From 50554035566b6ddbc27f50acb39b03e9e11f1a4a Mon Sep 17 00:00:00 2001 From: Ilnur Basyrov Date: Fri, 13 Feb 2026 15:36:11 +0400 Subject: [PATCH 1/6] PLUGINS-6345 --- CHANGELOG.txt | 3 +++ ecwid-shopping-cart.php | 2 +- includes/class-ec-store-admin-access.php | 4 ++++ readme.txt | 5 ++++- 4 files changed, 12 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.txt b/CHANGELOG.txt index ee9f912f..85f1870a 100644 --- a/CHANGELOG.txt +++ b/CHANGELOG.txt @@ -1,4 +1,7 @@ == Changelog == += 7.0.8 - Feb 13, 2026 = +- **Plugin code improvements for better security. Ecwid ecommerce shopping cart plugin update recommended.** + = 7.0.7 - Jan 29, 2026 = - **Plugin code improvements for better security. Ecwid ecommerce shopping cart plugin update recommended.** diff --git a/ecwid-shopping-cart.php b/ecwid-shopping-cart.php index 4b3bb5dd..72e7ff76 100644 --- a/ecwid-shopping-cart.php +++ b/ecwid-shopping-cart.php @@ -5,7 +5,7 @@ Description: Ecwid by Lightspeed is a full-featured shopping cart. It can be easily integrated with any Wordpress blog and takes less than 5 minutes to set up. Text Domain: ecwid-shopping-cart Author: Ecwid Ecommerce -Version: 7.0.7 +Version: 7.0.8 Author URI: https://go.lightspeedhq.com/ecwid-site License: GPLv2 or later */ diff --git a/includes/class-ec-store-admin-access.php b/includes/class-ec-store-admin-access.php index 75e7ad55..ba779a93 100644 --- a/includes/class-ec-store-admin-access.php +++ b/includes/class-ec-store-admin-access.php @@ -31,6 +31,10 @@ public function save_custom_user_profile_fields( $user_id ) { return; } + if ( ! $this->can_grant_access() ) { + return; + } + $user = new WP_User( $user_id ); if ( ! empty( $_POST['ec_store_admin_access'] ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.NonceVerification.Missing diff --git a/readme.txt b/readme.txt index d7064cd5..a8337682 100644 --- a/readme.txt +++ b/readme.txt @@ -5,7 +5,7 @@ License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Requires at least: 4.4 Tested up to: 6.9 -Stable tag: 7.0.7 +Stable tag: 7.0.8 Powerful, easy to use ecommerce shopping cart for WordPress. Sell on Facebook and Instagram. iPhone & Android apps. Superb support. @@ -152,6 +152,9 @@ You can use Ecwid’s built-in import tools to copy your store products from any * [Ecwid Help Center](http://help.ecwid.com "Ecwid Help") == Changelog == += 7.0.8 - Feb 13, 2026 = +- **Plugin code improvements for better security. Ecwid ecommerce shopping cart plugin update recommended.** + = 7.0.7 - Jan 29, 2026 = - **Plugin code improvements for better security. Ecwid ecommerce shopping cart plugin update recommended.** From c1715a417a690344ba79c4c09653e972406f55e9 Mon Sep 17 00:00:00 2001 From: Ilnur Basyrov Date: Thu, 23 Jul 2026 16:51:30 +0400 Subject: [PATCH 2/6] Compatibility with WP 7.0 --- CHANGELOG.txt | 3 +++ ecwid-shopping-cart.php | 2 +- readme.txt | 7 +++++-- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.txt b/CHANGELOG.txt index 85f1870a..ac4d795b 100644 --- a/CHANGELOG.txt +++ b/CHANGELOG.txt @@ -1,4 +1,7 @@ == Changelog == += 7.0.9 - Jul 22, 2026 = +- **WordPress 7.0 compatibility.** The new WordPress version is released. The Ecwid ecommerce shopping cart plugin is ready for the new release — everything works well in your WordPress admin and storefront pages. Feel free to upgrade your site to WordPress 7.0. + = 7.0.8 - Feb 13, 2026 = - **Plugin code improvements for better security. Ecwid ecommerce shopping cart plugin update recommended.** diff --git a/ecwid-shopping-cart.php b/ecwid-shopping-cart.php index 72e7ff76..85df1c81 100644 --- a/ecwid-shopping-cart.php +++ b/ecwid-shopping-cart.php @@ -5,7 +5,7 @@ Description: Ecwid by Lightspeed is a full-featured shopping cart. It can be easily integrated with any Wordpress blog and takes less than 5 minutes to set up. Text Domain: ecwid-shopping-cart Author: Ecwid Ecommerce -Version: 7.0.8 +Version: 7.0.9 Author URI: https://go.lightspeedhq.com/ecwid-site License: GPLv2 or later */ diff --git a/readme.txt b/readme.txt index a8337682..1ec6ce21 100644 --- a/readme.txt +++ b/readme.txt @@ -4,8 +4,8 @@ Tags: ecommerce, e-commerce, storefront, shopping cart, online store License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Requires at least: 4.4 -Tested up to: 6.9 -Stable tag: 7.0.8 +Tested up to: 7.0 +Stable tag: 7.0.9 Powerful, easy to use ecommerce shopping cart for WordPress. Sell on Facebook and Instagram. iPhone & Android apps. Superb support. @@ -152,6 +152,9 @@ You can use Ecwid’s built-in import tools to copy your store products from any * [Ecwid Help Center](http://help.ecwid.com "Ecwid Help") == Changelog == += 7.0.9 - Jul 22, 2026 = +- **WordPress 7.0 compatibility.** The new WordPress version is released. The Ecwid ecommerce shopping cart plugin is ready for the new release — everything works well in your WordPress admin and storefront pages. Feel free to upgrade your site to WordPress 7.0. + = 7.0.8 - Feb 13, 2026 = - **Plugin code improvements for better security. Ecwid ecommerce shopping cart plugin update recommended.** From 34ba2cd2d6315d732a4af82b8f2474d2ba923041 Mon Sep 17 00:00:00 2001 From: Ilnur Basyrov Date: Sat, 8 Aug 2026 14:58:27 +0400 Subject: [PATCH 3/6] PLUGINS-6357 --- ecwid-shopping-cart.php | 4 +- includes/class-ecwid-admin-main-page.php | 39 +++++++++++++++++- includes/class-ecwid-oauth.php | 40 ++++++++++++++++++- includes/class-ecwid-product-popup.php | 2 + includes/importer/class-ecwid-import-page.php | 7 ++-- js/product-popup.js | 2 +- readme.txt | 5 ++- templates/admin-footer.php | 2 +- templates/admin/simple-dashboard.php | 2 +- 9 files changed, 91 insertions(+), 12 deletions(-) diff --git a/ecwid-shopping-cart.php b/ecwid-shopping-cart.php index 85df1c81..9d9e4cc0 100644 --- a/ecwid-shopping-cart.php +++ b/ecwid-shopping-cart.php @@ -5,7 +5,7 @@ Description: Ecwid by Lightspeed is a full-featured shopping cart. It can be easily integrated with any Wordpress blog and takes less than 5 minutes to set up. Text Domain: ecwid-shopping-cart Author: Ecwid Ecommerce -Version: 7.0.9 +Version: 7.0.10 Author URI: https://go.lightspeedhq.com/ecwid-site License: GPLv2 or later */ @@ -2297,7 +2297,7 @@ function ecwid_admin_post_connect() } else if (!isset($_GET['reconnect'])) { wp_safe_redirect(Ecwid_Admin::get_dashboard_url() . '&oauth=no'); } else { - wp_safe_redirect(Ecwid_Admin::get_dashboard_url() . '&reconnect&connection_error'); + wp_safe_redirect( Ecwid_Admin_Main_Page::get_forced_reconnect_url( '&connection_error' ) ); } exit(); } diff --git a/includes/class-ecwid-admin-main-page.php b/includes/class-ecwid-admin-main-page.php index d07053c1..06b1d318 100644 --- a/includes/class-ecwid-admin-main-page.php +++ b/includes/class-ecwid-admin-main-page.php @@ -11,8 +11,10 @@ class Ecwid_Admin_Main_Page { const PAGE_HASH_UPGRADE = 'billing:feature=sso&plan=ecwid_venture'; const PAGE_HASH_COMPLETE_REGISTRATION = 'complete-registration'; + const NONCE_RECONNECT = 'ec_forced_reconnect'; + public function do_page() { - if ( self::is_forced_reconnect() ) { + if ( self::is_forced_reconnect() && self::is_verified_reconnect_request() ) { ecwid_update_store_id( ecwid_get_demo_store_id() ); } @@ -175,6 +177,41 @@ public static function is_forced_reconnect() { return isset( $_GET['reconnect'] ); } + /** + * Tells whether the current forced reconnect request is allowed to reset + * the store to the demo one. Guards the destructive part of the flow + * against CSRF: displaying the connect page stays nonce-free, resetting + * the store id does not. + */ + public static function is_verified_reconnect_request() { + if ( ! current_user_can( Ecwid_Admin::get_capability() ) ) { + return false; + } + + if ( ! isset( $_GET['_wpnonce'] ) ) { + return false; + } + + return (bool) wp_verify_nonce( + sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), + self::NONCE_RECONNECT + ); + } + + /** + * Builds a nonce-signed url that forces the reconnect flow. + * + * Returns a raw (unescaped) url, so it is safe to pass to wp_safe_redirect() + * and to javascript. Escape it with esc_url() when printing into markup. + * + * @param string $extra_args optional query string appended to the url, e.g. '&connection_error'. + */ + public static function get_forced_reconnect_url( $extra_args = '' ) { + return Ecwid_Admin::get_dashboard_url() + . '&reconnect' . $extra_args + . '&_wpnonce=' . wp_create_nonce( self::NONCE_RECONNECT ); + } + protected static function _get_upgrade_page_hash() { return 'billing:feature=sso&plan=ecwid_venture'; } diff --git a/includes/class-ecwid-oauth.php b/includes/class-ecwid-oauth.php index 382ff866..a5fa589e 100644 --- a/includes/class-ecwid-oauth.php +++ b/includes/class-ecwid-oauth.php @@ -9,6 +9,8 @@ class Ecwid_OAuth { const OPTION_JUST_CONNECTED = 'ecwid_just_connected'; + const NONCE_DISCONNECT = 'ec_disconnect'; + const SCOPE_READ_CATALOG = 'read_catalog'; const SCOPE_READ_STORE_PROFILE = 'read_store_profile'; const SCOPE_UPDATE_STORE_PROFILE = 'update_store_profile'; @@ -78,6 +80,13 @@ public function get_sso_reconnect_dialog_url() { } public function process_authorization() { + if ( ! current_user_can( Ecwid_Admin::get_capability() ) ) { + wp_die( + esc_html__( 'You do not have sufficient permissions to connect the store.', 'ecwid-shopping-cart' ), + 403 + ); + } + $reconnect = isset( $_REQUEST['action'] ) && $_REQUEST['action'] == 'ec_oauth_reconnect'; if ( isset( $_REQUEST['error'] ) || ! isset( $_REQUEST['code'] ) ) { @@ -97,7 +106,11 @@ public function process_authorization() { ); } - wp_safe_redirect( Ecwid_Admin::get_dashboard_url() . '&connection_error' . ( $reconnect ? '&reconnect' : '' ) ); + if ( $reconnect ) { + wp_safe_redirect( Ecwid_Admin_Main_Page::get_forced_reconnect_url( '&connection_error' ) ); + } else { + wp_safe_redirect( Ecwid_Admin::get_dashboard_url() . '&connection_error' ); + } exit; } @@ -180,6 +193,15 @@ public function process_authorization() { } public function disconnect_store() { + if ( ! current_user_can( Ecwid_Admin::get_capability() ) ) { + wp_die( + esc_html__( 'You do not have sufficient permissions to disconnect the store.', 'ecwid-shopping-cart' ), + 403 + ); + } + + check_admin_referer( self::NONCE_DISCONNECT ); + update_option( 'ecwid_store_id', ecwid_get_demo_store_id() ); $this->api->save_token( '' ); @@ -187,6 +209,16 @@ public function disconnect_store() { exit; } + /** + * Builds a nonce-signed store disconnect url. + * + * Returns a raw (unescaped) url. Escape it with esc_url() when printing into markup. + */ + public static function get_disconnect_url() { + return admin_url( 'admin-post.php?action=ec_disconnect' ) + . '&_wpnonce=' . wp_create_nonce( self::NONCE_DISCONNECT ); + } + public function get_safe_scopes_array( $scopes ) { if ( ! isset( $scopes ) || empty( $scopes ) ) { return $this->_get_default_scopes_array(); @@ -280,7 +312,11 @@ protected function trigger_auth_error( $mode = 'default' ) { EcwidPlatform::report_error( $last_error ); } - wp_safe_redirect( Ecwid_Admin::get_dashboard_url() . '&connection_error' . ( $mode == self::MODE_RECONNECT ? '&reconnect' : '' ) ); + if ( $mode == self::MODE_RECONNECT ) { + wp_safe_redirect( Ecwid_Admin_Main_Page::get_forced_reconnect_url( '&connection_error' ) ); + } else { + wp_safe_redirect( Ecwid_Admin::get_dashboard_url() . '&connection_error' ); + } exit(); } diff --git a/includes/class-ecwid-product-popup.php b/includes/class-ecwid-product-popup.php index 43f0cf47..b5f409c9 100644 --- a/includes/class-ecwid-product-popup.php +++ b/includes/class-ecwid-product-popup.php @@ -175,6 +175,8 @@ public function add_scripts() { 'lastPage' => __( 'Last Page', 'ecwid-shopping-cart' ), ); + $data['reconnect_url'] = Ecwid_Admin_Main_Page::get_forced_reconnect_url( '&reason=spw' ); + wp_localize_script( 'ecwid-product-popup', 'ecwidSpwParams', $data ); } diff --git a/includes/importer/class-ecwid-import-page.php b/includes/importer/class-ecwid-import-page.php index adaa5c13..83d0e333 100644 --- a/includes/importer/class-ecwid-import-page.php +++ b/includes/importer/class-ecwid-import-page.php @@ -156,9 +156,10 @@ public function do_reconnect() { } wp_safe_redirect( - 'admin.php?page=' . Ecwid_Admin::ADMIN_SLUG - . '&reconnect&return-url=' . rawurlencode( $url ) - . '&scope=create_catalog+update_catalog&do_reconnect=1' + Ecwid_Admin_Main_Page::get_forced_reconnect_url( + '&return-url=' . rawurlencode( $url ) + . '&scope=create_catalog+update_catalog&do_reconnect=1' + ) ); } diff --git a/js/product-popup.js b/js/product-popup.js index 8d293a6c..2fbb1211 100644 --- a/js/product-popup.js +++ b/js/product-popup.js @@ -16,7 +16,7 @@ jQuery(document).ready(function () { openPopup = function () { if (ecwidSpwParams && typeof ecwidSpwParams.no_token != 'undefined') { - location.href = 'admin.php?page=ec-store&reconnect&reason=spw'; + location.href = ecwidSpwParams.reconnect_url; return false; } diff --git a/readme.txt b/readme.txt index 1ec6ce21..54a844a6 100644 --- a/readme.txt +++ b/readme.txt @@ -5,7 +5,7 @@ License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Requires at least: 4.4 Tested up to: 7.0 -Stable tag: 7.0.9 +Stable tag: 7.0.10 Powerful, easy to use ecommerce shopping cart for WordPress. Sell on Facebook and Instagram. iPhone & Android apps. Superb support. @@ -152,6 +152,9 @@ You can use Ecwid’s built-in import tools to copy your store products from any * [Ecwid Help Center](http://help.ecwid.com "Ecwid Help") == Changelog == += 7.0.10 = +- **Plugin code improvements for better security. Ecwid ecommerce shopping cart plugin update recommended.** Thanks to Alexander Jurkschat for responsibly reporting the issue. + = 7.0.9 - Jul 22, 2026 = - **WordPress 7.0 compatibility.** The new WordPress version is released. The Ecwid ecommerce shopping cart plugin is ready for the new release — everything works well in your WordPress admin and storefront pages. Feel free to upgrade your site to WordPress 7.0. diff --git a/templates/admin-footer.php b/templates/admin-footer.php index 6a1092e8..8bf59b5f 100644 --- a/templates/admin-footer.php +++ b/templates/admin-footer.php @@ -6,7 +6,7 @@

- Reconnect', 'ecwid-shopping-cart' ), 'href="' . Ecwid_Admin::get_dashboard_url() . '&reconnect"' ) ); ?> + Reconnect', 'ecwid-shopping-cart' ), 'href="' . esc_url( Ecwid_Admin_Main_Page::get_forced_reconnect_url() ) . '"' ) ); ?>
diff --git a/templates/admin/simple-dashboard.php b/templates/admin/simple-dashboard.php index 9d49497d..ef36c96f 100644 --- a/templates/admin/simple-dashboard.php +++ b/templates/admin/simple-dashboard.php @@ -15,7 +15,7 @@
  • - +
From 78eeb7aed83de9bd1a09f9dfb844dc03f2c2b369 Mon Sep 17 00:00:00 2001 From: Ilnur Basyrov Date: Sat, 8 Aug 2026 15:06:14 +0400 Subject: [PATCH 4/6] PLUGINS-6358 --- templates/admin/developers.php | 50 ---------------------------------- 1 file changed, 50 deletions(-) diff --git a/templates/admin/developers.php b/templates/admin/developers.php index c1d4ecd8..9d8248e8 100644 --- a/templates/admin/developers.php +++ b/templates/admin/developers.php @@ -368,32 +368,6 @@
-
-
-
-
- - - -
-
-
-
-
- -
-
- -
-
-
- -
-
-
-
-
-
@@ -486,30 +460,6 @@
-
-
-
-
- -
-
-
-
-
- -
-
- -
-
-
- -
-
-
-
-
-
From ec828f1569d30f9c71bf4d220b9de7ca1f79f628 Mon Sep 17 00:00:00 2001 From: Ilnur Basyrov Date: Sat, 8 Aug 2026 15:09:26 +0400 Subject: [PATCH 5/6] fixed the version --- readme.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/readme.txt b/readme.txt index 54a844a6..dc87e0f0 100644 --- a/readme.txt +++ b/readme.txt @@ -5,7 +5,7 @@ License: GPLv2 or later License URI: https://www.gnu.org/licenses/gpl-2.0.html Requires at least: 4.4 Tested up to: 7.0 -Stable tag: 7.0.10 +Stable tag: 7.0.9 Powerful, easy to use ecommerce shopping cart for WordPress. Sell on Facebook and Instagram. iPhone & Android apps. Superb support. From 3f6e36b6c579e353058bc9560391b224f2c07ed4 Mon Sep 17 00:00:00 2001 From: Ilnur Basyrov Date: Sat, 8 Aug 2026 15:13:34 +0400 Subject: [PATCH 6/6] The changelog updates --- CHANGELOG.txt | 3 ++- readme.txt | 6 ++---- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.txt b/CHANGELOG.txt index ac4d795b..59e27b4e 100644 --- a/CHANGELOG.txt +++ b/CHANGELOG.txt @@ -1,6 +1,7 @@ == Changelog == -= 7.0.9 - Jul 22, 2026 = += 7.0.9 - Aug 8, 2026 = - **WordPress 7.0 compatibility.** The new WordPress version is released. The Ecwid ecommerce shopping cart plugin is ready for the new release — everything works well in your WordPress admin and storefront pages. Feel free to upgrade your site to WordPress 7.0. +- **Plugin code improvements for better security. Ecwid ecommerce shopping cart plugin update recommended.** Thanks to Alexander Jurkschat for responsibly reporting the issue. = 7.0.8 - Feb 13, 2026 = - **Plugin code improvements for better security. Ecwid ecommerce shopping cart plugin update recommended.** diff --git a/readme.txt b/readme.txt index dc87e0f0..e0297010 100644 --- a/readme.txt +++ b/readme.txt @@ -152,11 +152,9 @@ You can use Ecwid’s built-in import tools to copy your store products from any * [Ecwid Help Center](http://help.ecwid.com "Ecwid Help") == Changelog == -= 7.0.10 = -- **Plugin code improvements for better security. Ecwid ecommerce shopping cart plugin update recommended.** Thanks to Alexander Jurkschat for responsibly reporting the issue. - -= 7.0.9 - Jul 22, 2026 = += 7.0.9 - Aug 8, 2026 = - **WordPress 7.0 compatibility.** The new WordPress version is released. The Ecwid ecommerce shopping cart plugin is ready for the new release — everything works well in your WordPress admin and storefront pages. Feel free to upgrade your site to WordPress 7.0. +- **Plugin code improvements for better security. Ecwid ecommerce shopping cart plugin update recommended.** Thanks to Alexander Jurkschat for responsibly reporting the issue. = 7.0.8 - Feb 13, 2026 = - **Plugin code improvements for better security. Ecwid ecommerce shopping cart plugin update recommended.**