Proposed Bugfix: Don’t hijack any/all URLs with ‘code’ as a GET variable
-
I encountered a site where I was using
$_GET['code']
for something on the frontend. I found that I would be redirected to the Piwik for WooCommerce admin page if I ever tried to then view the resulting page withcode
as a URL parameter when this plugin is enabled.Thankfully, I found a simple fix was to edit
includes/class-wc-piwik.php
so that:if ( ! empty( $_GET['code'] ) || ! empty( $_GET['piwikurl'] ) || ! empty( $_GET['idsite'] ) ) { header( 'Location: ' . site_url() . '/wp-admin/admin.php?page=wc-settings&tab=integration' ); exit; }
was instead:
if( is_admin() ){ if ( ! empty( $_GET['code'] ) || ! empty( $_GET['piwikurl'] ) || ! empty( $_GET['idsite'] ) ) { header( 'Location: ' . site_url() . '/wp-admin/admin.php?page=wc-settings&tab=integration' ); exit; } }
so it only triggers on site admin pages.
Even then, this could probably be refined further so it only applies to actions regarding the Piwik for WooCommerce plugin rather than all of the site admin (which is what the code above still leaves it as). For example, I had thought about swapping out:
! empty( $_GET['code'] ) || ! empty( $_GET['piwikurl'] ) || ! empty( $_GET['idsite'] )
for:
! empty( $_GET['code'] ) && ( ! empty( $_GET['piwikurl'] ) || ! empty( $_GET['idsite'] ) )
but I wasn’t sure if that went along with the plugin’s logic or not (it at least wouldn’t hijack all instances of code being used as a GET variable site-wide/admin-wide).
I’d love to see this implemented as this is a pretty basic issue with that should be a fairly straightforward fix.
Thank you!
- The topic ‘Proposed Bugfix: Don’t hijack any/all URLs with ‘code’ as a GET variable’ is closed to new replies.