Skip to content

v2.4.0 — WP.org compliance pass: URL/SSRF hardening + opt-in debug logging

Choose a tag to compare

View all tags
@dukenukemall dukenukemall released this 15 May 11:58
· 8 commits to main since this release
v2.4.0
41d18e4

Fungies for WooCommerce 2.4.0

WP.org compliance pass — security hardening, opt-in debug logging, i18n cleanup, and readme polish ahead of submission.

Install

Download fungies-checkout-2.4.0.zip below and upload via WordPress Admin → Plugins → Add New → Upload Plugin. WordPress will detect the existing 2.3.x install and prompt to replace it.

🔒 Security

  • Fungies Store URL field is now an HTML5 url-typed input that saves through WC's esc_url_raw sanitizer. The runtime read site additionally re-validates with esc_url_raw + wp_http_validate_url and rejects any scheme other than http/https before building a customer redirect — closing a potential javascript:/file:// redirect-injection vector.
  • HTTPS host allowlist (fungies.io, fungies.net) now gates media_sideload_image calls before fetching product images, mitigating SSRF risk from third-party image URLs. Extensible via the new fungies_image_host_allowlist filter; uses a dot-boundary suffix check so evilfungies.io cannot impersonate fungies.io.
  • Webhook REST route carries an inline rationale documenting the HMAC-SHA256 signature verification, timing-safe hash_equals comparison, missing-secret rejection, and idempotency-key replay protection that act as the real auth gate. No behaviour change — guards future "tighten security" refactors that would break the integration.

🔕 Privacy

  • New "Debug Logging" admin toggle at WooCommerce → Settings → Fungies gates verbose API request/response dumps in the wc-logs fungies source. Errors and warnings still log unconditionally so genuine failures remain diagnosable; verbose dumps are off by default.
  • The previous always-on "Detailed Logging" feature description in readme.txt is replaced with an opt-in worded description that signals deliberate behaviour to WP.org reviewers.

🌐 i18n

  • Wrapped two previously-untranslated admin AJAX error strings in __() with translator comments and numbered placeholders (%1$s / %2$s) per WP coding standards.

🧹 Cleanup

  • Removed console.log / console.error calls from front-end Blocks checkout JS so the customer's browser console stays clean.
  • Removed obsolete Donate link: https://fungies.io from readme (homepage donate links trigger spam suspicion in WP.org review).
  • Removed == Screenshots == section from readme (no screenshot assets are shipped — referencing nonexistent screenshots would render broken image tiles on the WP.org plugin page).

📦 Docs / packaging

  • Older changelog entries (2.1.x, 2.0.x, 1.x) moved to a new changelog.txt per the WP.org FAQ guidance to keep readme.txt trimmed to the current major plus one back.
  • .gitattributes now export-ignores README.md, build.ps1, and fungies-*.zip so the shipped plugin zip contains only runtime files.

Upgrade notes

  • After updating, verify the new "Debug Logging" checkbox is off if you weren't already inspecting wc-logs.
  • If you serve product images from a custom domain (not *.fungies.io or *.fungies.net), add it to the allowlist:
add_filter( 'fungies_image_host_allowlist', function ( $hosts ) {
    $hosts[] = 'cdn.your-domain.com';
    return $hosts;
} );
  • If your existing Fungies Store URL value is malformed (no scheme, etc.), the plugin will now refuse to redirect and log a warning. Fix the URL in WooCommerce → Settings → Fungies.

Diff summary

10 files changed, 284 insertions(+), 147 deletions(-).

Full Changelog: v2.3.1...v2.4.0

Assets 3
Loading