Release 2.5.15 — sanitized sync (page-context tracking and save-test prune)

Port signed public page_context tokens, selector-proxy redirect lock-down,
and deferred variant pruning from ElementTest-WP 2.5.14 while keeping Doug
Wagner authorship and this repository as the update source.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: DougState

CHANGELOG.md

@@ -2,6 +2,14 @@
 
 `readme.txt` remains the canonical WordPress.org release history for this plugin. This file mirrors the shipped release notes in a GitHub-friendly format.
 
+## 2.5.15
+
+> Public tracking page-context hardening and selector-proxy redirect lock-down, plus admin save-test variant prune reorder so goal validation failures cannot delete variants. Ported from ElementTest-WP 2.5.14 (PRs #7 and #11). JS `VERSION` synced to 2.5.15.
+
+- Fix: **Signed `page_context` tokens** for public assignment, impression, and conversion writes. PHP embeds a signed token (test ID, server-observed URL, expiry) in localized payloads; the frontend sends it on tracking calls. Public write endpoints verify the token and scope writes to the rendered page. Pageview conversions are matched against the stored goal trigger instead of posted `page_url`.
+- Fix: **Admin selector proxy** uses `wp_safe_remote_get()`, disables redirects, and rejects 3xx responses.
+- Fix: **Variant pruning deferred** until after conversion-goal validation and persistence in `save_test()`, so a failed goal save cannot delete omitted variants.
+
 ## 2.5.14
 
 > Plugin author set to Doug Wagner. JS `VERSION` synced to 2.5.14.

README.md

@@ -25,8 +25,50 @@ Ready-to-install zip builds are published on [GitHub Releases](https://github.co
 - Performance analytics with statistical significance
 - Schedule-based test start/stop
 - Export reports as standalone HTML (with Chart.js visual dashboard), CSV, or JSON via admin UI or WP-CLI
+- Admin-only forced-variant preview URLs for QA
+- WP-CLI repair command for legacy JS/CSS variant source mangling
 - Optional GA4 custom event forwarding for variant conversions (fires `elementtest_converted` to your existing `gtag` tag in parallel with the plugin's DB tracking)
 
+## Developer and QA Workflows
+
+### Previewing a specific variant as an admin
+
+Logged-in admins can force the frontend assignment endpoint to return a specific variant for visual QA without waiting on random traffic allocation:
+
+```text
+https://example.com/product/my-page/?et_force=control
+https://example.com/product/my-page/?et_force=123
+```
+
+- `control` selects the control variant for every running test on the page.
+- A numeric value selects the matching `wp_elementtest_variants.variant_id` for that test.
+- The override is gated by `current_user_can( 'manage_options' )`; anonymous visitors and non-admin users ignore the query parameter and stay on the normal weighted assignment path.
+- The request still goes through `elementtest_get_variant_assignment`, page-scope validation, the normal `elementtest_variant_<test_id>` browser cookie, and the HttpOnly assignment-proof cookie. Use a clean browser/profile when you need to test organic random assignment after forcing variants.
+- Production admin preview traffic can still create impressions through the normal tracking flow. Prefer staging for repeated QA passes, or account for admin visits when reviewing report data.
+
+### Repairing pre-2.4.2 JS/CSS variant source
+
+Before 2.4.2, variant `changes` were sanitized with `wp_kses_post()` regardless of test type. For `js` and `css` tests this could encode operators and selectors (`>=` to `&gt;=`, `&&` to `&amp;&amp;`, `.a > .b` to `.a &gt; .b`) so variants either threw JavaScript syntax errors or CSS silently failed to match.
+
+Use the WP-CLI repair command to inspect and optionally decode affected rows:
+
+```bash
+# Dry-run scan of all JS/CSS variants. No database writes.
+wp elementtest fix-variant-changes
+
+# Show compact diffs for JavaScript variants only.
+wp elementtest fix-variant-changes --type=js --show-diff
+
+# Repair with a JSON backup of original rows.
+wp elementtest fix-variant-changes --apply \
+  --backup=variants-backup-$(date +%Y%m%d).json
+
+# Limit the repair to one test.
+wp elementtest fix-variant-changes --test-id=6 --apply --backup=t6.json
+```
+
+The command decodes only the five entity fingerprints produced by the old sanitizer (`&amp;`, `&lt;`, `&gt;`, `&quot;`, `&#039;`/`&#39;`). Other named entities such as `&nbsp;` and `&copy;` are left intact because they may be intentional inside HTML strings.
+
 ## Database Tables
 
 The plugin creates the following tables (prefixed with the WordPress table prefix):

assets/js/frontend.js

@@ -31,7 +31,7 @@ try {
 	// Constants & State
 	// =========================================================================
 
-	var VERSION = '2.5.14';
+	var VERSION = '2.5.15';
 	var OBSERVER_TIMEOUT = 8000; // Max time (ms) to wait for elements via MutationObserver.
 	var ANTIFLICKER_TIMEOUT = 3000; // Max time (ms) before forcing anti-flicker removal.
 
@@ -161,6 +161,29 @@ try {
 		return null;
 	}
 
+	/**
+	 * Find the signed page-context token for a test.
+	 *
+	 * @param {number} testId Test ID.
+	 * @return {string} Signed page-context token, or an empty string.
+	 */
+	function findPageContext( testId ) {
+		var sources = [
+			elementtestFrontend.tests || [],
+			elementtestFrontend.conversionOnlyTests || []
+		];
+
+		for ( var s = 0; s < sources.length; s++ ) {
+			for ( var i = 0; i < sources[ s ].length; i++ ) {
+				if ( String( sources[ s ][ i ].test_id ) === String( testId ) ) {
+					return sources[ s ][ i ].page_context || '';
+				}
+			}
+		}
+
+		return '';
+	}
+
 	/**
 	 * Request a server-authoritative assignment and proof cookie.
 	 *
@@ -177,7 +200,8 @@ try {
 			nonce: elementtestFrontend.nonce,
 			test_id: test.test_id,
 			user_hash: elementtestFrontend.userHash,
-			page_url: window.location.href
+			page_url: window.location.href,
+			page_context: test.page_context || ''
 		};
 
 		if ( elementtestFrontend.isAdmin ) {
@@ -434,7 +458,8 @@ try {
 			nonce: elementtestFrontend.nonce,
 			test_id: testId,
 			variant_id: variantId,
-			user_hash: elementtestFrontend.userHash
+			user_hash: elementtestFrontend.userHash,
+			page_context: findPageContext( testId )
 		};
 
 		sendTrackingRequest( data );
@@ -474,7 +499,8 @@ try {
 			user_hash: elementtestFrontend.userHash,
 			conversion_id: conversionId,
 			revenue: revenue || 0,
-			page_url: window.location.href
+			page_url: window.location.href,
+			page_context: findPageContext( testId )
 		};
 
 		sendTrackingRequest( data );
@@ -1461,6 +1487,7 @@ try {
 			conversion_id: conversionId,
 			revenue: revenue || 0,
 			page_url: window.location.href,
+			page_context: findPageContext( testId ),
 			product_id: productId || '',
 			product_name: productName || '',
 			product_qty: productQty || 1

elementtest-pro.php

@@ -3,7 +3,7 @@
  * Plugin Name: ElementTest Pro
  * Plugin URI: https://github.com/DougState/elementtest-pro
  * Description: A/B test various elements (CSS, copy, JS, images) of your pages and track conversion data to measure performance.
- * Version: 2.5.14
+ * Version: 2.5.15
  * Requires at least: 5.6
  * Tested up to: 7.0
  * Requires PHP: 7.4
@@ -23,7 +23,7 @@
 }
 
 // Define plugin constants
-define( 'ELEMENTTEST_VERSION', '2.5.14' );
+define( 'ELEMENTTEST_VERSION', '2.5.15' );
 define( 'ELEMENTTEST_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 define( 'ELEMENTTEST_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
 define( 'ELEMENTTEST_PLUGIN_BASENAME', plugin_basename( __FILE__ ) );