Security audit

.github/workflows/php.lint.test.yml

@@ -90,6 +90,7 @@ jobs:
                 run: |
                     rm tests/_envs/.env
                     mv tests/_envs/.env.testing tests/_envs/.env
+                    touch tests/_envs/.env.local
 
             -   name: Run PHP tests
                 run: composer test:wpunit

.gitignore

@@ -33,3 +33,11 @@ AGENTS.md
 .env.e2e
 .env.e2e.example
 bootstrap-project.js
+
+# Local test environment overrides
+tests/_envs/.env.local
+
+# Codeception runtime artifacts
+tests/_output/*
+!tests/_output/.gitignore
+tests/_support/_generated/

assets/build/admin/package.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('wp-i18n'), 'version' => '94ba9a9d32ea506460c6');
+<?php return array('dependencies' => array('wp-i18n'), 'version' => 'cd879d1903e305e67f49');

assets/build/editor/form.builder.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-components', 'wp-data', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-plugins'), 'version' => '998222f5df4e19e7fc3d');
+<?php return array('dependencies' => array('react', 'wp-components', 'wp-data', 'wp-editor', 'wp-element', 'wp-hooks', 'wp-i18n', 'wp-plugins'), 'version' => 'f2898b123edbefeeaef4');

assets/build/editor/package.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-api-fetch', 'wp-block-editor', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => '0aefae306822008fa4a6');
+<?php return array('dependencies' => array('react', 'wp-api-fetch', 'wp-block-editor', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-hooks', 'wp-i18n'), 'version' => '84dd167a2e5aa9a15f3b');

assets/build/frontend/main.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('wp-i18n'), 'version' => 'b145b8f23bfb859fdb34');
+<?php return array('dependencies' => array('wp-i18n'), 'version' => 'b6ad40658d81b14a771d');

assets/build/frontend/media.field.restrictions.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array('wp-i18n'), 'version' => '2fa8b05f10aab57b1eae');
+<?php return array('dependencies' => array('wp-i18n'), 'version' => '3a8ed91056d8ec80b043');

assets/src/frontend/main/reporting/BrowserReporting.js

@@ -26,7 +26,13 @@ function BrowserReporting() {
 		// browser automatically hide tooltip messages
 	};
 	this.validateOnChange = function () {
-		this.validate().then( () => {} ).catch( () => {} );
+		this.getErrors().then( errors => {
+			this.validityState.current = !Boolean( errors.length );
+
+			if ( !errors.length ) {
+				this.clearReport();
+			}
+		} ).catch( () => {} );
 	};
 
 	this.getErrorsRaw = async function ( promises ) {

assets/src/frontend/main/submit/AjaxSubmit.js

@@ -72,6 +72,11 @@ function AjaxSubmit( form ) {
 
 		this.lastResponse = response;
 		const $form       = jQuery( rootNode );
+		const csrfToken   = response?._jfb_csrf_token;
+
+		if ( csrfToken ) {
+			this.refreshCsrfToken( csrfToken );
+		}
 
 		switch ( response.status ) {
 			case 'success':
@@ -129,6 +134,26 @@ function AjaxSubmit( form ) {
 
 		rootNode.appendChild( node );
 	};
+	this.refreshCsrfToken = function ( csrfToken ) {
+		const formId = this.form.getFormId();
+		const forms  = document.querySelectorAll(
+			'form.jet-form-builder[data-form-id]',
+		);
+
+		for ( const formNode of forms ) {
+			if ( +formNode.dataset.formId !== formId ) {
+				continue;
+			}
+
+			const csrfFields = formNode.querySelectorAll(
+				'input[name="_jfb_csrf_token"]',
+			);
+
+			for ( const field of csrfFields ) {
+				field.value = csrfToken;
+			}
+		}
+	};
 }
 
 AjaxSubmit.prototype = Object.create( BaseSubmit.prototype );
@@ -167,4 +192,4 @@ AjaxSubmit.prototype.watchFail = function ( callable ) {
 	} );
 };
 
-export default AjaxSubmit;
+export default AjaxSubmit;

assets/src/frontend/media.field.restrictions/FileSizeRestriction.js

@@ -8,7 +8,7 @@ function FileSizeRestriction() {
 	this.validate = function () {
 		const { max_size: maxSize } = this.reporting.input.attrs;
 
-		return this.file.size < maxSize.value.current;
+		return this.file.size <= maxSize.value.current;
 	};
 
 	this.getRawMessage = function () {
@@ -19,4 +19,4 @@ function FileSizeRestriction() {
 
 FileSizeRestriction.prototype = Object.create( BaseFileRestriction.prototype );
 
-export default FileSizeRestriction;
+export default FileSizeRestriction;

codeception.dist.yml

@@ -17,6 +17,7 @@ extensions:
         - Codeception\Command\GenerateWPCanonical
         - Codeception\Command\GenerateWPXMLRPC
 params:
+    - tests/_envs/.env.local
     - tests/_envs/.env
 settings:
     colors: true
@@ -80,5 +81,3 @@ modules:
             mu-plugins: '/wp-content/mu-plugins'
             themes: '/wp-content/themes'
             uploads: '/wp-content/uploads'
-
-

compatibility/bricks/assets/build/frontend.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array(), 'version' => 'cf7d02a4042a42f5c32e');
+<?php return array('dependencies' => array(), 'version' => '223249f02ffb577062b5');

compatibility/jet-appointment/assets/build/frontend.asset.php

@@ -1 +1 @@
-<?php return array('dependencies' => array(), 'version' => '0c021d3fb5d78e7cd81c');
+<?php return array('dependencies' => array(), 'version' => 'bad44884ebe52d8c8260');