Directory

Command Palette lets unauthorized users switch to Code Editor · Issue #57604 · WordPress/gutenberg · GitHub
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Command Palette lets unauthorized users switch to Code Editor #57604

Open
MadtownLems opened this issue Jan 5, 2024 · 4 comments
Open

Command Palette lets unauthorized users switch to Code Editor #57604

MadtownLems opened this issue Jan 5, 2024 · 4 comments
Labels
[Package] Commands /packages/commands [Package] Edit Post /packages/edit-post [Package] Edit Site /packages/edit-site [Type] Bug An existing feature does not function as intended

Comments

@MadtownLems
Copy link

Description

When access to the Code Editor is disabled (via $settings['codeEditingEnabled'] = false; ), it can still be accessed using the Command Palette.

Step-by-step reproduction instructions

  1. Filter the Block Editor settings to disable codeEditingEnabled in the block_editor_settings_all filter

add_filter( 'block_editor_settings_all', 'disable_code_editor' ), 10, 2 );

function disable_code_editor( $settings, $context ) {
$settings['codeEditingEnabled'] = false;
return $settings;
}

  1. See that Code Editing is disabled via traditional means. It's blurred out in the Menu, and ctrl-shit-alt-M does nothing.
  2. Open the Command Palette and select "Toggle code editor"
  3. See that you are now in the Code Editor

Screenshots, screen recording, code snippet

code-editor-disabled

toggle

wrong

Environment info

WP 6.4.2, no Gutenberg plugin

Please confirm that you have searched existing issues in the repo.

Yes

Please confirm that you have tested with all plugins deactivated except Gutenberg.

Yes

@MadtownLems MadtownLems added the [Type] Bug An existing feature does not function as intended label Jan 5, 2024
@t-hamano
Copy link
Contributor

t-hamano commented Jan 6, 2024

Thanks for the report. I was also able to reproduce this problem.

Also, while looking for a solution, I discovered an issue with inconsistent command actions, and issues with the Site Editor.

In the Post Editor, there is only one action: "Toggle code editor".

image

In the Site Editor, on the other hand, the commands change depending on the editor context.

image

image

Furthermore, in the Site Editor, the hook that disables the editor type does not seem to be applied.

function disable_code_editor( $settings, $context ) {
	$settings['codeEditingEnabled'] = false;
	return $settings;
}
add_filter( 'block_editor_settings_all', 'disable_code_editor' , 10, 2 );

image

Therefore, in order to comprehensively resolve this issue, I think we will probably need to follow the steps below.

@t-hamano t-hamano added [Package] Edit Post /packages/edit-post [Package] Edit Site /packages/edit-site labels Jan 6, 2024
@jordesign jordesign added the [Package] Commands /packages/commands label Jan 7, 2024
@t-hamano
Copy link
Contributor

Update:

In the Post Editor, there is only one action: "Toggle code editor".
In the Site Editor, on the other hand, the commands change depending on the editor context.

This issue was resolved by #58148. It seems that it has been unified to Open code editor/Exit code editor.

@t-hamano
Copy link
Contributor

Update: In #59299, switching modes via the command palette is now disabled when only one editor mode is available.

@senadir
Copy link
Contributor

senadir commented Jun 13, 2024

Hey! Is this issue is valid?

Ensure that codeEditingEnabled and richEditingEnabled block editor settings are correctly applied to the Site Editor as well.

Seems unrelated to this package maybe and should be a separate issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
[Package] Commands /packages/commands [Package] Edit Post /packages/edit-post [Package] Edit Site /packages/edit-site [Type] Bug An existing feature does not function as intended
Projects
None yet
Development

No branches or pull requests

4 participants