WP.com API: Allow Users to Insert Header Code #34881

Aurorum · 2024-01-06T15:37:13Z

Required for Automattic/wp-calypso#86079

Proposed changes:

This adds an endpoint that ultimately allows users to include Header code on their site.

I thought about adding a separate endpoint like Custom CSS in case it handles a large amount of code, but I decided against it for a few reasons: realistically, I think this will mainly be used for a couple of meta tags; the endpoint already handles large amounts of data (including subscription email HTML and post categories!) and this isn't any larger relative to those, and also I don't think I can add another endpoint on the Calypso side since that's not open-source.

Jetpack product discussion

See Automattic/wp-calypso#56023.

Does this pull request change what data or activity we track or use?

No.

Testing instructions:

I always need help testing endpoints. :) I haven't actually been able to do this from an Atomic site, but I have from a Jetpack one.

Load the Calypso PR and navigate to /settings/header-code/site
Include some header code
Confirm that it's run when you load the site

For example - saving this on the Calypso side:

Should lead to this:

github-actions · 2024-01-06T15:38:07Z

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

✅ Include a description of your PR changes.
✅ Add testing instructions.
✅ Specify whether this PR includes any changes to data or privacy.
✅ Add changelog entries to affected projects

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

The e2e test report can be found here. Please note that it can take a few minutes after the e2e tests checks are complete for the report to be available.

Jetpack plugin:

The Jetpack plugin has different release cadences depending on the platform:

WordPress.com Simple releases happen daily.
WoA releases happen weekly.
Releases to self-hosted sites happen monthly. The next release is scheduled for February 6, 2024 (scheduled code freeze on February 5, 2024).

If you have any questions about the release process, please ask in the #jetpack-releases channel on Slack.

Aurorum · 2024-01-06T15:39:43Z

projects/plugins/jetpack/modules/header-code.php

+	}
+
+	if ( ! empty( $option ) && ! is_admin() ) {
+		echo wp_unslash( $option, 'post' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped


What's the best way of handling escaping for something like this? I wasn't quite sure.

In theory, probably some form of wp_kses(). But since the intent of this is to allow for <script> tags there doesn't seem much point in bothering, since if script tags are allowed an attacker able to set this option could do anything they want anyway.

Pointing that out in a comment might be helpful.

Thanks, will do!

tyxla · 2024-01-10T10:05:41Z

projects/plugins/jetpack/json-endpoints/class.wpcom-json-api-site-settings-endpoint.php

@@ -1115,6 +1116,13 @@ function ( $category_id ) {

 					break;

+				case 'jetpack_header_code':
+					if ( update_option( $key, $value ) ) {


Should we perform any safety checks on save? Are we good with any input without any verification?

Are we good with any input without any verification?

I think so, but happy to be corrected if I'm missing anything obvious. It also seems consistent with what the other options do.

tyxla

It also may be worth discussing if this field should have a UI in Jetpack, or if it's enough to have it in WP.com.

Aurorum · 2024-01-10T10:33:12Z

Would someone from Jetpack mind checking for a product review decision on that? Happy to include some UI if it's something which Jetpack folks would be keen on.

jeherve · 2024-01-10T14:25:52Z

Would someone from Jetpack mind checking for a product review decision on that? Happy to include some UI if it's something which Jetpack folks would be keen on.

That is definitely something we would need to discuss before we move forward. I'll comment on the original issue so we can continue this discussion.
Automattic/wp-calypso#56023 (comment)

github-actions · 2024-04-10T00:49:04Z

This PR has been marked as stale. This happened because:

It has been inactive for the past 3 months.
It hasn’t been labeled `[Pri] BLOCKER`, `[Pri] High`, etc.

If this PR is still useful, please do a [trunk merge or rebase](https://github.com/Automattic/jetpack/blob/trunk/docs/git-workflow.md#keeping-your-branch-up-to-date) and otherwise make sure it's up to date and has clear testing instructions. You may also want to ping possible reviewers in case they've forgotten about it. Please close this PR if you think it's not valid anymore — if you do, please add a brief explanation.

If the PR is not updated (or at least commented on) in another month, it will be automatically closed.

Aurorum · 2024-04-10T09:55:50Z

I still feel this PR is useful! But also still awaiting a product review…wonder if it might be possible to get a decision on that?

github-actions · 2024-07-10T00:49:31Z

This PR has been marked as stale. This happened because:

It has been inactive for the past 3 months.
It hasn’t been labeled `[Pri] BLOCKER`, `[Pri] High`, etc.

If this PR is still useful, please do a [trunk merge or rebase](https://github.com/Automattic/jetpack/blob/trunk/docs/git-workflow.md#keeping-your-branch-up-to-date) and otherwise make sure it's up to date and has clear testing instructions. You may also want to ping possible reviewers in case they've forgotten about it. Please close this PR if you think it's not valid anymore — if you do, please add a brief explanation.

If the PR is not updated (or at least commented on) in another month, it will be automatically closed.

Aurorum added 2 commits January 6, 2024 12:55

Initial commit

bca5ec9

Add endpoint to include header code

333c4b5

Aurorum mentioned this pull request Jan 6, 2024

Settings: Allow Users to Insert Header Code Automattic/wp-calypso#86079

Open

6 tasks

github-actions bot added [Feature] WPCOM API [Plugin] Jetpack Issues about the Jetpack plugin. https://wordpress.org/plugins/jetpack/ labels Jan 6, 2024

github-actions bot added the OSS Citizen This Pull Request was opened by an Open Source contributor. label Jan 6, 2024

Aurorum commented Jan 6, 2024

View reviewed changes

Change default value

287c3e7

anomiex added the [Status] Needs Review To request a review from Crew. Label will be renamed soon. label Jan 8, 2024

Add comment on escaping

1a9d65e

tyxla reviewed Jan 10, 2024

View reviewed changes

jeherve mentioned this pull request Jan 10, 2024

Atomic Sites: Add a Built-In Method to Put Code In Header Automattic/wp-calypso#56023

Open

jeherve added [Status] Blocked / Hold [Status] Needs Product Review Consider posting about this on an internal P2 for discussion and removed [Status] Needs Review To request a review from Crew. Label will be renamed soon. labels Jan 10, 2024

github-actions bot added the [Status] Stale label Apr 10, 2024

github-actions bot removed the [Status] Stale label Apr 11, 2024

github-actions bot added the [Status] Stale label Jul 10, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WP.com API: Allow Users to Insert Header Code #34881

WP.com API: Allow Users to Insert Header Code #34881

Aurorum commented Jan 6, 2024 •

edited

Loading

github-actions bot commented Jan 6, 2024 •

edited

Loading

Aurorum Jan 6, 2024

anomiex Jan 8, 2024

Aurorum Jan 8, 2024

tyxla Jan 10, 2024

Aurorum Jan 10, 2024 •

edited

Loading

tyxla left a comment

Aurorum commented Jan 10, 2024

jeherve commented Jan 10, 2024 •

edited

Loading

github-actions bot commented Apr 10, 2024

Aurorum commented Apr 10, 2024

github-actions bot commented Jul 10, 2024

WP.com API: Allow Users to Insert Header Code #34881

Are you sure you want to change the base?

WP.com API: Allow Users to Insert Header Code #34881

Conversation

Aurorum commented Jan 6, 2024 • edited Loading

Proposed changes:

Jetpack product discussion

Does this pull request change what data or activity we track or use?

Testing instructions:

github-actions bot commented Jan 6, 2024 • edited Loading

Aurorum Jan 6, 2024

Choose a reason for hiding this comment

anomiex Jan 8, 2024

Choose a reason for hiding this comment

Aurorum Jan 8, 2024

Choose a reason for hiding this comment

tyxla Jan 10, 2024

Choose a reason for hiding this comment

Aurorum Jan 10, 2024 • edited Loading

Choose a reason for hiding this comment

tyxla left a comment

Choose a reason for hiding this comment

Aurorum commented Jan 10, 2024

jeherve commented Jan 10, 2024 • edited Loading

github-actions bot commented Apr 10, 2024

Aurorum commented Apr 10, 2024

github-actions bot commented Jul 10, 2024

Aurorum commented Jan 6, 2024 •

edited

Loading

github-actions bot commented Jan 6, 2024 •

edited

Loading

Aurorum Jan 10, 2024 •

edited

Loading

jeherve commented Jan 10, 2024 •

edited

Loading