• Resolved KZeni

    (@kzeni)


    I encountered a site where I was using $_GET['code'] for something on the frontend. I found that I would be redirected to the Piwik for WooCommerce admin page if I ever tried to then view the resulting page with code as a URL parameter when this plugin is enabled.

    Thankfully, I found a simple fix was to edit includes/class-wc-piwik.php so that:

    
    if ( ! empty( $_GET['code'] ) || ! empty( $_GET['piwikurl'] ) || ! empty( $_GET['idsite'] ) ) {
    	header( 'Location: ' . site_url() . '/wp-admin/admin.php?page=wc-settings&tab=integration' );
    	exit;
    }
    

    was instead:

    
    if( is_admin() ){
    	if ( ! empty( $_GET['code'] ) || ! empty( $_GET['piwikurl'] ) || ! empty( $_GET['idsite'] ) ) {
    		header( 'Location: ' . site_url() . '/wp-admin/admin.php?page=wc-settings&tab=integration' );
    		exit;
    	}
    }
    

    so it only triggers on site admin pages.

    Even then, this could probably be refined further so it only applies to actions regarding the Piwik for WooCommerce plugin rather than all of the site admin (which is what the code above still leaves it as). For example, I had thought about swapping out:

    
    ! empty( $_GET['code'] ) || ! empty( $_GET['piwikurl'] ) || ! empty( $_GET['idsite'] )
    

    for:

    
    ! empty( $_GET['code'] ) && ( ! empty( $_GET['piwikurl'] ) || ! empty( $_GET['idsite'] ) )
    

    but I wasn’t sure if that went along with the plugin’s logic or not (it at least wouldn’t hijack all instances of code being used as a GET variable site-wide/admin-wide).

    I’d love to see this implemented as this is a pretty basic issue with that should be a fairly straightforward fix.

    Thank you!

Viewing 1 replies (of 1 total)
  • Thread Starter KZeni

    (@kzeni)

    As a follow up, this problem was resolved by changing over to the WooCommerce Matomo Analytics 1.x & newer plugin that’s included with https://plugins.matomo.org/WooCommerceAnalytics

    Really, this plugin listing should either be updated to the new plugin offering (which is a paid plugin as I understand it so that really isn’t an option) or should it be taken down or otherwise noticeably mentions that people should be using the current version of the plugin at https://plugins.matomo.org/WooCommerceAnalytics instead of this outdated & unsupported version being served up.

Viewing 1 replies (of 1 total)
  • The topic ‘Proposed Bugfix: Don’t hijack any/all URLs with ‘code’ as a GET variable’ is closed to new replies.