Release 2.5.16 — sanitized sync (selector iframe and nginx proxy AppSec)

Port the ElementTest-WP 2.5.16 security fixes and the unpublished 2.5.15 tracking fixes, while keeping this repository as the update source.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: DougState

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 `readme.txt` remains the canonical WordPress.org release history for this plugin. This file mirrors the shipped release notes in a GitHub-friendly format.
 
+## 2.5.16
+
+> AppSec hardening for the admin element selector iframe and the Nginx reverse-proxy IP trust model, plus the tracking fixes from ElementTest-WP 2.5.15 that were not in the published public 2.5.15. JS `VERSION` synced to 2.5.16.
+
+- Security: **Element selector iframe no longer combines `allow-scripts` with `allow-same-origin`.** Proxied page JS cannot read `elementtestAdmin` / the admin nonce from `window.parent` or drive privileged `admin-ajax.php` actions with the admin session. Selector communication stays on `postMessage`; the inject script targets `*` because the sandboxed frame has an opaque origin.
+- Security: **`proxy_page()` strips scripts / `javascript:` URLs / inline event handlers** from proxied HTML and emits a CSP that only allows the plugin's selector inject script.
+- Security: **Nginx reverse-proxy preset ships no default trusted CIDRs.** Loopback/RFC1918 defaults let clients spoof `X-Forwarded-For` / `X-Real-IP` on common php-fpm setups where `REMOTE_ADDR` is always `127.0.0.1`. Declare proxy egress via `elementtest_trusted_proxy_cidrs`; without it, forwarded headers are ignored.
+- Fix: **Hash-fragment pageview goals** (`/thank-you#paid`, query+hash, and hash wildcards) now accept the browser fragment after the fragmentless path/query matches the signed `page_context` URL.
+- Fix: **Cached public tracking** can authenticate with an unexpired signed `page_context` token when the localized public nonce is stale. Endpoint handlers still verify test, page/goal scope, assignment proof, and rate limits.
+- Fix: **Percent-encoded request URIs** are preserved when minting frontend page-context URLs. Control characters are still stripped.
+- Fix: **Page-context token TTL** now follows the Cookie Duration setting (`cookie_days`, default 30 days, capped at 365). `elementtest_page_context_token_ttl` can still shorten or extend the default.
+
 ## 2.5.15
 
 > Public tracking page-context hardening and selector-proxy redirect lock-down, plus admin save-test variant prune reorder so goal validation failures cannot delete variants. Ported from ElementTest-WP 2.5.14 (PRs #7 and #11). JS `VERSION` synced to 2.5.15.

README.md

@@ -191,7 +191,7 @@ If only Apache is listening on 80/443, select **None**. If Nginx is on 80/443 wi
 Forwarded headers (`X-Forwarded-For`, `X-Real-IP`, `CF-Connecting-IP`, or your custom header) are spoofable by any client that connects to WordPress directly, so ElementTest only honors them when the **direct connection** (`REMOTE_ADDR`) comes from a trusted proxy:
 
 - **Cloudflare** — trusts requests arriving from Cloudflare's published edge IP ranges.
-- **Nginx / Managed Hosting** — trusts requests arriving from loopback and private (RFC1918) ranges, which covers same-host and internal-network reverse proxies.
+- **Nginx / Managed Hosting** — enables reading `X-Real-IP` / `X-Forwarded-For`, but ships **no default trusted CIDRs** (loopback/RFC1918 defaults were unsafe on common php-fpm setups where every request appears as `127.0.0.1`). Add your proxy's egress range with `elementtest_trusted_proxy_cidrs` or forwarded headers stay ignored.
 - **Custom** — ships no trusted ranges by default; you must declare the IP(s) your proxy connects from (see below).
 
 When the direct connection is **not** a trusted proxy, forwarded headers are ignored and the direct connection IP is used. A request that bypasses the proxy and hits `admin-ajax.php` directly therefore cannot forge its IP to evade rate limiting or deduplication.
@@ -208,7 +208,7 @@ add_filter( 'elementtest_trusted_proxy_headers', function () {
 } );
 ```
 
-`elementtest_trusted_proxy_cidrs` — the IP ranges your proxy connects **from**. Add this if your proxy (or load balancer) reaches WordPress from a public IP not covered by the presets above; otherwise its forwarded headers will be ignored:
+`elementtest_trusted_proxy_cidrs` — the IP ranges your proxy connects **from**. Required for the Nginx and Custom presets (and for Cloudflare if you terminate TLS on your own edge). Example for a load balancer that reaches WordPress from a known egress range:
 
 ```php
 add_filter( 'elementtest_trusted_proxy_cidrs', function ( $cidrs ) {
@@ -217,6 +217,16 @@ add_filter( 'elementtest_trusted_proxy_cidrs', function ( $cidrs ) {
 } );
 ```
 
+If PHP-FPM only accepts connections from Nginx on the same host **and** the web server is locked down so clients cannot reach PHP directly, you may include loopback explicitly (this is no longer the plugin default):
+
+```php
+add_filter( 'elementtest_trusted_proxy_cidrs', function ( $cidrs ) {
+    $cidrs[] = '127.0.0.1/32';
+    $cidrs[] = '::1/128';
+    return $cidrs;
+} );
+```
+
 Both IPv4 and IPv6 CIDRs are supported. A bare IP (no `/`) is treated as a single host.
 
 ## Report Export (WP-CLI)

assets/js/element-selector.js

@@ -60,7 +60,10 @@
 							'<div class="ets-loading-spinner"></div>' +
 							'<span>Loading page&hellip;</span>' +
 						'</div>' +
-						'<iframe id="ets-iframe" class="ets-iframe" sandbox="allow-same-origin allow-scripts"></iframe>' +
+						// Scripts-only sandbox: omit allow-same-origin so proxied
+						// page JS cannot read parent.elementtestAdmin (admin nonce)
+						// or call privileged admin-ajax with the admin session.
+						'<iframe id="ets-iframe" class="ets-iframe" sandbox="allow-scripts"></iframe>' +
 					'</div>' +
 
 					/* Bottom panel — selected element info */
@@ -172,6 +175,11 @@
 	function handleMessage( event ) {
 		var data;
 
+		// Ignore messages when the selector is closed.
+		if ( ! isOpen ) {
+			return;
+		}
+
 		try {
 			data = ( typeof event.data === 'string' ) ? JSON.parse( event.data ) : event.data;
 		} catch ( e ) {

assets/js/frontend.js

@@ -31,7 +31,7 @@ try {
 	// Constants & State
 	// =========================================================================
 
-	var VERSION = '2.5.15';
+	var VERSION = '2.5.16';
 	var OBSERVER_TIMEOUT = 8000; // Max time (ms) to wait for elements via MutationObserver.
 	var ANTIFLICKER_TIMEOUT = 3000; // Max time (ms) before forcing anti-flicker removal.
 

assets/js/selector-inject.js

@@ -323,7 +323,11 @@
 		}
 
 		try {
-			window.parent.postMessage( JSON.stringify( msg ), window.location.origin );
+			// Target '*' so postMessage still works when the iframe is sandboxed
+			// without allow-same-origin (opaque unique origin). The parent
+			// validates msg.source === 'elementtest-selector' and only accepts
+			// messages while the selector overlay is open.
+			window.parent.postMessage( JSON.stringify( msg ), '*' );
 		} catch ( e ) {
 			// Silently ignore.
 		}

elementtest-pro.php

@@ -3,7 +3,7 @@
  * Plugin Name: ElementTest Pro
  * Plugin URI: https://github.com/DougState/elementtest-pro
  * Description: A/B test various elements (CSS, copy, JS, images) of your pages and track conversion data to measure performance.
- * Version: 2.5.15
+ * Version: 2.5.16
  * Requires at least: 5.6
  * Tested up to: 7.0
  * Requires PHP: 7.4
@@ -23,7 +23,7 @@
 }
 
 // Define plugin constants
-define( 'ELEMENTTEST_VERSION', '2.5.15' );
+define( 'ELEMENTTEST_VERSION', '2.5.16' );
 define( 'ELEMENTTEST_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 define( 'ELEMENTTEST_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
 define( 'ELEMENTTEST_PLUGIN_BASENAME', plugin_basename( __FILE__ ) );
@@ -120,7 +120,7 @@ public function resolve_proxy_headers( $headers ) {
      * Forwarded IP headers are only honored when the direct connection
      * (REMOTE_ADDR) falls inside one of these ranges, so a request that
      * bypasses the proxy cannot spoof its IP. Sites whose proxy connects
-     * from a public IP not covered by the defaults below should add their
+     * from a public IP (or any nginx/managed-host setup) should add their
      * proxy's CIDR via the `elementtest_trusted_proxy_cidrs` filter.
      *
      * @since  2.5.4
@@ -160,16 +160,13 @@ public function resolve_proxy_cidrs( $cidrs ) {
                 ) );
                 break;
             case 'nginx':
-                // Loopback + RFC1918 private ranges: the same-host or
-                // internal-network reverse proxy used by most managed hosts.
-                $cidrs = array_merge( $cidrs, array(
-                    '127.0.0.0/8',
-                    '10.0.0.0/8',
-                    '172.16.0.0/12',
-                    '192.168.0.0/16',
-                    '::1/128',
-                    'fc00::/7',
-                ) );
+                // Intentionally ships no default CIDRs. Trusting loopback /
+                // RFC1918 by default is unsafe on common php-fpm setups where
+                // REMOTE_ADDR is 127.0.0.1 for every request — any client that
+                // can reach PHP (or whose connection appears as loopback) could
+                // spoof X-Forwarded-For / X-Real-IP. Declare your proxy's real
+                // egress CIDR via the elementtest_trusted_proxy_cidrs filter;
+                // without it, forwarded headers are ignored (secure default).
                 break;
             // 'custom' ships no default CIDRs — the admin supplies the
             // proxy's address range via the elementtest_trusted_proxy_cidrs