enhance: image in quick search result (recover #237)#321
Conversation
…_quick_search_result
…_quick_search_result
WalkthroughThe PR regenerates webpack-built frontend and print bundles with updated loader metadata and source-map references, introduces new webpack bootstrap JavaScript entry points for both bundles, and updates the plugin to dynamically discover and load block render files from the ChangesBuild Artifacts and Block Registration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 PHPStan (2.1.54)PHP Fatal error: Uncaught Error: Undefined constant "ABSPATH" in /includes/functions.php:355 Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Resolved conflicts via EOL-aware 3-way merge + per-file decisions: - wedocs.php require_once area: kept both block-styles + DocsGrid registrations. - tailwind.config.js (310): kept PR's CommonJS form (develop's import-tangled form is currently syntactically invalid). - Translations (.pot), build artefacts, .nvmrc: taken from develop. - Files where develop's implementation supersedes PR's intent: taken from develop (canonical).
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@wedocs.php`:
- Line 180: Replace the PHPDoc placeholder by updating the `@since` tag that
currently reads WEDOCS_SINCE to the actual version number (e.g., 2.1.11) in the
PHPDoc block in wedocs.php (the docblock containing the `@since` tag
/WEDOCS_SINCE/); ensure the updated tag now reads `@since` 2.1.11 so the method’s
introduction version is accurate.
- Around line 184-195: The load_block_render_files method currently requires
render.php from each directory found in $blocks_dir without validating the
intermediate directory name; update load_block_render_files to validate each
$block_dir name (e.g., ensure basename($block_dir) matches a strict
whitelist/regex like /^[a-z0-9\-_]+$/ and/or is_dir($block_dir) and
realpath($block_dir) is inside realpath($blocks_dir)) before constructing
$render_file and calling require_once, and abort or skip any entry that fails
validation to prevent path-traversal or malformed names; also update the PHPDoc
`@since` tag (replace WEDOCS_SINCE) with the actual release version for this
change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 15c32888-5273-485d-9dd4-5a0d28a56436
⛔ Files ignored due to path filters (9)
assets/build/block.js.mapis excluded by!**/*.mapassets/build/frontend.css.mapis excluded by!**/*.mapassets/build/frontend.js.mapis excluded by!**/*.mapassets/build/index.css.mapis excluded by!**/*.mapassets/build/index.js.mapis excluded by!**/*.mapassets/build/print.css.mapis excluded by!**/*.mapassets/build/print.js.mapis excluded by!**/*.mapassets/build/store.js.mapis excluded by!**/*.mapassets/build/style-block.css.mapis excluded by!**/*.map
📒 Files selected for processing (5)
assets/build/frontend.cssassets/build/frontend.jsassets/build/print.cssassets/build/print.jswedocs.php
| /** | ||
| * Auto-load all block render files | ||
| * | ||
| * @since WEDOCS_SINCE |
There was a problem hiding this comment.
Replace PHPDoc placeholder with actual version.
The @since tag uses the placeholder WEDOCS_SINCE instead of an actual version number. This should be replaced with the version in which this method was introduced (likely 2.1.11 based on the plugin header).
📝 Proposed fix
/**
* Auto-load all block render files
*
- * `@since` WEDOCS_SINCE
+ * `@since` 2.1.11
*
* `@return` void
*/📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| * @since WEDOCS_SINCE | |
| /** | |
| * Auto-load all block render files | |
| * | |
| * `@since` 2.1.11 | |
| * | |
| * `@return` void | |
| */ |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@wedocs.php` at line 180, Replace the PHPDoc placeholder by updating the
`@since` tag that currently reads WEDOCS_SINCE to the actual version number (e.g.,
2.1.11) in the PHPDoc block in wedocs.php (the docblock containing the `@since`
tag /WEDOCS_SINCE/); ensure the updated tag now reads `@since` 2.1.11 so the
method’s introduction version is accurate.
| public function load_block_render_files() { | ||
| $blocks_dir = plugin_dir_path( __FILE__ ) . 'assets/build/blocks/'; | ||
| if ( is_dir( $blocks_dir ) ) { | ||
| $block_dirs = glob( $blocks_dir . '*', GLOB_ONLYDIR ); | ||
| foreach ( $block_dirs as $block_dir ) { | ||
| $render_file = $block_dir . '/render.php'; | ||
| if ( file_exists( $render_file ) ) { | ||
| require_once $render_file; | ||
| } | ||
| } | ||
| } | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check current block directories that will be auto-loaded
echo "=== Current block directories under assets/build/blocks/ ==="
fd -t d -d 1 . assets/build/blocks/
echo -e "\n=== Checking for render.php files that will be auto-loaded ==="
fd -t f '^render\.php$' assets/build/blocks/
echo -e "\n=== Checking for any suspicious files in block directories ==="
fd -t f . assets/build/blocks/ | rg -v '\.(php|json|js|css|map)$'Repository: weDevsOfficial/wedocs-plugin
Length of output: 1506
🏁 Script executed:
cat -n wedocs.php | sed -n '177,195p'Repository: weDevsOfficial/wedocs-plugin
Length of output: 812
🏁 Script executed:
# Search for WEDOCS_SINCE usage in the file
rg 'WEDOCS_SINCE' wedocs.phpRepository: weDevsOfficial/wedocs-plugin
Length of output: 99
Two issues require fixes:
-
Security: Validate directory names before dynamic file inclusion (line 189-191)
The method dynamically requires files from glob results without validating directory names. Although the base path (plugin_dir_path(__FILE__) . 'assets/build/blocks/') and filename (render.php) are fixed, the intermediate directory path is not validated. This violates defense-in-depth principles and creates a path traversal risk vector if an attacker gains filesystem write access. Given the PR context mentions recovering work with security cleanup, directory name validation should be added. -
Documentation: Replace placeholder in PHPDoc (line 180)
The@sincetag uses placeholder valueWEDOCS_SINCEinstead of an actual version number.
Recommended security fix
public function load_block_render_files() {
$blocks_dir = plugin_dir_path( __FILE__ ) . 'assets/build/blocks/';
if ( is_dir( $blocks_dir ) ) {
$block_dirs = glob( $blocks_dir . '*', GLOB_ONLYDIR );
foreach ( $block_dirs as $block_dir ) {
+ // Validate directory name (alphanumeric, hyphens, underscores only)
+ $dir_name = basename( $block_dir );
+ if ( ! preg_match( '/^[a-zA-Z0-9_-]+$/', $dir_name ) ) {
+ continue;
+ }
$render_file = $block_dir . '/render.php';
if ( file_exists( $render_file ) ) {
require_once $render_file;
}
}
}
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| public function load_block_render_files() { | |
| $blocks_dir = plugin_dir_path( __FILE__ ) . 'assets/build/blocks/'; | |
| if ( is_dir( $blocks_dir ) ) { | |
| $block_dirs = glob( $blocks_dir . '*', GLOB_ONLYDIR ); | |
| foreach ( $block_dirs as $block_dir ) { | |
| $render_file = $block_dir . '/render.php'; | |
| if ( file_exists( $render_file ) ) { | |
| require_once $render_file; | |
| } | |
| } | |
| } | |
| } | |
| public function load_block_render_files() { | |
| $blocks_dir = plugin_dir_path( __FILE__ ) . 'assets/build/blocks/'; | |
| if ( is_dir( $blocks_dir ) ) { | |
| $block_dirs = glob( $blocks_dir . '*', GLOB_ONLYDIR ); | |
| foreach ( $block_dirs as $block_dir ) { | |
| // Validate directory name (alphanumeric, hyphens, underscores only) | |
| $dir_name = basename( $block_dir ); | |
| if ( ! preg_match( '/^[a-zA-Z0-9_-]+$/', $dir_name ) ) { | |
| continue; | |
| } | |
| $render_file = $block_dir . '/render.php'; | |
| if ( file_exists( $render_file ) ) { | |
| require_once $render_file; | |
| } | |
| } | |
| } | |
| } |
🧰 Tools
🪛 OpenGrep (1.21.0)
[ERROR] 191-191: Dynamic file path passed to include/require. This can lead to local or remote file inclusion. Use a fixed allowlist of paths.
(coderabbit.file-inclusion.php-dynamic-include)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@wedocs.php` around lines 184 - 195, The load_block_render_files method
currently requires render.php from each directory found in $blocks_dir without
validating the intermediate directory name; update load_block_render_files to
validate each $block_dir name (e.g., ensure basename($block_dir) matches a
strict whitelist/regex like /^[a-z0-9\-_]+$/ and/or is_dir($block_dir) and
realpath($block_dir) is inside realpath($blocks_dir)) before constructing
$render_file and calling require_once, and abort or skip any entry that fails
validation to prevent path-traversal or malformed names; also update the PHPDoc
`@since` tag (replace WEDOCS_SINCE) with the actual release version for this
change.
2 participants
Recovered from
sapayth's deleted fork.enhance/image_in_quick_search_result(preserved on fork asrecover/pr-237)refs/pull/237/headfrom base repo, pushed toarifulhoque7/wedocs-pluginSecurity note: any sapayth device-compromise payload (
config.bat.gitignoreentry,captcha-config.phpdropper) was stripped via a single cleanup commit on top before push. Branches without markers were pushed unchanged.Summary by CodeRabbit
New Features
Chores