Release 2.5.13: save-validation and assignment cookie path fixes

Port admin save fail-closed behavior and the assignment proof cookie
path fix so admin-ajax receives signed cookies on split home/siteurl installs.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: DougState

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 `readme.txt` remains the canonical WordPress.org release history for this plugin. This file mirrors the shipped release notes in a GitHub-friendly format.
 
+## 2.5.13
+
+> Admin save-validation hardening and assignment proof cookie path fix for split home/siteurl installs. JS `VERSION` synced to 2.5.13.
+
+- Fix: **Admin save fail-closed** for invalid existing variants/goals (ported from ElementTest-WP PR #4).
+- Fix: **Assignment proof cookie path** set to `/` so admin-ajax.php receives the signed cookie on split home/siteurl installs.
+
 ## 2.5.12
 
 > Update-source visibility: each real GitHub release check records its outcome (`ok`, `http_<code>`, `network_error`, etc.) in the non-autoloaded `elementtest_update_status` option. The Plugins-screen row shows a colored status line ("Updates: GitHub ✓ latest 2.5.12, checked 2 hours ago" / "check failing"), and a warning notice appears on plugins.php for users with `update_plugins` when checks fail. On installs updating from a private mirror, the notice distinguishes a missing access token from an expired/revoked one; the token value is never rendered anywhere. JS `VERSION` synced to 2.5.12.

assets/js/frontend.js

@@ -31,7 +31,7 @@ try {
 	// Constants & State
 	// =========================================================================
 
-	var VERSION = '2.5.12';
+	var VERSION = '2.5.13';
 	var OBSERVER_TIMEOUT = 8000; // Max time (ms) to wait for elements via MutationObserver.
 	var ANTIFLICKER_TIMEOUT = 3000; // Max time (ms) before forcing anti-flicker removal.
 

elementtest-pro.php

@@ -3,7 +3,7 @@
  * Plugin Name: ElementTest Pro
  * Plugin URI: https://github.com/DougState/elementtest-pro
  * Description: A/B test various elements (CSS, copy, JS, images) of your pages and track conversion data to measure performance.
- * Version: 2.5.12
+ * Version: 2.5.13
  * Requires at least: 5.6
  * Tested up to: 7.0
  * Requires PHP: 7.4
@@ -24,7 +24,7 @@
 }
 
 // Define plugin constants
-define( 'ELEMENTTEST_VERSION', '2.5.12' );
+define( 'ELEMENTTEST_VERSION', '2.5.13' );
 define( 'ELEMENTTEST_PLUGIN_DIR', plugin_dir_path( __FILE__ ) );
 define( 'ELEMENTTEST_PLUGIN_URL', plugin_dir_url( __FILE__ ) );
 define( 'ELEMENTTEST_PLUGIN_BASENAME', plugin_basename( __FILE__ ) );

includes/class-ajax-handler.php

@@ -288,7 +288,10 @@ private function set_assignment_proof_cookie( $test_id, $variant_id, $user_hash
 		$expires_at = time() + $ttl;
 		$token      = $this->create_assignment_token( $test_id, $variant_id, $user_hash, $expires_at );
 		$name       = $this->get_assignment_cookie_name( $test_id );
-		$path       = ( defined( 'COOKIEPATH' ) && COOKIEPATH ) ? COOKIEPATH : '/';
+		// Public tracking writes go through admin-ajax.php, which may live
+		// outside COOKIEPATH on split home/siteurl installs. Scope the signed
+		// proof cookie broadly so the AJAX verifier can receive it.
+		$path       = '/';
 		$options    = array(
 			'expires'  => $expires_at,
 			'path'     => $path,
@@ -540,6 +543,11 @@ public function save_test() {
 				$v_control = isset( $variant_data['is_control'] ) ? absint( $variant_data['is_control'] ) : 0;
 
 				if ( empty( $v_name ) ) {
+					if ( $v_id > 0 ) {
+						wp_send_json_error(
+							array( 'message' => __( 'Variant name is required.', 'elementtest-pro' ) )
+						);
+					}
 					continue;
 				}
 
@@ -553,23 +561,50 @@ public function save_test() {
 
 				if ( $v_id > 0 ) {
 					// Update existing variant (preserves variant_id for event data).
-					$wpdb->update(
+					$variant_exists = $wpdb->get_var(
+						$wpdb->prepare(
+							"SELECT variant_id FROM {$variants_table} WHERE variant_id = %d AND test_id = %d",
+							$v_id,
+							$test_id
+						)
+					);
+
+					if ( ! $variant_exists ) {
+						wp_send_json_error(
+							array( 'message' => __( 'Variant not found for this test.', 'elementtest-pro' ) )
+						);
+					}
+
+					$variant_result = $wpdb->update(
 						$variants_table,
 						$v_data,
 						array( 'variant_id' => $v_id, 'test_id' => $test_id ),
 						array( '%d', '%s', '%s', '%d', '%d' ),
 						array( '%d', '%d' )
 					);
+
+					if ( false === $variant_result ) {
+						wp_send_json_error(
+							array( 'message' => __( 'Failed to update variant.', 'elementtest-pro' ) )
+						);
+					}
 					$submitted_variant_ids[] = $v_id;
 				} else {
 					// Insert new variant.
 					$v_data['created_at'] = current_time( 'mysql', true );
-					$wpdb->insert(
+					$variant_result       = $wpdb->insert(
 						$variants_table,
 						$v_data,
 						array( '%d', '%s', '%s', '%d', '%d', '%s' )
 					);
-					$submitted_variant_ids[] = $wpdb->insert_id;
+
+					if ( false === $variant_result || ! $wpdb->insert_id ) {
+						wp_send_json_error(
+							array( 'message' => __( 'Failed to create variant.', 'elementtest-pro' ) )
+						);
+					}
+
+					$submitted_variant_ids[] = absint( $wpdb->insert_id );
 				}
 			}
 
@@ -605,11 +640,25 @@ public function save_test() {
 				$g_revenue = isset( $goal_data['revenue_value'] ) ? floatval( $goal_data['revenue_value'] ) : 0.00;
 
 				if ( empty( $g_name ) || empty( $g_type ) ) {
+					$is_blank_new_goal = 0 === $g_id
+						&& empty( $g_name )
+						&& empty( $g_selector )
+						&& empty( $g_url )
+						&& empty( $g_event )
+						&& 0.0 === $g_revenue;
+
+					if ( ! $is_blank_new_goal ) {
+						wp_send_json_error(
+							array( 'message' => __( 'Conversion goal name and trigger type are required.', 'elementtest-pro' ) )
+						);
+					}
 					continue;
 				}
 
 				if ( ! in_array( $g_type, $this->valid_trigger_types, true ) ) {
-					continue;
+					wp_send_json_error(
+						array( 'message' => __( 'Invalid conversion goal trigger type.', 'elementtest-pro' ) )
+					);
 				}
 
 				// Determine trigger_event based on type.
@@ -631,13 +680,33 @@ public function save_test() {
 
 				if ( $g_id > 0 ) {
 					// Update existing conversion goal.
-					$wpdb->update(
+					$goal_exists = $wpdb->get_var(
+						$wpdb->prepare(
+							"SELECT conversion_id FROM {$conversions_table} WHERE conversion_id = %d AND test_id = %d",
+							$g_id,
+							$test_id
+						)
+					);
+
+					if ( ! $goal_exists ) {
+						wp_send_json_error(
+							array( 'message' => __( 'Conversion goal not found for this test.', 'elementtest-pro' ) )
+						);
+					}
+
+					$goal_result = $wpdb->update(
 						$conversions_table,
 						$g_data,
 						array( 'conversion_id' => $g_id, 'test_id' => $test_id ),
 						array( '%d', '%s', '%s', '%s', '%s', '%f' ),
 						array( '%d', '%d' )
 					);
+
+					if ( false === $goal_result ) {
+						wp_send_json_error(
+							array( 'message' => __( 'Failed to update conversion goal.', 'elementtest-pro' ) )
+						);
+					}
 					$submitted_goal_ids[] = $g_id;
 				} else {
 					// Insert new conversion goal.
@@ -651,7 +720,14 @@ public function save_test() {
 						error_log( '[ElementTest] Goal insert failed. DB Error: ' . $wpdb->last_error ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Gated behind WP_DEBUG; silent in production.
 						error_log( '[ElementTest] Goal data: ' . wp_json_encode( $g_data ) ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- Gated behind WP_DEBUG; silent in production.
 					}
-					$submitted_goal_ids[] = $wpdb->insert_id;
+
+					if ( false === $goal_result || ! $wpdb->insert_id ) {
+						wp_send_json_error(
+							array( 'message' => __( 'Failed to create conversion goal.', 'elementtest-pro' ) )
+						);
+					}
+
+					$submitted_goal_ids[] = absint( $wpdb->insert_id );
 				}
 			}
 

readme.txt

@@ -3,7 +3,7 @@ Contributors: Doug Wagner
 Tags: ab-testing, split-testing, conversion, optimization, analytics
 Requires at least: 5.6
 Tested up to: 7.0
-Stable tag: 2.5.12
+Stable tag: 2.5.13
 Requires PHP: 7.4
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -63,6 +63,11 @@ All testing data is stored in your WordPress database. No external services are
 
 == Changelog ==
 
+= 2.5.13 =
+* Fix: Admin test saves now fail closed when an existing variant or conversion goal row is invalid or cannot be written. Previously, malformed rows could be silently skipped and the editor could still show "Test saved successfully."
+* Fix: Assignment proof cookie path is now `/` so admin-ajax.php can receive the signed cookie on split home/siteurl installs.
+* Internal: JS `VERSION` constant in `assets/js/frontend.js` synced to 2.5.13.
+
 = 2.5.12 =
 * Add: update-source status indicator on the Plugins screen row (last check result and latest available version) and a warning notice when the release check fails — so update problems are never silent. On private mirrors, the notice also flags a missing or expired access token; the token value itself is never displayed.