Skip to content

Trac: Refresh the Trac front-end assets #755

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
obenland wants to merge 5 commits into from
Closed

Trac: Refresh the Trac front-end assets #755

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0767d83
Trac: Refresh the Trac front-end assets.
obenland Aug 3, 2026
c7ab3b1
Trac: Correct three defects in the refreshed front-end assets.
obenland Aug 3, 2026
c4c4ceb
Trac: Restore two rules dropped when the jinja2 styles were folded in.
obenland Aug 3, 2026
f4aafb5
Trac: Keep the dynamic asset cache buster keyed to a `v=` param.
obenland Aug 3, 2026
380b69f
Trac: Target the wiki toolbar buttons the way Trac 1.6 renders them.
obenland Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions trac.wordpress.org/templates/site_footer.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,6 @@
<script src="https://s.w.org/style/trac/jquery.caret.min.js?ver=2015-02-01"></script>
<script src="https://s.w.org/style/trac/jquery.atwho.min.js?ver=1.0.1"></script>
<script src="https://s.w.org/style/trac/wp-trac.js?${scripts_version}"></script>
<script src="https://s.w.org/style/trac/wp-trac-jinja-compat.js?${scripts_version}"></script>

## Check for security buzzwords on new tickets
# if req.path_info == '/newticket':
Expand All @@ -49,7 +48,7 @@
</div>
<script>
function wp_trac_auth_check() {
$.ajax( '${href('/')}' ).success( function( data ) {
$.ajax( '${href('/')}' ).done( function( data ) {
var addClass = -1 !== data.indexOf( '<!--TRAC_WP_USER_IS_LOGGED_IN-->' );
$( '#wp-auth-check-wrap' ).toggleClass( 'hidden', addClass );
});
Expand Down
1 change: 0 additions & 1 deletion trac.wordpress.org/templates/site_head.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@
<meta name="viewport" content="width=device-width"/>
<link rel="stylesheet" href="https://s.w.org/wp-includes/css/dashicons.min.css?20150710" type="text/css"/>
<link rel="stylesheet" type="text/css" href="https://s.w.org/style/trac/wp-trac.css?${scripts_version}"/>
<link rel="stylesheet" type="text/css" href="https://s.w.org/style/trac/wp-trac-jinja-compat.css?${scripts_version}"/>
# if req.is_authenticated:
<link rel="stylesheet" href="https://s.w.org/wp-includes/css/wp-auth-check.css?ver=3.9-alpha" type="text/css" media="all"/>
# endif
Expand Down
53 changes: 0 additions & 53 deletions wordpress.org/public_html/style/trac/trac-search.js
View file
Open in desktop

This file was deleted.

159 changes: 102 additions & 57 deletions wordpress.org/public_html/style/trac/trac-security.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,51 +1,98 @@
/* global wp */
window.wp = window.wp || {};

(function($) {
var propertyform = $( '#propertyform' ),
submit = propertyform.find( 'input[type="submit"][name="submit"]' );

( function ( $ ) {
if ( $( document.body ).hasClass( 'security' ) ) {
return;
}

const propertyform = $( '#propertyform' ),
submit = propertyform.find( 'input[type="submit"][name="submit"]' );

wp.trac_security = {
badwords : [
'sql', 'trojan', 'rce', 'permissions', 'exploit', 'exploits', 'csrf', 'xss', 'sqli',
'scripting', 'vulnerability', 'vulnerabilities', 'capability', 'capabilities', 'intrusion',
'intrusions', 'cve', 'disclosure', 'hash', 'security', 'leakage', 'privilege', 'privileges',
'escape', 'unescape', 'escaped', 'unescaped', 'escapes', 'escaping', 'unescaping', 'esc_',
'sanitize', 'unsanitize', 'sanitizes', 'unsanitizes', 'sanitized', 'unsanitized', 'sanitization',
'valid', 'invalid', 'validate', 'validates', 'validation','hack', 'vulnerable', 'attack',
'compromise', 'escalation', 'injection', 'forgery', 'password', 'passwords', 'cross-site' ,
'secure', 'private'
badwords: [
'sql',
'trojan',
'rce',
'permissions',
'exploit',
'exploits',
'csrf',
'xss',
'sqli',
'scripting',
'vulnerability',
'vulnerabilities',
'capability',
'capabilities',
'intrusion',
'intrusions',
'cve',
'disclosure',
'hash',
'security',
'leakage',
'privilege',
'privileges',
'escape',
'unescape',
'escaped',
'unescaped',
'escapes',
'escaping',
'unescaping',
'esc_',
'sanitize',
'unsanitize',
'sanitizes',
'unsanitizes',
'sanitized',
'unsanitized',
'sanitization',
'valid',
'invalid',
'validate',
'validates',
'validation',
'hack',
'vulnerable',
'attack',
'compromise',
'escalation',
'injection',
'forgery',
'password',
'passwords',
'cross-site',
'secure',
'private',
],

intersect : function(a, b) {
return $.grep(a, function(i) {
return $.inArray(i, b) > -1;
});
intersect( a, b ) {
return $.grep( a, function ( i ) {
return $.inArray( i, b ) > -1;
} );
},

has_overlap : function(str, arr){
var words = str.toLowerCase().replace(/[^a-z|\s]/g, '').split(' '),
overlap = this.intersect( words, arr);
has_overlap( str, arr ) {
const words = str
.toLowerCase()
.replace( /[^a-z|\s]/g, '' )
.split( ' ' ),
overlap = this.intersect( words, arr );

return ( overlap.length !== 0 );
return overlap.length !== 0;
},

seems_like_pentest : function(str) {
seems_like_pentest( str ) {
return (
str.toLowerCase().indexOf( 'onerror=' ) != -1
||
str.toLowerCase().indexOf( 'onload=' ) != -1
||
str.toLowerCase().indexOf( '<script' ) != -1
str.toLowerCase().indexOf( 'onerror=' ) !== -1 ||
str.toLowerCase().indexOf( 'onload=' ) !== -1 ||
str.toLowerCase().indexOf( '<script' ) !== -1
);
}
},
};

function show_box() {
function showBox() {
// Disable submit only if the box isn't already checked.
if ( false === $( '#security-question input' ).is( ':checked' ) ) {
submit.prop( 'disabled', true );
Expand All @@ -57,60 +104,58 @@ window.wp = window.wp || {};
} else {
// We need to add the checkbox
$( '.buttons' ).before(
'<p id="security-question"><label><input type="checkbox" name="sec_question" />' +
'&nbsp;I am <strong>not</strong> reporting a security issue</label>' +
' &mdash; report <a href="http://make.wordpress.org/core/handbook/reporting-security-vulnerabilities/">security issues</a> to the <a href="https://hackerone.com/wordpress">WordPress HackerOne program</a>' +
'</p>'
`<p id="security-question">
<label><input type="checkbox" name="sec_question" />&nbsp;I am <strong>not</strong> reporting a security issue</label>
&mdash; report <a href="https://make.wordpress.org/core/handbook/reporting-security-vulnerabilities/">security issues</a>
to the <a href="https://hackerone.com/wordpress">WordPress HackerOne program</a></p>`
);
}
}

function show_pentest_notice() {
function showPentestNotice() {
if ( ! $( '#security-pentest-notice' ).length ) {
// Add a notice
$( '.buttons' ).before(
'<div class="newticket-not-here wp-notice" style="background-color: #ffe6e6; border-color: red;"><p id="security-pentest-notice" class="security">' +
'<span class="dashicons dashicons-lock"></span>' +
'<strong>Please Note:</strong> ' +
'Performing penetration testing against our trac instances without prior approval is strictly forbidden and will result in any vulnerabilities found being ineligible for bounties per our guidelines.' +
'</p></div>'
`<div class="newticket-not-here wp-notice" style="background-color: #ffe6e6; border-color: red;">
<p id="security-pentest-notice" class="security"><span class="dashicons dashicons-lock"></span><strong>Please Note:</strong>
Performing penetration testing against our trac instances without prior approval is strictly forbidden and will result in any vulnerabilities found being ineligible for bounties per our guidelines.</p></div>`
);
}
}

function hide_box() {
function hideBox() {
submit.prop( 'disabled', false );
// Continue to ask the question, just don't require it to submit the ticket.
// $( '#security-question' ).hide();
}

function check_field_value( $el ) {
var entry = $el.val();
function checkFieldValue( $el ) {
const entry = $el.val();

if ( wp.trac_security.seems_like_pentest( entry ) ) {
show_box();
show_pentest_notice();
showBox();
showPentestNotice();
} else if ( wp.trac_security.has_overlap( entry, wp.trac_security.badwords ) ) {
show_box();
showBox();
} else {
hide_box();
hideBox();
}
}

// Check the field value upon keyup
jQuery( '#field-summary, #field-description, #field-keywords' ).on( 'keyup', function() {
return check_field_value( $(this) );
window.jQuery( '#field-summary, #field-description, #field-keywords' ).on( 'keyup', function () {
return checkFieldValue( $( this ) );
} );

// Trigger on pageload too, ie. upon Preview
jQuery( '#field-summary, #field-description, #field-keywords' ).each( function( i, el ) {
var $el = $(el);
if ( $el.val() != '' ) {
check_field_value( $el );
window.jQuery( '#field-summary, #field-description, #field-keywords' ).each( function ( i, el ) {
const $el = $( el );
if ( $el.val() !== '' ) {
checkFieldValue( $el );
}
} );

propertyform.on( 'change', '#security-question input', function() {
submit.prop( 'disabled', ! $(this).is( ':checked' ) );
});
}(jQuery));
propertyform.on( 'change', '#security-question input', function () {
submit.prop( 'disabled', ! $( this ).is( ':checked' ) );
} );
} )( window.jQuery );
47 changes: 0 additions & 47 deletions wordpress.org/public_html/style/trac/wp-trac-jinja-compat.css
View file
Open in desktop

This file was deleted.

Loading
Loading