kw/nolimit-discounts
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

1.5.2: take shared-menu 1.2.1, which centres the glyph

Browse Source 
Kristian reported the infinity sign sitting above centre in the admin menu on
the live shop. Security traced it to WordPress's own stylesheet rather than
adjusting it by eye: #adminmenu div.wp-menu-image is 36x34 and its :before
carries padding 7px 0, which is exactly 7 + 20 + 7 for a 20px dashicon at
line-height 1. The 1.2.0 rule set line-height 1.4 and inherited that padding,
so the pseudo-element was 42px tall inside a 34px parent.

1.2.1 reproduces the box, drops the padding and centres with flex — geometry
rather than a nudge, because U+221E sits on the maths axis instead of filling
its em box.

It is the same half-done abstraction as the escaping fix: the filter made the
character configurable and left the geometry tuned for one specific character.
Nothing could fail, because the only value anyone ever passed was the one it
was tuned for.

Verified before copying, including the part that makes the check meaningful:
Security predicted php -w WOULD differ this round, since the executable code
changed — so equal stripped hashes would have meant the wrong file. They
differ, and the diff is the version constant plus the CSS geometry, with
wpmgr_css_escape untouched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kristianwind
2026-09-20 18:52:51 +02:00
co-authored by Claude Opus 5
parent d707751a95
commit 6114473be0
4 changed files with 28 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.txt
+1 -1
View File
@@ -4,7 +4,7 @@ Tags: woocommerce, discount, email, shipping, coupon
Requires at least: 5.8
Tested up to: 7.1
Requires PHP: 7.4
Stable tag: 1.5.1
Stable tag: 1.5.2
WC requires at least: 6.0
WC tested up to: 11.1.0
License: GPLv2 or later
ci/plugin.conf
+6 -2
View File
@@ -75,7 +75,11 @@ RELEASE_REPO=kw/nolimit-discounts-dist
# The frozen hash is therefore a family-wide fact, not a local one, and taking
# a new one is something all six do in the same window.
#
# 9012fe98 = contract 1.2.0. The glyph is now emitted as CSS numeric escapes
# 678f1f03 = contract 1.2.1: the glyph is centred with flex inside an explicit
# 36x34 box instead of inheriting WordPress's 7px padding, which made the
# pseudo-element 42px tall inside a 34px parent and pushed the sign above
# centre. Kristian reported it from the live shop.
# Earlier: 9012fe98 = contract 1.2.0. The glyph is now emitted as CSS numeric escapes
# rather than through esc_attr(): HTML entities are not decoded by the CSS
# parser, so esc_attr was protecting by coincidence — and a backslash, which it
# leaves alone, IS a CSS escape and swallowed the closing quote. Changing the
@@ -83,4 +87,4 @@ RELEASE_REPO=kw/nolimit-discounts-dist
# backslashes, hex digits and spaces, so there is nothing left to leave the
# string with. Verified here against seven hostile inputs.
# Earlier frozen hashes: 184cebdc = 1.1.0, f4862d5c = 1.0.0.
WPMGR_MENU_SHA=9012fe98d867b86c993cee2f8d7b0b9fe5b89817fed4cf45346aa4949e2df307
WPMGR_MENU_SHA=678f1f0368fcc781ce34c0289f6470a6bb0491bc32c0598e859c7ceba66e5e2a
includes/shared-menu.php
+19 -2
View File
@@ -69,7 +69,7 @@ if ( ! defined( 'ABSPATH' ) ) {
}
if ( ! defined( 'WPMGR_MENU_VERSION' ) ) {
define( 'WPMGR_MENU_VERSION', '1.2.0' );
define( 'WPMGR_MENU_VERSION', '1.2.1' );
}
if ( ! defined( 'WPMGR_MENU_SLUG' ) ) {
@@ -160,6 +160,23 @@ if ( ! function_exists( 'wpmgr_ensure_menu' ) ) {
* `font-family` has to be overridden: WordPress sets the icon wrapper to
* the Dashicons font, and Dashicons has no infinity glyph, so inheriting
* it renders nothing at all.
*
* 🔴 The box is WordPress's own, measured rather than guessed, and the
* glyph is centred in it geometrically rather than nudged.
*
* wp-admin/css/admin-menu.css sets `#adminmenu div.wp-menu-image` to
* 36x34, and `div.wp-menu-image:before` to `padding: 7px 0` — which is
* exactly 7 + 20 + 7 for a 20px dashicon on `line-height: 1`. The first
* version of this rule set `line-height: 1.4` and inherited that padding,
* making the line box 28px and the whole pseudo-element 42px inside a 34px
* parent. Kristian reported the result: the glyph sitting above centre.
*
* So: reproduce the 36x34 box, drop the padding that only existed to
* position a 20px line inside it, and centre with flex. That matters more
* for an arbitrary glyph than for a dashicon — U+221E sits on the maths
* axis rather than filling its em box, so any rule that positions by
* line-height and padding is positioning the box and hoping about the
* glyph. `align-items: center` centres what is actually drawn.
*/
function wpmgr_menu_glyph_style() {
$glyph = apply_filters( 'wpmgr_menu_glyph', '∞' );
@@ -170,7 +187,7 @@ if ( ! function_exists( 'wpmgr_ensure_menu' ) ) {
// phpcs:disable WordPress.Security.EscapeOutput.OutputNotEscaped -- the slug is reduced to [a-z0-9_-] and the glyph to CSS numeric escapes; both are escaped for the context they are printed in, which is CSS rather than HTML.
printf(
'<style>#adminmenu .toplevel_page_%1$s .wp-menu-image::before{content:"%2$s";font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;font-size:20px;font-weight:400;line-height:1.4}</style>',
'<style>#adminmenu .toplevel_page_%1$s .wp-menu-image::before{content:"%2$s";font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;font-size:20px;font-weight:400;display:flex;align-items:center;justify-content:center;width:36px;height:34px;padding:0;line-height:1}</style>',
preg_replace( '/[^a-z0-9_-]/', '', strtolower( WPMGR_MENU_SLUG ) ),
wpmgr_css_escape( $glyph )
);
woocommerce-email-discount-manager.php
+2 -2
View File
@@ -4,7 +4,7 @@
* Plugin URI: https://gitea.nolimit.dk/kw/woo-discount-manager
* Update URI: https://gitea.nolimit.dk/kw/nolimit-discounts-dist
* Description: Apply discounts and show/hide shipping methods based on the customer's email address (full address, domain or partial match).
* Version: 1.5.1
* Version: 1.5.2
* Author: Kristian Wind
* Author URI: https://gitea.nolimit.dk/kw
* License: GPL-2.0-or-later
@@ -28,7 +28,7 @@ if ( ! defined( 'ABSPATH' ) ) {
exit;
}
define( 'WC_EDM_VERSION', '1.5.1' );
define( 'WC_EDM_VERSION', '1.5.2' );
define( 'WC_EDM_PLUGIN_FILE', __FILE__ );
define( 'WC_EDM_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
define( 'WC_EDM_PLUGIN_URL', plugin_dir_url( __FILE__ ) );