From 6114473be08406449e3dc7832d839ebcb488c308 Mon Sep 17 00:00:00 2001 From: kristianwind Date: Sun, 20 Sep 2026 18:52:51 +0200 Subject: [PATCH] 1.5.2: take shared-menu 1.2.1, which centres the glyph MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Kristian reported the infinity sign sitting above centre in the admin menu on the live shop. Security traced it to WordPress's own stylesheet rather than adjusting it by eye: #adminmenu div.wp-menu-image is 36x34 and its :before carries padding 7px 0, which is exactly 7 + 20 + 7 for a 20px dashicon at line-height 1. The 1.2.0 rule set line-height 1.4 and inherited that padding, so the pseudo-element was 42px tall inside a 34px parent. 1.2.1 reproduces the box, drops the padding and centres with flex — geometry rather than a nudge, because U+221E sits on the maths axis instead of filling its em box. It is the same half-done abstraction as the escaping fix: the filter made the character configurable and left the geometry tuned for one specific character. Nothing could fail, because the only value anyone ever passed was the one it was tuned for. Verified before copying, including the part that makes the check meaningful: Security predicted php -w WOULD differ this round, since the executable code changed — so equal stripped hashes would have meant the wrong file. They differ, and the diff is the version constant plus the CSS geometry, with wpmgr_css_escape untouched. Co-Authored-By: Claude Opus 5 (1M context) --- README.txt | 2 +- ci/plugin.conf | 8 ++++++-- includes/shared-menu.php | 21 +++++++++++++++++++-- woocommerce-email-discount-manager.php | 4 ++-- 4 files changed, 28 insertions(+), 7 deletions(-) diff --git a/README.txt b/README.txt index e9fe24a..f433e4a 100644 --- a/README.txt +++ b/README.txt @@ -4,7 +4,7 @@ Tags: woocommerce, discount, email, shipping, coupon Requires at least: 5.8 Tested up to: 7.1 Requires PHP: 7.4 -Stable tag: 1.5.1 +Stable tag: 1.5.2 WC requires at least: 6.0 WC tested up to: 11.1.0 License: GPLv2 or later diff --git a/ci/plugin.conf b/ci/plugin.conf index 6e7dc0d..3c86062 100644 --- a/ci/plugin.conf +++ b/ci/plugin.conf @@ -75,7 +75,11 @@ RELEASE_REPO=kw/nolimit-discounts-dist # The frozen hash is therefore a family-wide fact, not a local one, and taking # a new one is something all six do in the same window. # -# 9012fe98 = contract 1.2.0. The glyph is now emitted as CSS numeric escapes +# 678f1f03 = contract 1.2.1: the glyph is centred with flex inside an explicit +# 36x34 box instead of inheriting WordPress's 7px padding, which made the +# pseudo-element 42px tall inside a 34px parent and pushed the sign above +# centre. Kristian reported it from the live shop. +# Earlier: 9012fe98 = contract 1.2.0. The glyph is now emitted as CSS numeric escapes # rather than through esc_attr(): HTML entities are not decoded by the CSS # parser, so esc_attr was protecting by coincidence — and a backslash, which it # leaves alone, IS a CSS escape and swallowed the closing quote. Changing the @@ -83,4 +87,4 @@ RELEASE_REPO=kw/nolimit-discounts-dist # backslashes, hex digits and spaces, so there is nothing left to leave the # string with. Verified here against seven hostile inputs. # Earlier frozen hashes: 184cebdc = 1.1.0, f4862d5c = 1.0.0. -WPMGR_MENU_SHA=9012fe98d867b86c993cee2f8d7b0b9fe5b89817fed4cf45346aa4949e2df307 +WPMGR_MENU_SHA=678f1f0368fcc781ce34c0289f6470a6bb0491bc32c0598e859c7ceba66e5e2a diff --git a/includes/shared-menu.php b/includes/shared-menu.php index bd73360..9a87024 100644 --- a/includes/shared-menu.php +++ b/includes/shared-menu.php @@ -69,7 +69,7 @@ if ( ! defined( 'ABSPATH' ) ) { } if ( ! defined( 'WPMGR_MENU_VERSION' ) ) { - define( 'WPMGR_MENU_VERSION', '1.2.0' ); + define( 'WPMGR_MENU_VERSION', '1.2.1' ); } if ( ! defined( 'WPMGR_MENU_SLUG' ) ) { @@ -160,6 +160,23 @@ if ( ! function_exists( 'wpmgr_ensure_menu' ) ) { * `font-family` has to be overridden: WordPress sets the icon wrapper to * the Dashicons font, and Dashicons has no infinity glyph, so inheriting * it renders nothing at all. + * + * 🔴 The box is WordPress's own, measured rather than guessed, and the + * glyph is centred in it geometrically rather than nudged. + * + * wp-admin/css/admin-menu.css sets `#adminmenu div.wp-menu-image` to + * 36x34, and `div.wp-menu-image:before` to `padding: 7px 0` — which is + * exactly 7 + 20 + 7 for a 20px dashicon on `line-height: 1`. The first + * version of this rule set `line-height: 1.4` and inherited that padding, + * making the line box 28px and the whole pseudo-element 42px inside a 34px + * parent. Kristian reported the result: the glyph sitting above centre. + * + * So: reproduce the 36x34 box, drop the padding that only existed to + * position a 20px line inside it, and centre with flex. That matters more + * for an arbitrary glyph than for a dashicon — U+221E sits on the maths + * axis rather than filling its em box, so any rule that positions by + * line-height and padding is positioning the box and hoping about the + * glyph. `align-items: center` centres what is actually drawn. */ function wpmgr_menu_glyph_style() { $glyph = apply_filters( 'wpmgr_menu_glyph', '∞' ); @@ -170,7 +187,7 @@ if ( ! function_exists( 'wpmgr_ensure_menu' ) ) { // phpcs:disable WordPress.Security.EscapeOutput.OutputNotEscaped -- the slug is reduced to [a-z0-9_-] and the glyph to CSS numeric escapes; both are escaped for the context they are printed in, which is CSS rather than HTML. printf( - '', + '', preg_replace( '/[^a-z0-9_-]/', '', strtolower( WPMGR_MENU_SLUG ) ), wpmgr_css_escape( $glyph ) ); diff --git a/woocommerce-email-discount-manager.php b/woocommerce-email-discount-manager.php index 6ae7146..9b2a471 100644 --- a/woocommerce-email-discount-manager.php +++ b/woocommerce-email-discount-manager.php @@ -4,7 +4,7 @@ * Plugin URI: https://gitea.nolimit.dk/kw/woo-discount-manager * Update URI: https://gitea.nolimit.dk/kw/nolimit-discounts-dist * Description: Apply discounts and show/hide shipping methods based on the customer's email address (full address, domain or partial match). - * Version: 1.5.1 + * Version: 1.5.2 * Author: Kristian Wind * Author URI: https://gitea.nolimit.dk/kw * License: GPL-2.0-or-later @@ -28,7 +28,7 @@ if ( ! defined( 'ABSPATH' ) ) { exit; } -define( 'WC_EDM_VERSION', '1.5.1' ); +define( 'WC_EDM_VERSION', '1.5.2' ); define( 'WC_EDM_PLUGIN_FILE', __FILE__ ); define( 'WC_EDM_PLUGIN_DIR', plugin_dir_path( __FILE__ ) ); define( 'WC_EDM_PLUGIN_URL', plugin_dir_url( __FILE__ ) );