thatguygriff
f3f5c7801f
CI / No Debug Code (pull_request) Successful in 3s
CI / Tests (PHP 8.1) (pull_request) Successful in 43s
CI / Tests (PHP 8.3) (pull_request) Successful in 49s
CI / Tests (PHP 8.2) (pull_request) Successful in 59s
CI / Coding Standards (pull_request) Successful in 1m11s
CI / PHPStan (pull_request) Successful in 1m20s
CI / Build Plugin Zip (pull_request) Has been skipped
Four fixes from a security review pass: - Neutralise CSV formula injection in the payments export: fields with a leading =, +, -, @, tab, or CR (e.g. a hostile student display name) are apostrophe-prefixed in PaymentReport::csvLine() so they open as text in Excel/Google Sheets. Fixes #39. - Sanitise policy bodies with wp_kses_post at output in PolicyEndpoint::index() (the booking JS renders that HTML raw), so a future write path that forgets kses can never become stored XSS. Fixes #40. - Store invite tokens hashed (SHA-256) at rest: a database leak can no longer redeem pending invites. The registration link is shown once, at creation; the pending list shows email/invited date; lookups hash the submitted token. Existing plaintext pending invites must be re-issued. Fixes #41. - Validate availability slot datetimes on both creation paths (REST and admin form) via AvailabilitySlot::normalizeDateTime(): canonical and datetime-local forms normalise to Y-m-d H:i:s, garbage and end <= start are rejected (REST 400) instead of reaching the DATETIME column or throwing inside the weekly-series date arithmetic. Fixes #42. composer test (204 tests, 594 assertions), PHPStan L6, and PHPCS all green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
69 lines
3.2 KiB
PHP
69 lines
3.2 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
if (! defined('ABSPATH')) {
|
|
exit;
|
|
}
|
|
|
|
/**
|
|
* @var \Unsupervised\Schedular\Auth\Invite|null $invite
|
|
* @var string $token Raw invite token from the request (only its hash is stored).
|
|
* @var bool $canRegister
|
|
* @var bool $success
|
|
* @var string $error
|
|
* @var list<array{policy: \Unsupervised\Schedular\Policy\Policy, version: \Unsupervised\Schedular\Policy\PolicyVersion}> $policyForms
|
|
*/
|
|
?>
|
|
<div class="us-register-form">
|
|
<?php if ($success) : ?>
|
|
<p class="us-success"><?php esc_html_e('Your account has been created and you are now logged in.', 'unsupervised-schedular'); ?></p>
|
|
<?php elseif (! $canRegister) : ?>
|
|
<p><?php esc_html_e('Registration is by invitation only. Please use the link from your invitation email, or contact the studio.', 'unsupervised-schedular'); ?></p>
|
|
<?php else : ?>
|
|
<?php if ($error !== '') : ?>
|
|
<p class="us-error" role="alert"><?php echo esc_html($error); ?></p>
|
|
<?php endif; ?>
|
|
|
|
<form method="post" action="">
|
|
<?php wp_nonce_field('us_student_register'); ?>
|
|
<input type="hidden" name="us_invite" value="<?php echo esc_attr($token); ?>">
|
|
|
|
<p>
|
|
<label for="us-reg-email"><?php esc_html_e('Email', 'unsupervised-schedular'); ?></label>
|
|
<input type="email" id="us-reg-email" value="<?php echo esc_attr($invite->email); ?>" readonly>
|
|
</p>
|
|
<p>
|
|
<label for="us-reg-name"><?php esc_html_e('Your name', 'unsupervised-schedular'); ?></label>
|
|
<input type="text" name="display_name" id="us-reg-name" autocomplete="name" required>
|
|
</p>
|
|
<p>
|
|
<label for="us-reg-pass"><?php esc_html_e('Password', 'unsupervised-schedular'); ?></label>
|
|
<input type="password" name="password" id="us-reg-pass" autocomplete="new-password" minlength="8" required>
|
|
</p>
|
|
|
|
<?php if (! empty($policyForms)) : ?>
|
|
<fieldset class="us-policies">
|
|
<legend><?php esc_html_e('Policies', 'unsupervised-schedular'); ?></legend>
|
|
<?php foreach ($policyForms as $form) : ?>
|
|
<div class="us-policy">
|
|
<h4><?php echo esc_html($form['policy']->title); ?></h4>
|
|
<div class="us-policy-body"><?php echo wp_kses_post((string) $form['version']->body); ?></div>
|
|
<label>
|
|
<input type="checkbox" name="accept[]" value="<?php echo esc_attr((string) $form['version']->id); ?>" required>
|
|
<?php
|
|
/* translators: %s: policy title */
|
|
echo esc_html(sprintf(__('I have read and agree to the %s.', 'unsupervised-schedular'), $form['policy']->title));
|
|
?>
|
|
</label>
|
|
</div>
|
|
<?php endforeach; ?>
|
|
</fieldset>
|
|
<?php endif; ?>
|
|
|
|
<p>
|
|
<input type="submit" name="us_register" value="<?php esc_attr_e('Create Account', 'unsupervised-schedular'); ?>">
|
|
</p>
|
|
</form>
|
|
<?php endif; ?>
|
|
</div>
|