From 4c3f0c61bbcebcdc38e53ef05416fd3918f78485 Mon Sep 17 00:00:00 2001 From: "Dave (translate via Sonnet 4.6)" Date: Thu, 5 Nov 2026 22:38:57 -0700 Subject: [PATCH] fix: harden frontend account returns and empty-card rendering --- DESIGN.md | 4 ++++ .../frontend-account-example-source.md | 20 ++++++++++++------ static/downloads/frontend-account-example.zip | Bin 7072 -> 7239 bytes static/downloads/frontend-account/canvas.php | 5 +++-- static/downloads/frontend-account/portal.css | 2 -- .../frontend-account/ums-account-example.php | 13 ++++++++++-- 6 files changed, 32 insertions(+), 12 deletions(-) diff --git a/DESIGN.md b/DESIGN.md index c98aa03ac..a4b8f9535 100644 --- a/DESIGN.md +++ b/DESIGN.md @@ -31,6 +31,10 @@ page markup and scoped CSS together in the downloadable package. - Guests see sign-in/recovery guidance, not empty private widgets. Exclude all account/checkout routes from upstream caching as well as sending no-cache headers. Presentation gating never replaces model ownership checks. +- Guest sign-in and recovery preserve the validated local request path and query, + including selected-site and membership context; do not accept external returns. +- Remove only completely empty example-owned card wrappers after native content + renders. Never hide populated cards based on internal widget class names. Screenshot assets show synthetic data and actual rendered product states, not reconstructed UI. Use viewport captures (at most 1568px on the longest diff --git a/docs/user-guide/client-management/frontend-account-example-source.md b/docs/user-guide/client-management/frontend-account-example-source.md index 66f34ebd4..c32eed2c5 100644 --- a/docs/user-guide/client-management/frontend-account-example-source.md +++ b/docs/user-guide/client-management/frontend-account-example-source.md @@ -20,7 +20,7 @@ build step is required. Do not put PHP in page content or edit Ultimate Multisit /** * Plugin Name: Ultimate Multisite Account Page Example * Description: An optional presentation layer for native Ultimate Multisite shortcodes. - * Version: 1.0.0 + * Version: 1.0.1 * License: GPL-2.0-or-later * Text Domain: ums-account-example */ @@ -47,9 +47,18 @@ add_action('template_redirect', function () { add_action('wp_enqueue_scripts', function () { if (ums_account_example_is_page()) { - wp_enqueue_style('ums-account-example', plugins_url('portal.css', __FILE__), [], '1.0.0'); + wp_enqueue_style('ums-account-example', plugins_url('portal.css', __FILE__), [], '1.0.1'); } }); + +add_filter('the_content', function ($content) { + if (!ums_account_example_is_page()) { + return $content; + } + + // After blocks/shortcodes render, omit only our own completely empty cards. + return preg_replace('/]*\sclass="[^"]*\bums-card\b[^"]*"[^>]*>\s*<\/div>/', '', $content); +}, 20); ``` ### `canvas.php` @@ -79,12 +88,13 @@ defined('ABSPATH') || exit;
+

- - + +
@@ -132,10 +142,8 @@ body.ums-account-canvas { margin: 0; background: #f7f8f5; } .ums-section-heading > span { color: var(--muted); font-size: 10px; font-weight: 700; letter-spacing: .13em; } .ums-section-copy { color: var(--muted); margin: -4px 0 20px; font-size: 14px; max-width: 640px; } .ums-card { background: var(--paper); border: 1px solid var(--line); border-radius: 12px; overflow-wrap: anywhere; min-width: 0; } -.ums-card:empty { display: none; } .ums-detail-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 20px; } .ums-site-detail { display: grid; gap: 20px; margin-top: 20px; } -.ums-site-detail > .ums-card:not(:has(.wu-current-site)), .ums-detail-grid > .ums-card:not(:has(.wu-styling)), .ums-invoices:not(:has(.wu-invoices)) { display: none; } .ums-invoices { margin-top: 20px; } .ums-portal .wu-styling { font-family: inherit; font-size: 14px; line-height: 1.6; } .ums-portal .wu-styling h3 { font-size: 16px; color: var(--ink); } diff --git a/static/downloads/frontend-account-example.zip b/static/downloads/frontend-account-example.zip index 5e69cb8f5106b069382d166dbf72f34bed91a2b4..065735697fc966519ce0283ea8fd283fbbe60b58 100644 GIT binary patch delta 3938 zcmV-o51sI!H^(@z7YGRubv6xV0{{TzlOPBte^%db+cpq>j{l0QRzPwP$H?m<*=UCh z+taqBT~QQ+KuKqbFhz1CWhX%Y_#G+BP}Fn^&?l4B-FM&pcDmJ#UaT)K;ScS&l1zYR zHA2bcf!SMNLI5jE)ky~xb8O8@FJ{4D%eVx|96umv(baTQoztDWhRgM$!X1}bCGorW ze-D4Y`|w-5gs)!#AGy0-Y&YqfN|o+OBQ&lRn?>q>AoXNGFj;rRA!p7RUUUv^vb=@u z#)~1VHj9h2MaQ6Qn6c=xsMo`?QGm7#dP$8gFN7jiJC(#I(RdkvqBDeKEoRYy<54T) zA}Ez~C<*e&E7xQd9(akXaJd35x#LW%e{9JFW;X#PSU&396YE(n(sj==EmZY%^2s0b zQZQ?ixNGg|6w*~6=6G;#KnvnZqZ}Z~S+AT$UfJ%sj-WBP%c7tBgU>{?IYog2;DecC z5f2;DtTo8k-5c_k5CipW>65 zLDRcRq^Bl(hgO0WC|(NZFP(Kn-M~?qJt>zs6VYJJTMAHo2MM=%XVK)uuEr|ol;9=& z>{EO(jiTkXq<;FJI8vby4#|X@fA?CWX_?@1Pq0H^zpV-a_MJLk4g+(P72kzIyy%M? z&AImHyh_8E;MI^-s#I{S;IhKUELz0OJG5@i{TR%Mjc;D-DlN}s?Sd( zP|{D|`C8PyrRL@Z*iR@*Dr_iNxxb#lA%LFp_bQ7x(a33;^lRkF6Ska2_!YF+7HDik zGl}K{6kJgB>N$J*h1Q^*f8dmy?F=5$os3dH(-b}R!1>i9^BZ#ib{uEB);diJl*#J# z6n|BwR<5TvXm4ND#FOS2b@NUs_k61NFVT;T*Rkfbctb5*LpV!(bbg6zGB{TTr@`H` z^E;L{)o5Y%@8<>V_h(qd;m^f?P)h>@6aWAK2mk;8AzU7jdV)a#vvv#10tz=@i0gd_ z001N&lOYHie{gSdbYW~RV{>zzS>KQ2wh?~6zk=OEf%RdvC&{vG%jh9(fdqX>9-8*4 z$O9#fY<4A4(GPo_Apd)Zq$HD+WM6L=*tIBfhMf84o8kELC-T=M;a%Ahc&9~`1L0+U zjY!E!m3K#05?+(`1OjKw_G_9cz4@M&x6*&34)5K>qk3*Hyf3X^!(9hm~*m-UA=}@PN-n*MeBF*@xRr zDn@cv0uH1J_~~8@pjIeb99oB)WG#m(T0t%JWZ8ivJm>guruDOwzdDeNiv?a-y?^#z zL(*KEe-;X-V=u&^6`H_NBQNA{sO{}Xn*1!EzsF@SG4c0ytfXT7iwW4 zhi6#>c*s{DiiwaY<4M;zXV$Pdx3&~_ZOhAhe=}HFb*(u8cg4F_xn^CxlZNLkB_Cri z-1+On@NV2xP)!aNMGfSTw2YUxBYyOD{@zP1^q}kGcs~kgc@#Z6~KOayI%shm zYr(uVWd!qf6a!*Yr4YNFCgishrhw2wWkq`33dp){#)LLHg>20;5xq zk7)&eeSb;e5<2?1B|XoWUszN>f|y11c`8y>P;RQFpw+1;m zC-5>X6}ql@is;18D%0p>3R_6he{2fPsO0T)bfV33gcvwNyIPT(tpA*9$o}&5QAj*9 zxIF#RyZ5$UEFIquGQL3sA`hB7>*f2U#WBlsVd3TF{ftHJh)H~XcLV*Dr(Y(vT?0*b zHxBeS!N!jbub?VD--Y|_K6DS$*pLH=V@C0R*%io%Nkm#2cRAu62bxI`f1m^5Mp-gC z!(bAyexRXKh44H%&c>3y&$S*lsM|?-t4B_p^W<$zAV&UB5u%%Jo9y=iorKNC{qv|J zLERW`ed6!M-Z0O~w&wWq#$7casj@TZMS!5jwN?a-d3^0o_5^zX5h`j=x}ii#5+unq z1?p7N7dj`e=RR>7mn1nBf8EcbHhCez`SLMiN&8dd*YoNBuFkxR!yHS{x&-ePd9e`NLWQ)N<<)I84} z{e?={=2|==6(F4^AHzN|#Z1k_QU2Rua?Y+pTtr0Dm=i;L0Vs!@HHURGXQK(h!POXa(;0xwQwCRua^_laG2-26k5u1N7ON2T~^jm0d1fC z7pt@!YD-@~qe!&9mW9H}UvZ3oF&j$QDMyKN%Hm5IZb=b75=3kGFq@)QUw}; zwKLw46fzJ4-s|rPJ*}+@^Z`ZAi1>mwI9q3N?=29YB{(28e=pPvlbrl0`vTL#@xG4u zh$x^}$8+8LdWMNU<{_(e$#xl?c4!O%s!`xnHA4$rXVE|2?)pQ_cP`8;qIuk{Q74OR z?M-ulO4Xu&a-u1}4BY@JTkz$lrF`F;Il;LucVIJbFYm2tJBF~S~kCQ3ooIC1gETA^Cj z#=4BXe?!`Lvv#Tnl@0gN->?Em;ayan;>Z39L;GrB{Jz4#gV6n50V$*8S&u-uF}zrP zAjIrno2}{Lz{KiH;KYS$&fB_6O+uqn7umAMtMd5XHQt-0<$`uw@3?wos@s)x&_8RS z?UH@;P~MusFG#JAKdoQ>hbdxg3y#1aB520Oe|B(~&XIqDouTB`LDk!(7^{iSQj^r` z2Xj)4o~hN*S=zqpXntd<9~!$D+MZ_RWe~9)5RhgrY-ea*ir>uwZuZ(^HfIbbFq<=@ zIJ>jbs}I&QO5<9VSU5MXS9gs0@EYuyZd zFp@)ikPHb=ONhR2vuNN>*DrCfHwNkd08mQ<1QY-O00;m803lr3c8H>O0ssIs1(Pus zGJjO>PunmM{oMQ&H#99t)h56! z@uJMJ#+{%QMwU)$wGTrD+8=oir9q3z@qhXXIbWiInKqy(aD$r|>_QtSbcQym6aPSC zebSv|JK3ot=Te}uB=6(syuX`l_qFNgl*7~yFYwO6i7vP#NLAQAe-zxumDV)Ka3&RI zQ8;}6Z8W_26vl9W4|pftK@jjPV>6jkz9@7HERdB{D|1M2VzFTlW|b1Yp6Kl=9Dl>_ zptHV?!#26#>W15dd=4*R0E`iJW8|$i*S6#WA!;PX#1L+f9>xbj$Dpf>f;G`W@Idik zC5eEn0kQ_jr1dpKUSpGC9eei<{w5X%g8|IZJ-2{a8j`3E|EkbP%$T13MB$jsqL{=y zyfED1*?(8YAb~J#tKDDwLMnQ&w-+}J<({sk#b724X?`Zg zYmhUDUKQZq>L@L^SRh*<&uB!Wx;YPzy=W8OmJAiyRFP|bLF|7swo|!fj?u;;=|SmN z*s{vxQCQM4@jMZ>=4I@|+4(7BaSz6qG-Q6I!WYV0v(JQ9j+Xa%$C}_u`hS~$(Ec>G z4c0RToiv5vjL2Y`YjJJU_3DE`MYi@p7t(=N`4V(xK;J45x+ZW)A!?>ug5V~jZ^aV_ zeQ@T~UTU)-i_*hP-b|+BtE0>A#EP6-JJ=duZP9I7+gF3@#}wG|FC9&6_i&OD>L{%j zk$$U+{ZQ?0)Bhh(O928D1Cvu3vI!7%HVtM20088Z4jNqos|%A68yAz63lNj_84#1C z8X5vG4U-WY7n2zc4wLm65F0mNi0gd_001N&0015U0000000000005+ce3K9xF&x@< wh@y4^001-v001ih0000000000005+cH5Zc+1QwG^7Z;O?8xRKc82|tP0KBS*4*&oF delta 3759 zcmYk9WmMFQ7R86|E{8#yfdPgT96%ZzNeM}5K~YLXMnvJyfJjIW-5_ zlo)uF)KKrfx7J(to%7+Web)Z?`>^)_BKIzqgOX}DU3={|2?&J7@KQnnGh?qcdD=kF zK(Yd?Ui=#UQ0Vl0nPA36g+($G@;fd2eI;5hwp~w*AJ>*ULF9k48V2rkM81!YLeZm71?ioF;sY7mho*~@xCdOxl{uW25C)2 z59ev@Rg@qfRyGC%Z`eu+xW6gOc*Prw`{R21+#~t2WJ@m2E#H1DzUswaX;XF_=W};D zqSfZeG*;CXc0@LvYmdQqtlyf@zGbf1Yk=R@*2McYQRIE#5Sgh2)O8jH!kGnf^x49N zlFMFUER*Xz?MD?tpG-Y?T{$?=RWT}LTP(9->d#_*XXfK1>Ch1Qh6j7*l6oqwzutw% z$&)ii#rWM3vlZeGPUer+dFB{fvpG|L^kl632@Z)*%uj)=BPtLh0-^c2Q4t?A2S;xH z%ul-Zy_)YTa4J>-$-i?#ne-vJYDnhrLDtR^Ln|d zS4+p@D^hKd9zu;>4g0392j6|!vNl;eiX|uGL%R{~EM9zWfF?=}Hi>pD?hdS^Ca0J5 zwW4S7F{zkE@+}K`W7=E+SeZ-=)tI5JOJVSUbxE>a{T#vD$!|MUP{jY9iA(K~gyWft zZI349#t{jf#Z$H{=B1$beA?q4Kuj`&gggS1tI2;$yqLL_LsMKjjyXvvclOUB&AXd_9TwNewE8TYMKVq$M;0e z#x&r9--;hcK3g6WV|Y5|%TimvHynYWRy^x(Vt-f7qvnMp zS-Oub+OT53MzZJa+-^|oMUr!;!|hEQb>W|(+`QTRY;9*)M>-0dgr2vhP?RIlA!nLL z&7Z3;w|icFdMx944G`6o(flB$?hiCKD5V5}_P8;8l$@AKdRoBN3*X2T(9se6T^oJI z|24_ks@~Ru?J*{)Lpi}Itp_I9^1W8sT~}*Gr0%;Bs{k*uij3?9 znw3Z8z=r4@{BIK9@&W}yCi#Jc4Nw0Yf|0STw78C8goHs{QGkZ!kn>Wmx$)Bmn2(0PTJYu___ zd)DNo;$;@oDI!E^X8dGq!EJ&CKJuJFiTG`=bb<`qcPYhvGg#Acz}9pX5g}VDocbfc zRWq)qy&&eTt9zHjx!Q8;);l3sBMbD{mG8kvfP^Lg_6IWFa+-Nw?JjK+QO2OdsVZL7 zPnV$rnQzy1h{>0`5{h?gWF(oUkW(Q6v&NR*t~6IpeFwN*I-`!0FG zXAeYZOTDzPXf!J|ALJ9MFINMXR&@*@itx>Rx@XY|CYi$HaBD-zuP+}LQBNCb4ki`A zTY|VJl$b>&9@vLiI=rTSwPe1cM4Q4Yk@v*%@!C<;MJUpMrB~Fw(lo6!;njq=P=!@w ze$zTupg`&g=`*#|;%vC!F{xd0vD1%+iU)=}<%-c(`a{XiZ>2+@n#f*fX1+WHGC|}q zAF9kZq4@DM1pnYAjzcypUHrNz{0@Wbt*-vs?TOUh z4bt%oI0f}26!QqT+p=WtdCEyGYGp{(@Iq?@_>uqEM z``I5aYoeoT;ig=mntJA8v)G8-Npwm2)96P7sjFSdWy?kam}T(^F)H3AYxz9YHBqyI z`;^E7Xbcx+hG$%#K5pA9SDm`t+&c^Q9s(4}OHAUlPm+&4Xi9IO<>}eBGbRR)*07ZO za0)q$+{DAN0tq)OE5QFZ%@lUG&4HhtH%p%9n=0(1p+P82^%$4=37^VAmEbb0N7cb- z607V+k4H_QCUZ1eEW&8Gfv8?>HZMc4O{Mg8;xR$C**>JM%Mz41ugD#2eNKAGz`J`15i z+#7Fi&?}P2p!cd<8m_GF8z_6^uA?ah(A#sJD2$KdUWaV?%ICd(782)~s2K?Hog`bHLw&>@3Uri_50+g$INTgCEz^9xvmRpeATB z>#wC02L-@;a@Q}MF>(@q(R)*_TBm4 zp75`d;YcZuXOX_)#yF~tou8fmI+)wg3B0B4-S`F=t>jTnq(5XQY#f@G4}M_Aj&Gz7 zjtP_@ElVoxUh|M*`Lpw9pQ9MO;ifQ`UnI_DQ37midIPkzia!J7#+i7sFfFTVnQ@So zuX6}llZ+*i8o|Is!-hggnvsB0zx2)*{>Fqs@0GnqENfJ>04}V7(PxB-Ty~-bQfHB6 z6A!!#Q@?_i7KD#z>N?%unZ?A!X2ZRg=Kj3pIsc9B^U%-sPc`5Ee9`0Fm$*HA_w&;E zx;W@s<=gbY*jnn)QNe}$Cq@iZ&Md8L=8foQ<4YWmt5BEmkwT?kM=CALW=oR0C7~lb zK`CW8_)xmvr{IY+;JmrKh)#laIswxJG(c^Qs7-p@wY&WM$&!gTHI^ci%Dn8Un#y|x zrO7`_^Aj8!8_)EC9zP zz_j{;&`s)Jt#ufC);hkMsIi->dP?QhOxy&Rr)9{I0(l*dN={gin$5h_sC@b~DZO@D zDjnk#4P>oOjvq|DJb_dRR{KVJ2fN8imNB+asULO=FQmyx_U%0-y8AAqW<%dx2)m(g zov9?qIf=xB3!jU@*vkzT=E}a_G7dxDC3Mm+jPEYaerZ4r7xWo94Zi zSlh+#wh2n8UIo)h(=Lf}o=;rq$suq$1i(m-gp?Ho0{tClKzue8`otc1A`pn06l1_4 z17M83CZre#axxxzGq@U-%EMbL3ezJM9mdtzXzhxIWJc=b5GZU`1q=So#?MfBO&5mN zxs=5#;Pi9}U-QCL=yRYdT1DKq&752%l393Po5CzIXg{wAWAQp&@3|X`18kadi)U!95aFjPQZl&+@7S~SvOv4uv7CMkg;+~}~zXSapODigc-U5@VN zq#Tu&Ag zb4V%=X(2RN-y+X^wt<3SdGnM_Go@9(X3Wq zV`Kbob7n_d6+AoJIdv5$iZ@iJfRLOr-3X zB^oA-5=4~vH|>9A0ECC@pHK_}asLg||E2&fOaEWf2!xaCAHF~!vHv;#z6EG72gaBK X&TgbfM*g2a#owz;3<4Q||D*m5$_E8* diff --git a/static/downloads/frontend-account/canvas.php b/static/downloads/frontend-account/canvas.php index 15214858e..cea7e0534 100644 --- a/static/downloads/frontend-account/canvas.php +++ b/static/downloads/frontend-account/canvas.php @@ -22,12 +22,13 @@
+

- - + +
diff --git a/static/downloads/frontend-account/portal.css b/static/downloads/frontend-account/portal.css index 93d041f7f..730aa36c6 100644 --- a/static/downloads/frontend-account/portal.css +++ b/static/downloads/frontend-account/portal.css @@ -33,10 +33,8 @@ body.ums-account-canvas { margin: 0; background: #f7f8f5; } .ums-section-heading > span { color: var(--muted); font-size: 10px; font-weight: 700; letter-spacing: .13em; } .ums-section-copy { color: var(--muted); margin: -4px 0 20px; font-size: 14px; max-width: 640px; } .ums-card { background: var(--paper); border: 1px solid var(--line); border-radius: 12px; overflow-wrap: anywhere; min-width: 0; } -.ums-card:empty { display: none; } .ums-detail-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 20px; } .ums-site-detail { display: grid; gap: 20px; margin-top: 20px; } -.ums-site-detail > .ums-card:not(:has(.wu-current-site)), .ums-detail-grid > .ums-card:not(:has(.wu-styling)), .ums-invoices:not(:has(.wu-invoices)) { display: none; } .ums-invoices { margin-top: 20px; } .ums-portal .wu-styling { font-family: inherit; font-size: 14px; line-height: 1.6; } .ums-portal .wu-styling h3 { font-size: 16px; color: var(--ink); } diff --git a/static/downloads/frontend-account/ums-account-example.php b/static/downloads/frontend-account/ums-account-example.php index 17e51de14..a87b25571 100644 --- a/static/downloads/frontend-account/ums-account-example.php +++ b/static/downloads/frontend-account/ums-account-example.php @@ -2,7 +2,7 @@ /** * Plugin Name: Ultimate Multisite Account Page Example * Description: An optional presentation layer for native Ultimate Multisite shortcodes. - * Version: 1.0.0 + * Version: 1.0.1 * License: GPL-2.0-or-later * Text Domain: ums-account-example */ @@ -29,6 +29,15 @@ function ums_account_example_is_page() { add_action('wp_enqueue_scripts', function () { if (ums_account_example_is_page()) { - wp_enqueue_style('ums-account-example', plugins_url('portal.css', __FILE__), [], '1.0.0'); + wp_enqueue_style('ums-account-example', plugins_url('portal.css', __FILE__), [], '1.0.1'); } }); + +add_filter('the_content', function ($content) { + if (!ums_account_example_is_page()) { + return $content; + } + + // After blocks/shortcodes render, omit only our own completely empty cards. + return preg_replace('/]*\sclass="[^"]*\bums-card\b[^"]*"[^>]*>\s*<\/div>/', '', $content); +}, 20);