steve/att-consent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security hardening and accessibility improvements (v1.1.0)

Browse Source 
Address findings from security audit: wrap inline JSON.parse in
try/catch to prevent consent flow failure on corrupted cookies,
allowlist admin tab parameter, clamp consent_expiry server-side,
escape all server values in admin JS table builder, fix focus trap
listener cleanup, add aria-labelledby and banner focus for screen
readers, skip frontend loading during AJAX.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Steve Hanlon
2026-02-18 10:32:16 +00:00
parent 0a73181ea7
commit 2294c8eda7
7 changed files with 146 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
includes/class-admin.php
View File

@@ -102,7 +102,6 @@ class ATT_Consent_Admin {
return;
}
$active_tab = isset( $_GET['tab'] ) ? sanitize_key( $_GET['tab'] ) : 'general'; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
$tabs = array(
'general' => __( 'General', 'att-consent' ),
'appearance' => __( 'Appearance', 'att-consent' ),
@@ -110,6 +109,10 @@ class ATT_Consent_Admin {
'scripts' => __( 'Custom Scripts', 'att-consent' ),
'advanced' => __( 'Advanced', 'att-consent' ),
);
$active_tab = isset( $_GET['tab'] ) ? sanitize_key( $_GET['tab'] ) : 'general'; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
if ( ! array_key_exists( $active_tab, $tabs ) ) {
$active_tab = 'general';
}
$settings = ATT_Consent::get_settings();
?>
@@ -163,7 +166,7 @@ class ATT_Consent_Admin {
$settings['gtm_container_id'] = sanitize_text_field( $_POST['gtm_container_id'] ?? '' );
$settings['consent_mode'] = in_array( $_POST['consent_mode'] ?? '', array( 'advanced', 'basic' ), true ) ? $_POST['consent_mode'] : 'advanced';
$settings['banner_position'] = in_array( $_POST['banner_position'] ?? '', array( 'bottom', 'top', 'center' ), true ) ? $_POST['banner_position'] : 'bottom';
$settings['consent_expiry'] = absint( $_POST['consent_expiry'] ?? 365 );
$settings['consent_expiry'] = min( 730, max( 1, absint( $_POST['consent_expiry'] ?? 365 ) ) );
$settings['floating_widget'] = in_array(
$_POST['floating_widget'] ?? '',
array( 'bottom-right', 'right', 'none' ),