@automattic/newspack-blocks 4.28.1-hotfix-blocks-input-validation.1 → 4.28.1-hotfix-blocks-input-validation.2

package/CHANGELOG.md

@@ -1,12 +1,9 @@
-## @automattic/newspack-blocks [4.28.1-hotfix-blocks-input-validation.1](https://github.com/Automattic/newspack-workspace/compare/newspack-blocks@4.28.0...newspack-blocks@4.28.1-hotfix-blocks-input-validation.1) (2026-07-31)
+## @automattic/newspack-blocks [4.28.1-hotfix-blocks-input-validation.2](https://github.com/Automattic/newspack-workspace/compare/newspack-blocks@4.28.1-hotfix-blocks-input-validation.1...newspack-blocks@4.28.1-hotfix-blocks-input-validation.2) (2026-07-31)
 
 
 ### Bug Fixes
 
-* **blocks:** keep author list and checkout fallbacks intact ([53012be](https://github.com/Automattic/newspack-workspace/commit/53012be987c2001aa8a855dfbf6b857b70c4463b))
-* **blocks:** keep iframe imports inside the uploads directory ([a0118cc](https://github.com/Automattic/newspack-workspace/commit/a0118cc501ca0bfbb851c9e0fdb0f005702b99da))
-* **blocks:** restrict author contact fields to user managers ([c872eb9](https://github.com/Automattic/newspack-workspace/commit/c872eb90589d056a354228adc0a2a65afa6245d3))
-* **blocks:** validate post-checkout redirect destinations ([f418142](https://github.com/Automattic/newspack-workspace/commit/f418142055e14fc6e8fe82726996c7a7028452d5))
+* **blocks:** close after-success dead ends and tighten write checks ([12e6bd8](https://github.com/Automattic/newspack-workspace/commit/12e6bd898d28eaf4fb6a59633f99b297febc308f))
 
 # @automattic/newspack-blocks [4.28.0](https://github.com/Automattic/newspack-workspace/compare/newspack-blocks@4.27.1...newspack-blocks@4.28.0) (2026-07-20)
 

package/includes/class-modal-checkout.php

@@ -1188,27 +1188,80 @@ final class Modal_Checkout {
 		ob_end_flush();
 	}
 
+	/**
+	 * Behaviors that have somewhere to go once checkout finishes.
+	 *
+	 * Anything else leaves the reader in a modal that won't move and won't close, so it is
+	 * treated as "close the modal" instead.
+	 *
+	 * @var string[]
+	 */
+	const AFTER_SUCCESS_BEHAVIORS = [ 'custom', 'referrer' ];
+
 	/**
 	 * Reduce a post-checkout destination to one this site is willing to send readers to.
 	 *
 	 * The destination reaches the thank-you page through the request, whether it came from
 	 * the block's own settings or from the link the reader followed, and by that point the
-	 * two are indistinguishable. Core's redirect validation decides: this site's host is
-	 * always allowed, and a publisher who wants to send readers somewhere else adds that
-	 * host through the standard `allowed_redirect_hosts` filter.
+	 * two are indistinguishable. Core's redirect validation decides, so the destinations
+	 * this site accepts are the ones `allowed_redirect_hosts` reports. That's this site's
+	 * own host, plus whatever a publisher adds through that filter, plus anything another
+	 * plugin has added (`Newspack\NRH` registers one).
 	 *
 	 * @param string $url The requested destination.
 	 *
 	 * @return string The destination, or an empty string if it is not allowed.
 	 */
 	public static function sanitize_after_success_url( $url ) {
+		$url = sanitize_url( (string) $url );
+
 		if ( empty( $url ) ) {
 			return '';
 		}
 
+		// Core compares hosts case-sensitively; host names aren't. Normalise first so this
+		// site's own host typed in capitals isn't read as somewhere else.
+		$host = wp_parse_url( $url, PHP_URL_HOST );
+		if ( $host && strtolower( $host ) !== $host ) {
+			$url = str_replace( '://' . $host, '://' . strtolower( $host ), $url );
+		}
+
 		return (string) wp_validate_redirect( $url, '' );
 	}
 
+	/**
+	 * Drop an after-success behavior the reader can't act on.
+	 *
+	 * A behavior with nowhere to go renders a modal that neither navigates nor closes, so
+	 * the destination, the behavior and its button label all fall away together and the
+	 * reader gets the ordinary "close" button instead of one labelled for a page they
+	 * won't be taken to.
+	 *
+	 * @param array $params After-success params.
+	 *
+	 * @return array The params, less any the reader can't act on.
+	 */
+	public static function filter_after_success_params( $params ) {
+		$behavior = $params['after_success_behavior'] ?? '';
+
+		if ( '' === $behavior ) {
+			return $params;
+		}
+
+		$is_unknown  = ! in_array( $behavior, self::AFTER_SUCCESS_BEHAVIORS, true );
+		$has_nowhere = 'custom' === $behavior && empty( $params['after_success_url'] );
+
+		if ( $is_unknown || $has_nowhere ) {
+			unset(
+				$params['after_success_behavior'],
+				$params['after_success_url'],
+				$params['after_success_button_label']
+			);
+		}
+
+		return $params;
+	}
+
 	/**
 	 * Get after success button params.
 	 */
@@ -1225,19 +1278,13 @@ final class Modal_Checkout {
 		$params = array_filter(
 			[
 				'after_success_behavior'     => isset( $request_params['after_success_behavior'] ) ? sanitize_text_field( wp_unslash( $request_params['after_success_behavior'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-				'after_success_url'          => isset( $request_params['after_success_url'] ) ? self::sanitize_after_success_url( sanitize_url( wp_unslash( $request_params['after_success_url'] ) ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+				'after_success_url'          => isset( $request_params['after_success_url'] ) ? self::sanitize_after_success_url( wp_unslash( $request_params['after_success_url'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 				'after_success_button_label' => isset( $request_params['after_success_button_label'] ) ? sanitize_text_field( wp_unslash( $request_params['after_success_button_label'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 				'action_type'                => isset( $request_params['action_type'] ) ? sanitize_text_field( wp_unslash( $request_params['action_type'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 			]
 		);
 
-		// A custom destination this site won't redirect to falls back to closing the modal, so
-		// the reader gets a finished checkout rather than an empty destination.
-		if ( 'custom' === ( $params['after_success_behavior'] ?? '' ) && empty( $params['after_success_url'] ) ) {
-			unset( $params['after_success_behavior'] );
-		}
-
-		return $params;
+		return self::filter_after_success_params( $params );
 	}
 
 	/**

package/newspack-blocks.php

@@ -7,7 +7,7 @@
  * Author URI:      https://newspack.com/
  * Text Domain:     newspack-blocks
  * Domain Path:     /languages
- * Version:         4.28.1-hotfix-blocks-input-validation.1
+ * Version:         4.28.1-hotfix-blocks-input-validation.2
  *
  * @package         Newspack_Blocks
  */
@@ -15,7 +15,7 @@
 define( 'NEWSPACK_BLOCKS__PLUGIN_FILE', __FILE__ );
 define( 'NEWSPACK_BLOCKS__BLOCKS_DIRECTORY', 'dist/' );
 define( 'NEWSPACK_BLOCKS__PLUGIN_DIR', plugin_dir_path( NEWSPACK_BLOCKS__PLUGIN_FILE ) );
-define( 'NEWSPACK_BLOCKS__VERSION', '4.28.1-hotfix-blocks-input-validation.1' );
+define( 'NEWSPACK_BLOCKS__VERSION', '4.28.1-hotfix-blocks-input-validation.2' );
 
 require_once NEWSPACK_BLOCKS__PLUGIN_DIR . 'includes/class-newspack-blocks.php';
 require_once NEWSPACK_BLOCKS__PLUGIN_DIR . 'includes/class-newspack-blocks-api.php';

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@automattic/newspack-blocks",
-	"version": "4.28.1-hotfix-blocks-input-validation.1",
+	"version": "4.28.1-hotfix-blocks-input-validation.2",
 	"author": "Automattic",
 	"description": "=== Newspack Blocks === Contributors: (this should be a list of wordpress.org userid's) Donate link: https://example.com/ Tags: comments, spam Requires at least: 4.5 Tested up to: 5.1.1 Stable tag: 0.1.0 License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html",
 	"repository": {

package/src/blocks/author-list/view.php

@@ -57,7 +57,7 @@ function newspack_blocks_render_block_author_list( $attributes ) {
 		'author_type'  => $author_type,
 		'author_roles' => $author_roles,
 		'exclude'      => $attributes['exclude'], // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude
-		'fields'       => [ 'id', 'name', 'bio', 'email', 'social', 'avatar', 'url' ],
+		'fields'       => WP_REST_Newspack_Author_List_Controller::DEFAULT_FIELDS,
 	];
 
 	if ( $exclude_empty ) {

package/src/blocks/author-profile/class-wp-rest-newspack-authors-controller.php

@@ -38,6 +38,8 @@ class WP_REST_Newspack_Authors_Controller extends WP_REST_Controller {
 	 * @return boolean
 	 */
 	public static function can_read_user_management_fields() {
+		// Keep `list_users` first: on multisite, core maps `edit_users` through
+		// `manage_network_users`, so a site administrator passes only on `list_users`.
 		return current_user_can( 'list_users' ) || current_user_can( 'edit_users' );
 	}
 

package/src/blocks/iframe/class-wp-rest-newspack-iframe-controller.php

@@ -309,8 +309,10 @@ class WP_REST_Newspack_Iframe_Controller extends WP_REST_Controller {
 	/**
 	 * Confirm that a destination resolves inside a directory.
 	 *
-	 * A last check on the resolved paths, after the destination's parent exists, so that a
-	 * symlink or a gap in the checks above still cannot place a file outside the directory.
+	 * A last check on the resolved paths, so that a symlink or a gap in the checks above
+	 * still cannot place a file outside the directory. The destination itself need not
+	 * exist yet: the deepest part of it that does exist is what gets resolved, which is
+	 * what lets this run before anything is created.
 	 *
 	 * @param string $directory   Absolute path to the directory the write must stay inside.
 	 * @param string $destination Absolute path to the intended destination.
@@ -318,14 +320,24 @@ class WP_REST_Newspack_Iframe_Controller extends WP_REST_Controller {
 	 * @return boolean
 	 */
 	private function is_inside_directory( $directory, $destination ) {
-		$directory   = realpath( $directory );
-		$destination = realpath( dirname( $destination ) );
+		$directory = realpath( $directory );
 
-		if ( ! $directory || ! $destination ) {
+		if ( ! $directory ) {
 			return false;
 		}
 
-		return 0 === strpos( trailingslashit( $destination ), trailingslashit( $directory ) );
+		$existing = dirname( $destination );
+		while ( ! file_exists( $existing ) && dirname( $existing ) !== $existing ) {
+			$existing = dirname( $existing );
+		}
+
+		$resolved = realpath( $existing );
+
+		if ( ! $resolved ) {
+			return false;
+		}
+
+		return 0 === strpos( trailingslashit( $resolved ), trailingslashit( $directory ) );
 	}
 
 	/**
@@ -540,9 +552,13 @@ class WP_REST_Newspack_Iframe_Controller extends WP_REST_Controller {
 		$iframe_path       = trailingslashit( $iframe_upload_dir . $iframe_folder );
 		$data              = $request->get_body_params();
 
-		// create iframe directory if not existing.
-		if ( ! file_exists( $iframe_upload_dir ) ) {
-			wp_mkdir_p( $iframe_upload_dir );
+		// Create this archive's own directory up front, so each entry's destination can be
+		// resolved against it before anything is written.
+		if ( ! file_exists( $iframe_path ) ) {
+			wp_mkdir_p( $iframe_path );
+		}
+		if ( ! $this->is_inside_directory( $iframe_upload_dir, $iframe_path ) ) {
+			return $invalid_file_error;
 		}
 
 		// Extract files from archive.
@@ -572,12 +588,15 @@ class WP_REST_Newspack_Iframe_Controller extends WP_REST_Controller {
 				}
 
 				$destination = $iframe_path . $entry_relative_path;
+
+				// Checked before anything is created, so a destination outside this archive's
+				// own folder never gets a directory made for it.
+				if ( ! $this->is_inside_directory( $iframe_path, $destination ) ) {
+					return $invalid_file_error;
+				}
 				if ( ! file_exists( dirname( $destination ) ) ) {
 					wp_mkdir_p( dirname( $destination ) );
 				}
-				if ( ! $this->is_inside_directory( $iframe_upload_dir, $destination ) ) {
-					return $invalid_file_error;
-				}
 
 				$put = $wp_filesystem->put_contents( $destination, $contents );
 				if ( ! $put ) {

package/src/modal-checkout/templates/thankyou.php

@@ -51,11 +51,18 @@ $after_success_url      = isset( $_GET['after_success_url'] ) ? esc_url( \Newspa
 $after_success_label    = isset( $_GET['after_success_button_label'] ) ? \sanitize_text_field( \wp_unslash( $_GET['after_success_button_label'] ) ) : \Newspack_Blocks\Modal_Checkout::get_modal_checkout_labels( 'after_success' ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 $checkout_data          = Checkout_Data::get_checkout_data( $order );
 
-// A custom destination this site won't redirect to falls back to closing the modal, so the
-// reader gets a finished checkout rather than an empty destination.
-if ( 'custom' === $after_success_behavior && empty( $after_success_url ) ) {
-	$after_success_behavior = '';
-}
+// A behavior the reader can't act on falls back to closing the modal, so they get a
+// finished checkout rather than a button that goes nowhere.
+$after_success_params   = \Newspack_Blocks\Modal_Checkout::filter_after_success_params(
+	[
+		'after_success_behavior'     => $after_success_behavior,
+		'after_success_url'          => $after_success_url,
+		'after_success_button_label' => $after_success_label,
+	]
+);
+$after_success_behavior = $after_success_params['after_success_behavior'] ?? '';
+$after_success_url      = $after_success_params['after_success_url'] ?? '';
+$after_success_label    = $after_success_params['after_success_button_label'] ?? \Newspack_Blocks\Modal_Checkout::get_modal_checkout_labels( 'after_success' );
 ?>
 <div class="woocommerce-order">
 <?php if ( $is_success ) : ?>

package/vendor/composer/installed.php

@@ -3,7 +3,7 @@
         'name' => 'automattic/newspack-blocks',
         'pretty_version' => 'dev-main',
         'version' => 'dev-main',
-        'reference' => '53012be987c2001aa8a855dfbf6b857b70c4463b',
+        'reference' => '12e6bd898d28eaf4fb6a59633f99b297febc308f',
         'type' => 'wordpress-plugin',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         'automattic/newspack-blocks' => array(
             'pretty_version' => 'dev-main',
             'version' => 'dev-main',
-            'reference' => '53012be987c2001aa8a855dfbf6b857b70c4463b',
+            'reference' => '12e6bd898d28eaf4fb6a59633f99b297febc308f',
             'type' => 'wordpress-plugin',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),