Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-1472: UnusedCSS_Admin.php in unusedcss/tags/1.7.1/includes/modules/unused-css – WordPress Plugin Repository

The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Actions include resetting the API key, accessing or deleting log files, and deleting cache among others.

CVE
#google#js#java#wordpress#php#auth

1<?php23defined( ‘ABSPATH’ ) or die();45/**6 * Class UnusedCSS7 */8abstract class UnusedCSS_Admin {910 use RapidLoad_Utils;1112 /**13 * @var UnusedCSS_Autoptimize14 */15 public $uucss;1617 /**18 * @var bool19 */20 public static $enabled = true;2122 /**23 * Page related meta options24 * @var array25 */26 public static $page_options = [27 'safelist’,28 'exclude’,29 'blocklist’30 ];3132 /**33 * UnusedCSS constructor.34 * @param UnusedCSS $uucss35 */36 public function __construct($uucss)37 {3839 $this->uucss = $uucss;4041 if(is_admin()){4243 add_action( 'admin_menu’, array( $this, ‘add_uucss_option_page’ ) );4445 }464748 if (!self::$enabled) {49 return;50 }5152 add_action( 'current_screen’, function () {5354 if ( get_current_screen() && get_current_screen()->base == ‘settings_page_uucss’ ) {55 add_action( 'admin_enqueue_scripts’, [ $this, ‘enqueueScripts’ ] );56 }57 } );5859 $this->cache_trigger_hooks();6061 add_action( 'add_meta_boxes’, [$this, ‘add_meta_boxes’] );62 add_action( 'save_post’, [$this, ‘save_meta_box_options’] , 10, 2);63 add_action( "uucss_run_gpsi_test_for_all", [ $this, ‘run_gpsi_test_for_all’ ]);6465 add_filter( ‘plugin_action_links_’ . plugin_basename( UUCSS_PLUGIN_FILE ), [66 $this,67 'add_plugin_action_link’68 ] );6970 if(is_admin()){7172 $this->deactivate();7374 add_action('current_screen’, [$this, ‘validate_domain’]);75 add_action('wp_ajax_clear_page_cache’, [$this, ‘clear_page_cache’]);76 add_action('wp_ajax_mark_faqs_read’, [$this, ‘mark_faqs_read’]);77 add_action('wp_ajax_mark_notice_read’, [$this, ‘mark_notice_read’]);78 add_action('wp_ajax_frontend_logs’, [$this, ‘frontend_logs’]);79 add_action('wp_ajax_uucss_logs’, [$this, ‘uucss_logs’]);80 add_action('wp_ajax_clear_uucss_logs’, [$this, ‘clear_uucss_logs’]);81 add_action( "wp_ajax_uucss_test_url", [ $this, ‘uucss_test_url’ ] );82 add_action( "wp_ajax_uucss_run_gpsi_status_check_for_all", [ $this, ‘run_gpsi_status_check_for_all’ ] );83 add_action( "wp_ajax_uucss_data", [ $this, ‘uucss_data’ ] );84 add_action( "wp_ajax_uucss_license", [ $this, ‘uucss_license’ ] );85 add_action( "wp_ajax_uucss_status", [ $this, ‘uucss_status’ ] );86 add_action( "wp_ajax_uucss_rule_stats", [ $this, ‘uucss_rule_stats’ ] );87 add_action( "wp_ajax_suggest_whitelist_packs", [ $this, ‘suggest_whitelist_packs’ ] );88 add_action( "wp_ajax_verify_api_key", [ $this, ‘verify_api_key’ ] );89 add_action( "wp_ajax_uucss_deactivate", [ $this, ‘ajax_deactivate’ ] );90 add_action( "wp_ajax_uucss_connect", [ $this, ‘uucss_connect’ ] );91 add_action( "wp_ajax_attach_rule", [ $this, ‘attach_rule’ ] );92 add_action( "wp_ajax_uucss_update_rule", [ $this, ‘uucss_update_rule’ ] );93 add_action( 'wp_ajax_uucss_queue’, [$this, ‘queue_posts’]);94 add_action( 'wp_ajax_rapidload_notifications’, [$this, ‘rapidload_notifications’]);95 add_action( 'admin_notices’, [ $this, ‘first_uucss_job’ ] );96 add_action( 'updated_option’, [ $this, ‘clear_cache_on_option_update’ ], 10, 3 );97 }9899 add_action( 'uucss_sitemap_queue’, [$this, ‘queue_sitemap’], 10, 1);100101 }102103 function rapidload_notifications(){104105 wp_send_json_success([106 ‘faqs’ => $this->get_faqs(),107 ‘notifications’ => $this->get_public_notices()108 ]);109110 }111112 function queue_posts(){113114 if(!isset($_REQUEST[‘post_type’])) {115 wp_send_json_error(‘post type not found’);116 }117118 $type = isset($_REQUEST[‘type’]) ? $_REQUEST[‘type’] : 'path’;119 $rule = isset($_REQUEST[‘rule’]) ? $_REQUEST[‘rule’] : false;120 $regex = isset($_REQUEST[‘regex’]) ? $_REQUEST[‘regex’] : false;121122 $post_type = sanitize_text_field($_REQUEST[‘post_type’]);123124 $list = isset($_POST[‘url_list’]) ? $_POST[‘url_list’] : null;125126 $posts = null;127128 global $uucss;129130 if(isset($list) && is_array($list) && !empty($list)){131132 if($type == ‘path’){133 UnusedCSS_DB::requeue_urls($list);134 }else{135 UnusedCSS_DB::requeue_rules($list);136 }137138 $this->uucss->cleanCacheFiles();139140 wp_send_json_success(‘successfully links added to the queue’);141 }else if($post_type == ‘current’){142143 if($type == ‘path’){144 RapidLoad_Settings::clear_links(true);145 }else{146 UnusedCSS_DB::clear_rules(true);147 }148149 $this->uucss->cleanCacheFiles();150151 wp_send_json_success(‘successfully links added to the queue’);152153 }else if($post_type == ‘processing’){154155 if($type == ‘path’){156 UnusedCSS_DB::requeue_jobs(‘processing’);157 UnusedCSS_DB::requeue_jobs(‘waiting’);158 }else{159 UnusedCSS_DB::requeue_rule_jobs(‘processing’);160 UnusedCSS_DB::requeue_rule_jobs(‘waiting’);161 }162163 $this->uucss->cleanCacheFiles();164165 wp_send_json_success(‘successfully links added to the queue’);166167 }else if($post_type == ‘warnings’){168169 if($type == ‘path’){170 UnusedCSS_DB::requeue_jobs(‘warnings’);171 }else{172 UnusedCSS_DB::requeue_rule_jobs(‘warnings’);173 }174175 $this->uucss->cleanCacheFiles();176177 wp_send_json_success(‘successfully links added to the queue’);178179 }else if($post_type == ‘failed’){180181 if($type == ‘path’){182 UnusedCSS_DB::requeue_jobs();183 }else{184 UnusedCSS_DB::requeue_rule_jobs();185 }186187 $this->uucss->cleanCacheFiles();188189 wp_send_json_success(‘successfully links added to the queue’);190191 }else if($post_type == ‘url’){192193 $url = isset($_REQUEST[‘url’]) ? $_REQUEST[‘url’] : false;194195 if($url && !$this->is_url_allowed($url)){196 wp_send_json_error(‘url is excluded’);197 }198199 $url_object = false;200201 if($type == ‘path’){202203 $url_object = new UnusedCSS_Path([204 ‘url’ => $url205 ]);206207 }else{208209 $url_object = new UnusedCSS_Rule([210 ‘rule’ => $rule,211 ‘regex’ => $regex212 ]);213214 }215216 if(!$url_object){217218 wp_send_json_error(‘Invalid URL’);219220 }221222 $url_object->requeue();223 $url_object->save();224225 wp_send_json_success(‘successfully link added to the queue’);226227 }else if($post_type == ‘site_map’){228229 $sitemap = isset($_REQUEST[‘url’]) ? $_REQUEST[‘url’] : false;230231 if(!$sitemap){232233 wp_send_json_error(‘site map url required’);234 }235236 $spawned = $this->schedule_cron('uucss_sitemap_queue’,[237 ‘url’ => $sitemap238 ]);239240 wp_send_json_success(‘Sitemap links scheduled to be added to the queue.’);241242 }else{243244 $posts = new WP_Query(array(245 'post_type’=> $post_type,246 ‘posts_per_page’ => -1247 ));248249 }250251 if($posts && $posts->have_posts()){252 while ($posts->have_posts()){253 $posts->the_post();254255 $url = $this->transform_url(get_the_permalink(get_the_ID()));256257 if($this->is_url_allowed($url)){258 new UnusedCSS_Path([259 ‘url’ => $url260 ]);261 }262263 }264 }265266 wp_reset_query();267268 wp_send_json_success(‘successfully links added to the queue’);269270 }271272 function queue_sitemap($url = false){273274 if(!$url){275276 $url = apply_filters('uucss/sitemap/default’, stripslashes(get_site_url(get_current_blog_id())) . ‘/sitemap_index.xml’);277 }278279 $site_map = new RapidLoad_Sitemap();280 $urls = $site_map->process_site_map($url);281282 global $uucss;283284 if(isset($urls) && !empty($urls)){285286 foreach ($urls as $url){287288 if($this->is_url_allowed($this->transform_url($url))){289290 new UnusedCSS_Path([291 ‘url’ => $url292 ]);293 }294295 }296 }297 }298299 public function add_uucss_option_page() {300301 add_submenu_page( 'options-general.php’, 'RapidLoad’, 'RapidLoad’, 'manage_options’, 'uucss’, function () {302 wp_enqueue_script( ‘post’ );303304 ?>305 <div class="wrap">306 <h1><?php _e( 'RapidLoad Settings’, ‘autoptimize’ ); ?></h1>307 <?php308 do_action(‘uucss/options/before_render_form’);309 ?>310 <div>311 <?php $this->render_form() ?>312 </div>313 </div>314315 <?php316 });317318 register_setting('autoptimize_uucss_settings’, ‘autoptimize_uucss_settings’);319320 }321322 public function render_form() {323 $options = RapidLoad_Base::fetch_options();324325 include(‘parts/options-page.html.php’);326 }327328 public function uucss_rule_stats(){329330 wp_send_json_success([331 ‘duplicateFiles’ => UnusedCSS_DB::get_duplicate_files()332 ]);333334 }335336 public function uucss_status(){337338 $job_counts = UnusedCSS_DB::get_job_counts();339340 wp_send_json_success([341 ‘cssStyleSheetsCount’ => $this->uucss->cache_file_count(),342 ‘cssStyleSheetsSize’ => $this->uucss->size(),343 ‘hits’ => $job_counts->hits,344 ‘success’ => $job_counts->success,345 ‘ruleBased’ => $job_counts->rule_based,346 ‘queued’ => $job_counts->queued,347 ‘waiting’ => $job_counts->waiting,348 ‘processing’ => $job_counts->processing,349 ‘warnings’ => $job_counts->warnings,350 ‘failed’ => $job_counts->failed,351 ‘total’ => $job_counts->total,352 ]);353 }354355 public function uucss_update_rule(){356357 if( !isset($_REQUEST[‘rule’]) || empty($_REQUEST[‘rule’]) ||358 !isset($_REQUEST[‘url’]) || empty($_REQUEST[‘url’])359 ){360 wp_send_json_error(‘Required fields missing’);361 }362363 $rule = $_REQUEST[‘rule’];364 $url = $_REQUEST[‘url’];365 $regex = isset($_REQUEST[‘regex’]) ? $_REQUEST[‘regex’] : '/’;366367 $url = $this->transform_url($url);368369 global $uucss;370371 if(!$this->is_url_allowed($url)){372 wp_send_json_error(‘URL not allowed’);373 }374375 if(!self::is_url_glob_matched($url, $regex)){376 wp_send_json_error(‘Invalid regex for the url’);377 }378379 $ruleObject = false;380 $update_mode = 'create’;381382 if(isset($_REQUEST[‘old_rule’]) && isset($_REQUEST[‘old_regex’])){383384 $old_rule = $_REQUEST[‘old_rule’];385 $old_regex = $_REQUEST[‘old_regex’];386 $old_url = $_REQUEST[‘old_url’];387388 if(UnusedCSS_DB::rule_exists_with_error( $old_rule, $old_regex)){389390 $ruleObject = new UnusedCSS_Rule([391 ‘rule’ => $old_rule,392 ‘regex’ => $old_regex393 ]);394395 if(isset($_REQUEST[‘old_url’]) && $_REQUEST[‘old_url’] != $url ||396 $_REQUEST[‘old_rule’] != $rule || $_REQUEST[‘old_regex’] != $regex){397 if(isset($_REQUEST[‘requeue’]) && $_REQUEST[‘requeue’] == “1”){398 error_log($_REQUEST[‘requeue’]);399 $ruleObject->requeue();400 $ruleObject->releaseRule();401 }402 }403404 $ruleObject->url = $url;405 $ruleObject->rule = $rule;406 $ruleObject->regex = $regex;407 $ruleObject->save();408 $update_mode = 'update’;409410411412 do_action('uucss/rule/saved’, $ruleObject, [413 ‘rule’ => $old_rule,414 ‘regex’ => $old_regex,415 ‘url’ => $old_url416 ]);417418 wp_send_json_success(‘Rule updated successfully’);419 }420421 }422423 if(UnusedCSS_DB::rule_exists_with_error($_REQUEST[‘rule’], $_REQUEST[‘regex’])){424 wp_send_json_error(‘Rule already exist’);425 }426427 $ruleObject = new UnusedCSS_Rule([428 ‘rule’ => $rule,429 ‘url’ => $url,430 ‘regex’ => $regex,431 ]);432433 do_action('uucss/rule/saved’, $ruleObject, false);434435 wp_send_json_success(‘Rule updated successfully’);436 }437438 public function attach_rule(){439440 $type = isset($_REQUEST[‘type’]) ? $_REQUEST[‘type’] : false;441 $url = isset($_REQUEST[‘url’]) ? $_REQUEST[‘url’] : false;442 $rule_id = isset($_REQUEST[‘rule_id’]) ? $_REQUEST[‘rule_id’] : false;443444 if(!$type || !$url){445 wp_send_json_error(‘Required field missing’);446 }447448 if($type == ‘detach’ && UnusedCSS_DB::rule_exist_by_url($url)){449 wp_send_json_error(‘Rule exist with same url’);450 }451452 if($type == ‘detach’ && UnusedCSS_DB::link_exists_with_error($url)){453454 $path = new UnusedCSS_Path([455 ‘url’ => $url456 ]);457 $path->attach_rule();458 $path->save();459 wp_send_json_success(‘Successfully detached from rule’);460 }461462 if(!is_numeric($rule_id) || !$type || $type == ‘attach’ && !$rule_id){463 wp_send_json_error(‘Required field missing’);464 }465466 if($type == ‘attach’){467468 $rule = UnusedCSS_Rule::get_rule_from_id($rule_id);469470 if(!$rule){471 wp_send_json_error(‘Rule not found’);472 }473474 $path = new UnusedCSS_Path([475 ‘url’ => $url476 ]);477478 if(!self::is_url_glob_matched($url, $rule->regex)){479 wp_send_json_success(‘Pattern not matched’);480 }481482 $path->attach_rule($rule->id, $rule->rule);483 $path->save();484 wp_send_json_success(‘Successfully attached to rule’);485 }486487 }488489 public static function is_domain_verified(){490 $options = self::get_site_option( ‘autoptimize_uucss_settings’ );491 return $options[‘valid_domain’];492 }493494 public function clear_cache_on_option_update( $option, $old_value, $value ) {495496 if ( $option == ‘autoptimize_uucss_settings’ && $this->uucss ) {497498 $needs_to_cleared = false;499500 $diffs = [];501 $diffs_invert = [];502503 if ( $old_value && $value ) {504 $diffs = array_diff_key( $old_value, $value );505 $diffs_invert = array_diff_key( $value, $old_value );506 }507508 if ( isset( $diffs_invert[‘valid_domain’] ) ) {509 unset( $diffs_invert[‘valid_domain’] );510 }511 if ( isset( $diffs[‘valid_domain’] ) ) {512 unset( $diffs[‘valid_domain’] );513 }514515 $diffs = array_merge( $diffs, $diffs_invert );516517 // if these settings are changed cache will be cleared518 if ( isset( $diffs[‘uucss_minify’] ) ||519 isset( $diffs[‘uucss_keyframes’] ) ||520 isset( $diffs[‘uucss_fontface’] ) ||521 isset( $diffs[‘uucss_analyze_javascript’] ) ||522 isset( $diffs[‘uucss_safelist’] ) ||523 isset( $diffs[‘whitelist_packs’] ) ||524 isset( $diffs[‘uucss_blocklist’] ) ||525 isset( $diffs[‘uucss_variables’] ) ) {526 $needs_to_cleared = true;527 }528529 foreach ( [ 'whitelist_packs’, 'uucss_safelist’, ‘uucss_blocklist’ ] as $compare_value ) {530 if ( isset( $value[ $compare_value ] ) && isset( $old_value[ $compare_value ] ) && $old_value[ $compare_value ] !== $value[ $compare_value ] ) {531 $needs_to_cleared = true;532 break;533 }534 }535536 if(isset( $diffs[‘uucss_enable_rules’] )){537 UnusedCSS_DB::detach_all_rules();538 }539540 if ( $needs_to_cleared ) {541542 $this->uucss->clear_cache( null, [543 ‘soft’ => true544 ] );545 }546547 RapidLoad_Base::fetch_options(false);548 }549550 }551552 public function deactivate() {553554 if ( ! isset( $_REQUEST[‘deactivated’] ) || empty( $_REQUEST[‘deactivated’] ) ) {555 return;556 }557558 if ( ! isset( $_REQUEST[‘nonce’] ) || ! wp_verify_nonce( $_REQUEST[‘nonce’], ‘uucss_activation’ ) ) {559 self::add_admin_notice( 'RapidLoad : Request verification failed for Activation. Contact support if the problem persists.’, ‘error’ );560561 return;562 }563564 $options = self::get_site_option( ‘autoptimize_uucss_settings’ );565566 unset( $options[‘uucss_api_key_verified’] );567 unset( $options[‘uucss_api_key’] );568 unset( $options[‘whitelist_packs’] );569570 self::update_site_option( 'autoptimize_uucss_settings’, $options );571572 $cache_key = 'pand-' . md5( ‘first-uucss-job’ );573 self::delete_site_option( $cache_key );574575 $this->uucss->vanish();576577 self::$deactivating = true;578579 $notice = [580 ‘action’ => 'activate’,581 ‘message’ => 'RapidLoad : Deactivated your license for this site.’,582 ‘main_action’ => [583 ‘key’ => 'Reactivate’,584 ‘value’ => self::activation_url( ‘authorize’ )585 ],586 ‘type’ => ‘success’587 ];588 self::add_advanced_admin_notice( $notice );589590 return;591 }592593 public function first_uucss_job() {594595 if ( class_exists(‘PAnD’) && ! PAnD::is_admin_notice_active( ‘first-uucss-job-forever’ ) ) {596 return;597 }598599 if(get_current_screen() && get_current_screen()->base == ‘settings_page_uucss’){600 return;601 }602603 $job = RapidLoad_Settings::get_first_link();604605 if ( $job && $job[‘status’] == ‘success’ ) : ?>606 <div data-dismissible="first-uucss-job-forever"607 class="updated notice uucss-notice notice-success is-dismissible">608 <h4><span class="dashicons dashicons-yes-alt"></span> RapidLoad successfully ran your first job!</h4>609 <p><?php _e( ‘You slashed <strong>’ . $job[‘meta’][‘stats’]->reductionSize . ' </strong> of unused CSS - that\’s <strong>’ . $job[‘meta’][‘stats’]->reduction . '% </strong> of your total CSS file size. Way to go 👏’, ‘sample-text-domain’ ); ?></p>610 </div>611 <?php endif;612613 if ( $job && $job[‘status’] == ‘failed’ ) : ?>614 <div data-dismissible="first-uucss-job-forever"615 class="error notice uucss-notice notice-error is-dismissible">616 <h4><span class="dashicons dashicons-no-alt"></span> RapidLoad : We were unable to remove unused css617 from618 your site 🤕</h4>619620 <div>621 <p> Our team can help. Get in touch with support <a target="_blank"622 href="https://rapidload.zendesk.com/hc/en-us/requests/new">here</a>623 </p>624 <blockquote class="error notice">625 <strong>Link :</strong> <?php echo $job[‘url’] ?> <br>626 <strong>Error :</strong> <?php echo $job[‘meta’][‘error’][‘code’] ?> <br>627 <strong>Message :</strong> <?php echo $job[‘meta’][‘error’][‘message’] ?>628 </blockquote>629 </div>630631 </div>632 <?php endif;633 }634635 public function uucss_connect(){636637 if ( ! isset( $_REQUEST[‘license_key’] ) || empty( $_REQUEST[‘license_key’] ) ) {638 wp_send_json_error( ‘License Key required’ );639 }640641 $license_key = $_REQUEST[‘license_key’];642643 $uucss_api = new RapidLoad_Api();644 $uucss_api->apiKey = $license_key;645 $results = $uucss_api->post( 'connect’, [ ‘url’ => $this->transform_url(get_site_url()), ‘type’ => ‘wordpress’ ] );646647 if ( $uucss_api->is_error( $results ) ) {648 if(isset($results->errors) && isset($results->errors[0])){649 wp_send_json_error($results->errors[0]->detail);650 }else{651 wp_send_json_error(‘License Key verification fail’);652 }653 }654655 wp_send_json_success([656 ‘success’ => true,657 ‘message’ => 'License Key verification success’,658 ‘activation_nonce’ => wp_create_nonce( ‘uucss_activation’ ),659 ]);660 }661662 public function ajax_deactivate() {663664 $options = self::get_site_option( ‘autoptimize_uucss_settings’ );665666 $cache_key = 'pand-' . md5( ‘first-uucss-job’ );667 self::delete_site_option( $cache_key );668669 $this->uucss->vanish();670671 $api = new RapidLoad_Api();672673 // remove domain from authorized list674 $api->post( 'deactivate’, [675 ‘url’ => site_url()676 ] );677678 unset( $options[‘uucss_api_key_verified’] );679 unset( $options[‘uucss_api_key’] );680 unset( $options[‘whitelist_packs’] );681682 self::update_site_option( 'autoptimize_uucss_settings’, $options );683684 wp_send_json_success( true );685 }686687 public function validate_domain() {688689 if ( get_current_screen() && get_current_screen()->base != ‘settings_page_uucss’ ) {690 return;691 }692693 $options = self::get_site_option( ‘autoptimize_uucss_settings’ );694695 if(!isset( $options[‘uucss_api_key_verified’] ) || $options[‘uucss_api_key_verified’] != ‘1’){696 return;697 }698699 $uucss_api = new RapidLoad_Api();700701 if ( ! isset( $options[‘uucss_api_key’] ) ) {702 return;703 }704705 $results = $uucss_api->get( 'verify’, [ ‘url’ => site_url(), ‘token’ => $options[‘uucss_api_key’] ] );706707 if($uucss_api->is_error($results)){708 $options[‘valid_domain’] = false;709 self::update_site_option('autoptimize_uucss_settings’, $options);710 return;711 }712713 if(!isset($options[‘valid_domain’]) || !$options[‘valid_domain’]){714 $options[‘valid_domain’] = true;715 self::update_site_option('autoptimize_uucss_settings’, $options);716 }717 }718719 public function uucss_data() {720721 if ( ! isset( $_REQUEST[‘nonce’] ) || ! wp_verify_nonce( $_REQUEST[‘nonce’], ‘uucss_nonce’ ) ) {722 wp_send_json_error( ‘UnusedCSS - Malformed Request Detected, Contact Support.’ );723 }724725 $type = isset($_REQUEST[‘type’]) ? $_REQUEST[‘type’] : 'path’;726727 $start = isset($_REQUEST[‘start’]) ? $_REQUEST[‘start’] : 0;728 $length = isset($_REQUEST[‘length’]) ? $_REQUEST[‘length’] : 10;729 $draw = isset($_REQUEST[‘draw’]) ? $_REQUEST[‘draw’] : 1;730731 $status_filter = isset($_REQUEST[‘columns’]) &&732 isset($_REQUEST[‘columns’][0]) &&733 isset($_REQUEST[‘columns’][0][‘search’]) &&734 isset($_REQUEST[‘columns’][0][‘search’][‘value’]) ?735 $_REQUEST[‘columns’][0][‘search’][‘value’] : false;736737 $filters = [];738739 if($status_filter){740741 if($status_filter == ‘warning’){742743 $filters[] = " warnings IS NOT NULL ";744 }else{745746 $filters[] = " status = ‘". $status_filter . "’ AND warnings IS NULL ";747 }748749 }else{750751 $filters[] = " status != ‘rule-based’ ";752753 }754755 $url_filter = isset($_REQUEST[‘columns’]) &&756 isset($_REQUEST[‘columns’][1]) &&757 isset($_REQUEST[‘columns’][1][‘search’]) &&758 isset($_REQUEST[‘columns’][1][‘search’][‘value’]) ?759 $_REQUEST[‘columns’][1][‘search’][‘value’] : false;760761 $url_regex = isset($_REQUEST[‘columns’]) &&762 isset($_REQUEST[‘columns’][1]) &&763 isset($_REQUEST[‘columns’][1][‘search’]) &&764 isset($_REQUEST[‘columns’][1][‘search’][‘regex’]) ?765 $_REQUEST[‘columns’][1][‘search’][‘regex’] : false;766767 if($url_regex == ‘true’ && $url_filter){768769 $filters[] = " url = ‘". $url_filter . "’ ";770771 }772773 if($url_regex == ‘false’ && $url_filter){774775 $filters[] = " url LIKE ‘%". $url_filter . "%’ ";776777 }778779 $where_clause = '’;780781 foreach ($filters as $key => $filter){782783 if($key == 0){784785 $where_clause = ' WHERE ';786 $where_clause .= $filter;787 }else{788789 $where_clause .= ' AND ';790 $where_clause .= $filter;791 }792793 }794795 $data = $type == ‘path’ ?796 UnusedCSS_DB::get_links($start, $length, $where_clause):797 UnusedCSS_DB::get_rules($start, $length, $where_clause);798799 wp_send_json([800 ‘data’ => $data,801 “draw” => (int)$draw,802 “recordsTotal” => $type == ‘path’ ? UnusedCSS_DB::get_total_job_count() : UnusedCSS_DB::get_total_rule_count(),803 “recordsFiltered” => $type == ‘path’ ? UnusedCSS_DB::get_total_job_count($where_clause) : UnusedCSS_DB::get_total_rule_count($where_clause),804 “success” => true805 ]);806 }807808 public function enqueueScripts() {809810 $deregister_scripts = apply_filters('uucss/scripts/deregister’, [‘select2’]);811812 if(isset($deregister_scripts) && is_array($deregister_scripts)){813 foreach ($deregister_scripts as $deregister_script){814 wp_dequeue_script($deregister_script);815 wp_deregister_script($deregister_script);816 }817 }818819 wp_enqueue_script( 'select2’, UUCSS_PLUGIN_URL . 'assets/libs/select2/select2.min.js’, array( ‘jquery’ ) );820821 wp_enqueue_script( 'datatables’, UUCSS_PLUGIN_URL . 'assets/libs/datatables/jquery.dataTables.min.js’, array(822 'jquery’,823 'uucss_admin’824 ) );825 wp_enqueue_style( 'datatables’, UUCSS_PLUGIN_URL . ‘assets/libs/datatables/jquery.dataTables.min.css’ );826827 wp_register_script( 'uucss_admin’, UUCSS_PLUGIN_URL . 'assets/js/uucss_admin.js’, array(828 'jquery’,829 'wp-util’830 ), UUCSS_VERSION );831832 wp_register_script( 'uucss_log’, UUCSS_PLUGIN_URL . 'assets/js/uucss_log.js’, array(833 'jquery’,834 'wp-util’835 ), UUCSS_VERSION );836837 $deregister_styles = apply_filters('uucss/styles/deregister’,[]);838839 if(isset($deregister_styles) && is_array($deregister_styles)){840 foreach ($deregister_styles as $deregister_style){841 wp_dequeue_style($deregister_style);842 }843 }844845 wp_enqueue_style( 'uucss_admin’, UUCSS_PLUGIN_URL . 'assets/css/uucss_admin.css’, [], UUCSS_VERSION );846847 global $rapidload;848849 $data = array(850 ‘api’ => RapidLoad_Api::get_key(),851 ‘nonce’ => wp_create_nonce( ‘uucss_nonce’ ),852 ‘url’ => site_url(),853 ‘ajax_url’ => admin_url( ‘admin-ajax.php’ ),854 ‘setting_url’ => admin_url( ‘options-general.php?page=uucss’ ),855 ‘on_board_complete’ => apply_filters('uucss/on-board/complete’, false),856 ‘api_key_verified’ => self::is_api_key_verified(),857 ‘notifications’ => $this->getNotifications(),858 ‘faqs’ => [],859 ‘public_notices’ => [],860 ‘dev_mode’ => apply_filters('uucss/dev_mode’, isset($this->uucss->options[‘uucss_dev_mode’])) && $this->uucss->options[‘uucss_dev_mode’] == "1",861 ‘rules_enabled’ => $rapidload->rules_enabled(),862 ‘cpcss_enabled’ => $rapidload->critical_css_enabled(),863 ‘home_url’ => home_url(),864 ‘uucss_enable_debug’ => ! empty( $this->uucss->options[‘uucss_enable_debug’] ) && ‘1’ === $this->uucss->options[‘uucss_enable_debug’],865 );866867 wp_localize_script( 'uucss_admin’, 'uucss’, $data );868869 wp_enqueue_script( ‘uucss_admin’ );870 wp_enqueue_script( ‘uucss_log’ );871872 wp_enqueue_style( 'select2’, UUCSS_PLUGIN_URL . ‘assets/libs/select2/select2.min.css’ );873874 }875876 public function getNotifications() {877878 return apply_filters('uucss/notifications’, []);879 }880881 public function run_gpsi_test_for_all(){882883 $links = UnusedCSS_DB::get_links_where(" WHERE status IN(‘success’,’rule-based’) ");884885 if(!empty($links)){886887 foreach ($links as $link){888889 if(isset($link[‘meta’]) &&890 isset($link[‘meta’][‘stats’]) &&891 isset($link[‘meta’][‘stats’]->success_count) &&892 $link[‘meta’][‘stats’]->success_count > 0 ||893 isset($link[‘success_count’]) && $link[‘success_count’]894 ){895 continue;896 }897898 $this->get_gpsi_test_result($link);899900 }901902 }903904 }905906 public function run_gpsi_status_check_for_all(){907908 $spawned = wp_schedule_single_event( time() + 5, ‘uucss_run_gpsi_test_for_all’);909910 wp_send_json_success([911 ‘spawned’ => $spawned912 ]);913 }914915 public function get_public_notices(){916917 $api = new RapidLoad_Api();918919 $result = $api->get(‘notification’);920921 $data = !$api->is_error($result) && isset($result->data) ? $result->data : [];922923 $data = array_filter($data, function ($notice){924 $notice_read = UnusedCSS_Admin::get_site_option(‘uucss_notice_’ . $notice->id . ‘_read’);925 return empty($notice_read);926 });927928 $keys = array_keys($data);929930 if(empty($keys)){931 return $data;932 }933934 $notices = [];935936 foreach ($data as $key => $notice){937 array_push($notices, $notice);938 }939940 return $notices;941 }942943 public function get_gpsi_test_result($link){944945 $uucss_api = new RapidLoad_Api();946947 $cached_files = [];948 $original_files = [];949950 if(isset($link[‘files’]) && !empty($link[‘files’])){951952 $cached_files = array_filter($link[‘files’], function ($file){953 return !$this->str_contains($file[‘original’], ‘//inline-style@’);954 });955956 $original_files = array_filter($link[‘files’], function ($file){957 return !$this->str_contains($file[‘original’], ‘//inline-style@’);958 });959 }960961 do_action( 'uucss/cached’, [962 ‘url’ => $link[‘url’]963 ]);964965 return $uucss_api->post( 'test/wordpress’,966 [967 ‘url’ => urldecode($link[‘url’]),968 ‘files’ => !empty($cached_files) ? array_column($cached_files, ‘uucss’) : [],969 ‘aoFiles’ => !empty($original_files) ? array_column($original_files, ‘original’) : []970 ]);971972 }973974 public function uucss_test_url(){975976 global $uucss;977978 if(!isset($_REQUEST[‘url’])){979 wp_send_json_error(‘url required’);980 }981982 $url = $_REQUEST[‘url’];983 $type = isset($_REQUEST[‘type’]) ? $_REQUEST[‘type’] : 'path’;984985 if($type == ‘rule’){986987 if(!isset($_REQUEST[‘rule’]) || !isset($_REQUEST[‘regex’])){988 wp_send_json_error(‘rule and regex required’);989 }990991 }992993 $uucss_api = new RapidLoad_Api();994995 $link = $type == ‘path’ ? UnusedCSS_DB::get_link($url) : UnusedCSS_DB::get_rule($_REQUEST[‘rule’],$_REQUEST[‘regex’]);996997 $result = $this->get_gpsi_test_result($link);998999 if ( $uucss_api->is_error( $result ) ) {1000 if(isset($result->errors) && isset($result->errors[0])){1001 wp_send_json_error($result->errors[0]->detail);1002 }else{1003 wp_send_json_error($result);1004 }1005 }10061007 wp_send_json_success($result);1008 }10091010 public function get_faqs(){10111012 $rapidload_faqs_read = self::get_site_option(‘rapidload_faqs_read’);10131014 if(!empty($rapidload_faqs_read)){1015 return [];1016 }10171018 $api = new RapidLoad_Api();10191020 $result = $api->get(‘faqs’);10211022 $default = [1023 [1024 “title” => "I enabled RapidLoad and now my site is broken. What do I do?",1025 “message” => "If you are encountering layout or styling issues on a RapidLoad optimized page, try enabling the “Load Original CSS Files” option or <a href=’https://rapidload.zendesk.com/hc/en-us/articles/360063292673-Sitewide-Safelists-Blocklists’>adding safelist rules</a> for affected elements in the plugin Advanced Settings. Always remember to requeue affected pages after making plugin changes. Need more help? Head over to the RapidLoad docs for more information or to submit a Support request: <a href=’https://rapidload.zendesk.com/hc/en-us’>https://rapidload.zendesk.com/hc/en-us</a>",1026 ],1027 [1028 “title” => "Why am I still seeing the “Removed unused CSS” flag in Google Page Speed Insights?",1029 “message” => "It’s possible that the RapidLoad optimized version of the page is not yet being served. Try clearing your page cache and running the GPSI test again.",1030 ],1031 [1032 “title” => "Will this plugin work with other caching plugins?",1033 “message” => "RapidLoad works with all major caching plugins. If you are using a little known caching plugin and are experiencing issues with RapidLoad, please submit your issue and caching plugin name to our support team and we will review.",1034 ],1035 [1036 “title” => "Do I need to run this every time I make a change?",1037 “message” => "No! RapidLoad works in the background, so any new stylesheets that are added will be analyzed and optimized on the fly. Just set it and forget it!",1038 ],1039 [1040 “title” => "Do you offer support if I need it?",1041 “message” => "Yes, our team is standing by to assist you! Submit a support ticket any time from the Support tab in the plugin and we’ll be happy to help.",1042 ]1043 ];10441045 return !$api->is_error($result) && isset($result->data) ? $result->data : $default;1046 }10471048 public function clear_uucss_logs(){1049 $file_system = new RapidLoad_FileSystem();10501051 if(!$file_system->exists(WP_CONTENT_DIR . ‘/uploads/rapidload/’)){1052 wp_send_json_success(true);1053 }10541055 $file_system->delete_folder(WP_CONTENT_DIR . ‘/uploads/rapidload/’);1056 wp_send_json_success(true);1057 }10581059 public function uucss_logs(){10601061 $file_system = new RapidLoad_FileSystem();10621063 if(!$file_system->exists(UUCSS_LOG_DIR . ‘debug.log’)){1064 wp_send_json_success([]);1065 }10661067 $data = $file_system->get_contents(UUCSS_LOG_DIR . ‘debug.log’);10681069 if(empty($data)){1070 wp_send_json_success([]);1071 }10721073 $data = '[' . $data . ']';10741075 wp_send_json_success(json_decode($data));1076 }10771078 public function frontend_logs(){10791080 $args = [];10811082 $args[‘type’] = isset($_REQUEST[‘type’]) && !empty($_REQUEST[‘type’]) ? $_REQUEST[‘type’] : 'frontend’;1083 $args[‘log’] = isset($_REQUEST[‘log’]) && !empty($_REQUEST[‘log’]) ? $_REQUEST[‘log’] : '’;1084 $args[‘url’] = isset($_REQUEST[‘url’]) && !empty($_REQUEST[‘url’]) ? $_REQUEST[‘url’] : '’;10851086 self::log($args);10871088 wp_send_json_success(true);1089 }10901091 public function mark_faqs_read(){10921093 self::update_site_option('rapidload_faqs_read’, true);1094 wp_send_json_success(true);1095 }10961097 public function mark_notice_read(){10981099 $notice_id = isset($_REQUEST[‘notice_id’]) ? $_REQUEST[‘notice_id’] : false;11001101 if($notice_id){1102 self::update_site_option(‘uucss_notice_’ . $notice_id . '_read’, true);1103 }11041105 wp_send_json_success(true);1106 }11071108 public function clear_page_cache(){11091110 $url = isset($_REQUEST[‘url’]) ? $_REQUEST[‘url’] : false;1111 $rule = isset($_REQUEST[‘rule’]) ? $_REQUEST[‘rule’] : false;1112 $regex = isset($_REQUEST[‘regex’]) ? $_REQUEST[‘regex’] : false;11131114 $status = isset($_REQUEST[‘status’]) ? $_REQUEST[‘status’] : false;11151116 $type = isset($_REQUEST[‘type’]) ? $_REQUEST[‘status’] : 'path’;11171118 if($url){11191120 UnusedCSS_DB::reset_hits($url);1121 do_action( 'uucss/cached’, [1122 ‘url’ => $url1123 ] );1124 }11251126 $links = false;11271128 if($rule && $regex){11291130 $rule = UnusedCSS_DB::get_rule($rule, $regex);11311132 if(isset($rule[‘id’])){11331134 $links = UnusedCSS_DB::get_links_where(" WHERE rule_id = " . $rule[‘id’]);11351136 }1137 }11381139 if($status){11401141 UnusedCSS_DB::reset_hits();11421143 if($type == ‘path’){11441145 $links = UnusedCSS_DB::get_links_where(' ');11461147 }else{11481149 $links = UnusedCSS_DB::get_rules_where(' ');11501151 }11521153 }11541155 if($links && !empty($links)){11561157 foreach ($links as $link){11581159 if(isset($link[‘url’])){1160 self::uucss_log($link[‘url’]);1161 do_action( 'uucss/cached’, [1162 ‘url’ => $link[‘url’]1163 ] );1164 }1165 }1166 }11671168 wp_send_json_success(‘page cache cleared’);1169 }11701171 public static function is_api_key_verified() {11721173 $api_key_status = isset( RapidLoad_Base::fetch_options()[‘uucss_api_key_verified’] ) ? RapidLoad_Base::fetch_options()[‘uucss_api_key_verified’] : '’;11741175 return $api_key_status == '1’;11761177 }11781179 public function add_plugin_action_link( $links ) {11801181 $_links = array(1182 ‘<a href="’ . admin_url( ‘options-general.php?page=uucss’ ) . '">Settings</a>’,1183 );11841185 return array_merge( $_links, $links );1186 }11871188 public function add_meta_boxes()1189 {1190 add_meta_box(1191 'uucss-options’,1192 __( 'RapidLoad Options’, ‘uucss’ ),1193 [$this, ‘meta_box’],1194 get_post_types(),1195 'side’1196 );1197 }11981199 public function meta_box( $post ) {12001201 $options = RapidLoad_Base::get_page_options($post->ID);12021203 include(‘parts/admin-post.html.php’);1204 }12051206 public function save_meta_box_options($post_id, $post)1207 {1208 if ( !isset( $_POST[‘uucss_nonce’] ) || !wp_verify_nonce( $_POST[‘uucss_nonce’], ‘uucss_option_save’ ) ) {1209 return;1210 }12111212 if (defined(‘DOING_AUTOSAVE’) && DOING_AUTOSAVE) {1213 return;1214 }12151216 $this->update_meta($post_id);12171218 }12191220 public function cache_trigger_hooks() {1221 add_action( 'save_post’, [ $this, ‘cache_on_actions’ ], 110, 3 );1222 add_action( 'untrash_post’, [ $this, ‘cache_on_actions’ ], 10, 1 );1223 add_action( 'wp_trash_post’, [ $this, ‘clear_on_actions’ ], 10, 1 );1224 add_action( "wp_ajax_uucss_purge_url", [ $this, ‘ajax_purge_url’ ] );1225 }12261227 public static function suggest_whitelist_packs() {12281229 if ( ! function_exists( ‘get_plugins’ ) ) {1230 require_once ABSPATH . 'wp-admin/includes/plugin.php’;1231 }12321233 $plugins = get_plugins();1234 $active_plugins = array_map( function ( $key, $item ) {12351236 $item[‘slug’] = $key;12371238 return $item;1239 }, array_keys( $plugins ), $plugins );12401241 $api = new RapidLoad_Api();12421243 $data = $api->post( 'whitelist-packs/wp-suggest’, [1244 ‘plugins’ => $active_plugins,1245 ‘theme’ => get_template(),1246 ‘url’ => site_url()1247 ] );12481249 if ( wp_doing_ajax() ) {1250 wp_send_json_success( $data->data );1251 }12521253 return isset($data) && is_array($data) ? $data : [];1254 }12551256 public function uucss_license() {12571258 $api = new RapidLoad_Api();12591260 $data = $api->get( 'license’, [1261 ‘url’ => $this->transform_url(get_site_url()),1262 ‘version’ => UUCSS_VERSION,1263 ‘db_version’ => RapidLoad_DB::$db_version,1264 ‘db_version_exist’ => RapidLoad_DB::$current_version1265 ] );12661267 if ( ! is_wp_error( $data ) ) {12681269 if ( isset( $data->errors ) ) {1270 wp_send_json_error( $data->errors[0]->detail );1271 }12721273 if ( gettype( $data ) === ‘string’ ) {1274 wp_send_json_error( $data );1275 }12761277 do_action( ‘uucss/license-verified’ );12781279 wp_send_json_success( $data->data );1280 }12811282 wp_send_json_error( ‘unknown error occurred’ );1283 }12841285 public function verify_api_key() {12861287 if ( ! isset( $_POST[‘api_key’] ) ) {1288 wp_send_json_error();12891290 return;1291 }12921293 $uucss_api = new RapidLoad_Api();1294 $uucss_api->apiKey = sanitize_text_field( $_POST[‘api_key’] );12951296 $results = $uucss_api->get( ‘verify’ );12971298 if ( isset( $results->data ) ) {1299 wp_send_json_success( true );1300 }13011302 wp_send_json_error();13031304 }13051306 public function ajax_purge_url() {13071308 if ( ! isset( $_POST[‘nonce’] ) || ! wp_verify_nonce( $_POST[‘nonce’], ‘uucss_nonce’ ) ) {1309 wp_send_json_error( ‘authentication failed’ );13101311 return;1312 }13131314 $args = isset($_POST[‘args’]) ? $_POST[‘args’] : [];13151316 if ( ! isset( $_POST[‘url’] ) ) {1317 wp_send_json_error();13181319 return;1320 }13211322 if ( isset( $_POST[‘args’] ) ) {1323 $args[‘post_id’] = ( isset( $_POST[‘args’][‘post_id’] ) ) ? intval( $_POST[‘args’][‘post_id’] ) : null;1324 }13251326 $url = esc_url_raw( $_POST[‘url’] );13271328 if(isset($args[‘rule_id’])){1329 $rule = UnusedCSS_Rule::get_rule_from_id($args[‘rule_id’]);1330 if($rule){1331 $url = $rule->url;1332 $args[‘rule’] = $rule->rule;1333 $args[‘regex’] = $rule->regex;1334 }1335 }13361337 if ( isset( $_POST[‘clear’] ) && boolval($_POST[‘clear’] == ‘true’) ) {1338 $list = isset($_POST[‘url_list’]) ? $_POST[‘url_list’] : null;13391340 if(isset($list) && is_array($list) && !empty($list)){1341 foreach ($list as $item){13421343 $url = is_array($item) && isset($item[‘url’]) ? $item[‘url’] : $item;13441345 if(is_array($item) && isset($item[‘rule’])){1346 $args[‘rule’] = $item[‘rule’];1347 }13481349 if(is_array($item) && isset($item[‘regex’])){1350 $args[‘regex’] = $item[‘regex’];1351 }13521353 $this->uucss->clear_cache( $url, $args );1354 }1355 }else{1356 $this->uucss->clear_cache( $url, $args );1357 }13581359 wp_send_json_success( true );1360 return;1361 }13621363 if ( isset( $args[“post_id”] ) ) {1364 $args[‘options’] = $this->uucss->api_options( $args[“post_id”] );1365 }13661367 $args[‘immediate’] = true;1368 $args[‘priority’] = true;13691370 wp_send_json_success( $this->uucss->cache( $url, $args ) );1371 }13721373 /**1374 * @param $post_id1375 * @param $post WP_Post1376 * @param $update1377 */1378 public function cache_on_actions($post_id, $post = null, $update = null)1379 {13801381 $post = get_post($post_id);13821383 if($post->post_status == “publish”) {13841385 $this->clear_on_actions( $post->ID );13861387 $url = get_permalink( $post );13881389 if(UnusedCSS_DB::link_exists_with_error($url) || !RapidLoad_Base::get()->rules_enabled()){1390 $this->uucss->cache( $url );1391 }13921393 }1394 }13951396 public function clear_on_actions($post_ID)1397 {1398 $link = get_permalink($post_ID);13991400 if($link){1401 $this->uucss->clear_cache($link);1402 }1403 }14041405 public function update_meta($post_id)1406 {1407 foreach (self::$page_options as $option) {14081409 if ( ! isset( $_POST[ ‘uucss_’ . $option ] ) ) {1410 delete_post_meta( $post_id, ‘_uucss_’ . $option );1411 continue;1412 }14131414 $value = sanitize_text_field( $_POST[ ‘uucss_’ . $option ] );14151416 update_post_meta( $post_id, ‘_uucss_’ . $option, $value );1417 }1418 }14191420 public static function get_site_option($name)1421 {1422 if(is_multisite()){14231424 return get_blog_option(get_current_blog_id(), $name, false);14251426 }1427 return get_site_option( $name, false );1428 }14291430 public static function update_site_option($name, $value){14311432 if(is_multisite()){14331434 return update_blog_option(get_current_blog_id(), $name, $value);14351436 }1437 return update_site_option($name, $value);1438 }14391440 public static function delete_site_option($name){14411442 if(is_multisite()){14431444 return delete_blog_option(get_current_blog_id(), $name);14451446 }1447 return delete_site_option($name);1448 }14491450 public static function first_job_done(){1451 return (RapidLoad_Settings::get_first_link() ? true : false);1452 }1453}

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907