is_premium() ) { return; } // Multilingual plugins (Polylang/WPML directory mode) can resolve the // admin's `home_url('/')` to a language-prefixed path where // `is_front_page()` is false on the iframe load; auth (cap + nonce, // below) is the real boundary. // phpcs:ignore WordPress.Security.NonceVerification.Recommended if ( empty( $_GET['pdfemb-data'] ) ) { return; } // Editor-only route — require a Block Editor capability and a nonce // minted by the editor session. Anonymous / non-editor visitors get // the regular front-end response by falling through to WP routing. if ( ! current_user_can( 'edit_posts' ) ) { return; } $nonce = isset( $_GET['pdfemb-nonce'] ) ? sanitize_key( wp_unslash( (string) $_GET['pdfemb-nonce'] ) ) : ''; if ( ! wp_verify_nonce( $nonce, self::NONCE_ACTION ) ) { return; } // phpcs:ignore WordPress.Security.NonceVerification.Recommended $atts = $this->decode( sanitize_text_field( wp_unslash( (string) $_GET['pdfemb-data'] ) ) ); if ( empty( $atts ) ) { echo ''; exit; } $pdf_id = isset( $atts['pdfID'] ) ? (int) $atts['pdfID'] : 0; if ( $pdf_id <= 0 ) { return; } // `read_post` walks up to the parent post for attachments. Without // this gate, every editor (e.g. contributor) could trigger a render // of any PDF their nonce reaches — including PDFs attached to other // authors' draft/private posts. if ( ! current_user_can( 'read_post', $pdf_id ) ) { return; } // Re-derive the URL from the attachment ID server-side. Trusting the // payload's `url` (or `pdfemb-serveurl`) would let an editor bind one // pdfID with a `url` pointing at a different secure PDF — // Pro::add_viewer_strings would then mint a per-URL secureNonce for // that injected URL. Forcing the URL to match the verified pdfID // closes that smuggling route. Lite has no secure path itself, but // the same contract applies for parity with Premium. $true_url = wp_get_attachment_url( $pdf_id ); if ( ! $true_url ) { return; } $atts['url'] = $true_url; unset( $atts['pdfemb-serveurl'], $atts['_editorPreview'] ); // Lite registers `pdfemb_pdfjs` and `pdfemb_embed_pdf` (plus the // `pdfemb_trans` localization) on the `wp_enqueue_scripts` action, // which is fired by wp_head() and therefore runs *after* this // template_redirect handler. Register them explicitly so the // shortcode's enqueue_inline_assets() and our wp_print_scripts() // calls have something to print. pdf_embedder()->enqueue_scripts(); // Run the same shortcode pipeline used on the front-end so the editor // preview matches what visitors will see. $html = ( new Shortcode() )->render( $atts ); $this->emit_iframe_doc( $html ); exit; } /** * Decode the base64url-encoded JSON payload back into an attributes array. * Matches the JS-side `btoa()` with `+/` swapped for `-_` and * `=` padding stripped. * * @since 5.0.0 * * @param string $encoded Base64url string from the query parameter. */ private function decode( string $encoded ): array { // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode $json = base64_decode( strtr( $encoded, '-_', '+/' ), true ); if ( $json === false || $json === '' ) { return []; } $atts = json_decode( $json, true ); return is_array( $atts ) ? $atts : []; } /** * Emit the standalone HTML document that wraps the shortcode output so the * pdfemb_embed_pdf JS can attach PDF.js inside the iframe body. * * @since 5.0.0 * * @param string $body_html HTML produced by the shortcode render pipeline. */ private function emit_iframe_doc( string $body_html ): void { nocache_headers(); header( 'X-Robots-Tag: noindex, nofollow' ); header( 'Content-Type: text/html; charset=' . get_bloginfo( 'charset' ) ); ?> >