no custom avatar.
 		$fields              = ! empty( $request->get_param( 'fields' ) ) ? explode( ',', $request->get_param( 'fields' ) ) : [ 'id' ]; // Fields to get. Will return at least id.
+		$fields              = self::restrict_fields( $fields );
 		$include             = ! empty( $request->get_param( 'include' ) ) ? explode( ',', $request->get_param( 'include' ) ) : null; // Fetch authors by multiple IDs.
 		$post_id             = ! empty( $request->get_param( 'post_id' ) ) ? $request->get_param( 'post_id' ) : 0; // Fetch authors for a specific post (contextual mode).
 

package/src/blocks/iframe/class-wp-rest-newspack-iframe-controller.php

@@ -246,6 +246,100 @@ class WP_REST_Newspack_Iframe_Controller extends WP_REST_Controller {
 		return in_array( $mime_type, array_keys( self::iframe_archive_accepted_file_mimes() ), true );
 	}
 
+	/**
+	 * Reduce a caller-supplied name to a single safe path segment.
+	 *
+	 * Used for names this plugin generates but builds out of caller-supplied parts, such as
+	 * the destination folder derived from an attachment title.
+	 *
+	 * @param string $segment The name to reduce.
+	 *
+	 * @return string|false The safe segment, or false if nothing usable is left.
+	 */
+	private function sanitize_path_segment( $segment ) {
+		$segment = sanitize_file_name( basename( str_replace( '\\', '/', (string) $segment ) ) );
+
+		if ( '' === $segment || '.' === $segment || '..' === $segment ) {
+			return false;
+		}
+
+		return $segment;
+	}
+
+	/**
+	 * Reduce a caller-supplied relative path to safe segments, keeping subdirectories.
+	 *
+	 * Archive entries may legitimately sit in subdirectories and are referenced by name from
+	 * the archive's own markup, so the segments are checked rather than rewritten: renaming
+	 * them would break those references. Anything that could point outside the destination —
+	 * an upward segment, an absolute path, a drive letter or a null byte — is refused
+	 * outright rather than stripped, since stripping is what makes layered payloads such as
+	 * `....//` work.
+	 *
+	 * @param string $path The relative path to reduce.
+	 *
+	 * @return string|false The safe relative path, or false if it is not usable.
+	 */
+	private function sanitize_relative_path( $path ) {
+		$path = str_replace( '\\', '/', (string) $path );
+
+		if ( '' === $path || false !== strpos( $path, "\0" ) ) {
+			return false;
+		}
+
+		// Absolute paths, including Windows drive letters.
+		if ( '/' === $path[0] || preg_match( '#^[a-zA-Z]:#', $path ) ) {
+			return false;
+		}
+
+		$segments = [];
+		foreach ( explode( '/', $path ) as $segment ) {
+			if ( '' === $segment || '.' === $segment ) {
+				continue;
+			}
+			if ( '..' === $segment ) {
+				return false;
+			}
+			$segments[] = $segment;
+		}
+
+		return empty( $segments ) ? false : implode( '/', $segments );
+	}
+
+	/**
+	 * Confirm that a destination resolves inside a directory.
+	 *
+	 * A last check on the resolved paths, so that a symlink or a gap in the checks above
+	 * still cannot place a file outside the directory. The destination itself need not
+	 * exist yet: the deepest part of it that does exist is what gets resolved, which is
+	 * what lets this run before anything is created.
+	 *
+	 * @param string $directory   Absolute path to the directory the write must stay inside.
+	 * @param string $destination Absolute path to the intended destination.
+	 *
+	 * @return boolean
+	 */
+	private function is_inside_directory( $directory, $destination ) {
+		$directory = realpath( $directory );
+
+		if ( ! $directory ) {
+			return false;
+		}
+
+		$existing = dirname( $destination );
+		while ( ! file_exists( $existing ) && dirname( $existing ) !== $existing ) {
+			$existing = dirname( $existing );
+		}
+
+		$resolved = realpath( $existing );
+
+		if ( ! $resolved ) {
+			return false;
+		}
+
+		return 0 === strpos( trailingslashit( $resolved ), trailingslashit( $directory ) );
+	}
+
 	/**
 	 * Receive the iframe content, handle it, and returns the URL and the folder name.
 	 *
@@ -363,7 +457,11 @@ class WP_REST_Newspack_Iframe_Controller extends WP_REST_Controller {
 	 * @return WP_REST_Response
 	 */
 	private function process_iframe_document( $request, $document_filename, $media_source_path ) {
-		if ( ! $this->validate_file_extension( $document_filename, false ) ) {
+		// The filename is built from the source attachment's title, so it is only a name once
+		// it has been reduced to a single segment.
+		$document_filename = $this->sanitize_path_segment( $document_filename );
+
+		if ( ! $document_filename || ! $this->validate_file_extension( $document_filename, false ) ) {
 			return new WP_Error(
 				'newspack_blocks',
 				sprintf(
@@ -393,6 +491,14 @@ class WP_REST_Newspack_Iframe_Controller extends WP_REST_Controller {
 			}
 		}
 
+		if ( ! $this->is_inside_directory( $iframe_upload_dir, $iframe_path ) ) {
+			return new WP_Error(
+				'newspack_blocks',
+				__( 'Could not upload your document.', 'newspack-blocks' ),
+				[ 'status' => '400' ]
+			);
+		}
+
 		// Copy uploaded document file to destination.
 		if ( copy( $media_source_path, $iframe_path ) ) {
 			return [
@@ -434,14 +540,25 @@ class WP_REST_Newspack_Iframe_Controller extends WP_REST_Controller {
 		}
 		global $wp_filesystem;
 
+		// The folder is built from the source attachment's title, so it is only a name once it
+		// has been reduced to a single segment.
+		$iframe_folder = $this->sanitize_path_segment( $iframe_folder );
+		if ( ! $iframe_folder ) {
+			return $invalid_file_error;
+		}
+
 		$wp_upload_dir     = wp_upload_dir();
 		$iframe_upload_dir = $wp_upload_dir['path'] . self::IFRAME_UPLOAD_DIR;
 		$iframe_path       = trailingslashit( $iframe_upload_dir . $iframe_folder );
 		$data              = $request->get_body_params();
 
-		// create iframe directory if not existing.
-		if ( ! file_exists( $iframe_upload_dir ) ) {
-			wp_mkdir_p( $iframe_upload_dir );
+		// Create this archive's own directory up front, so each entry's destination can be
+		// resolved against it before anything is written.
+		if ( ! file_exists( $iframe_path ) ) {
+			wp_mkdir_p( $iframe_path );
+		}
+		if ( ! $this->is_inside_directory( $iframe_upload_dir, $iframe_path ) ) {
+			return $invalid_file_error;
 		}
 
 		// Extract files from archive.
@@ -464,10 +581,24 @@ class WP_REST_Newspack_Iframe_Controller extends WP_REST_Controller {
 			}
 			$stat = $zip->statIndex( $file_index );
 			if ( $stat && isset( $stat['name'] ) ) {
-				if ( ! file_exists( dirname( $iframe_path . $stat['name'] ) ) ) {
-					wp_mkdir_p( dirname( $iframe_path . $stat['name'] ) );
+				// An entry names its own destination, so it decides where the write lands.
+				$entry_relative_path = $this->sanitize_relative_path( $stat['name'] );
+				if ( ! $entry_relative_path ) {
+					return $invalid_file_error;
+				}
+
+				$destination = $iframe_path . $entry_relative_path;
+
+				// Checked before anything is created, so a destination outside this archive's
+				// own folder never gets a directory made for it.
+				if ( ! $this->is_inside_directory( $iframe_path, $destination ) ) {
+					return $invalid_file_error;
 				}
-				$put = $wp_filesystem->put_contents( $iframe_path . $stat['name'], $contents );
+				if ( ! file_exists( dirname( $destination ) ) ) {
+					wp_mkdir_p( dirname( $destination ) );
+				}
+
+				$put = $wp_filesystem->put_contents( $destination, $contents );
 				if ( ! $put ) {
 					return $invalid_file_error;
 				}

package/src/modal-checkout/templates/thankyou.php

@@ -47,9 +47,22 @@ if ( ! $is_valid ) {
 
 $is_success             = ! $order->has_status( 'failed' );
 $after_success_behavior = isset( $_GET['after_success_behavior'] ) ? \sanitize_text_field( \wp_unslash( $_GET['after_success_behavior'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-$after_success_url      = isset( $_GET['after_success_url'] ) ? esc_url( \sanitize_url( \wp_unslash( $_GET['after_success_url'] ) ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+$after_success_url      = isset( $_GET['after_success_url'] ) ? esc_url( \Newspack_Blocks\Modal_Checkout::sanitize_after_success_url( \sanitize_url( \wp_unslash( $_GET['after_success_url'] ) ) ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 $after_success_label    = isset( $_GET['after_success_button_label'] ) ? \sanitize_text_field( \wp_unslash( $_GET['after_success_button_label'] ) ) : \Newspack_Blocks\Modal_Checkout::get_modal_checkout_labels( 'after_success' ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 $checkout_data          = Checkout_Data::get_checkout_data( $order );
+
+// A behavior the reader can't act on falls back to closing the modal, so they get a
+// finished checkout rather than a button that goes nowhere.
+$after_success_params   = \Newspack_Blocks\Modal_Checkout::filter_after_success_params(
+	[
+		'after_success_behavior'     => $after_success_behavior,
+		'after_success_url'          => $after_success_url,
+		'after_success_button_label' => $after_success_label,
+	]
+);
+$after_success_behavior = $after_success_params['after_success_behavior'] ?? '';
+$after_success_url      = $after_success_params['after_success_url'] ?? '';
+$after_success_label    = $after_success_params['after_success_button_label'] ?? \Newspack_Blocks\Modal_Checkout::get_modal_checkout_labels( 'after_success' );
 ?>
 <div class="woocommerce-order">
 <?php if ( $is_success ) : ?>

package/vendor/composer/installed.php

@@ -3,7 +3,7 @@
         'name' => 'automattic/newspack-blocks',
         'pretty_version' => 'dev-main',
         'version' => 'dev-main',
-        'reference' => 'f937e9f691dbdb938f7478a05bc22d51b771311f',
+        'reference' => '12e6bd898d28eaf4fb6a59633f99b297febc308f',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         'automattic/newspack-blocks' => array(
             'pretty_version' => 'dev-main',
             'version' => 'dev-main',
-            'reference' => 'f937e9f691dbdb938f7478a05bc22d51b771311f',
+            'reference' => '12e6bd898d28eaf4fb6a59633f99b297febc308f',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),