Skip to content

Commit 7995c15

Browse files
obfuscate API key the same way as Mailchimp does in their web interface
1 parent ce079ad commit 7995c15

File tree

3 files changed

+183
-179
lines changed

3 files changed

+183
-179
lines changed

includes/functions.php

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -439,10 +439,11 @@ function _mc4wp_use_sslverify()
439439
*/
440440
function mc4wp_obfuscate_string($string)
441441
{
442-
$length = strlen($string);
443-
$obfuscated_length = ceil($length / 2);
444-
$string = str_repeat('*', $obfuscated_length) . substr($string, $obfuscated_length);
445-
return $string;
442+
if (strlen($string) <= 2) return $string;
443+
$length = strlen($string);
444+
$keep = floor(strlen($string) / 3);
445+
$keep = min($keep, 4);
446+
return substr($string, 0, $keep) . str_repeat('*', $length - ($keep*2)) . substr($string, -$keep);
446447
}
447448

448449
/**

includes/views/general-settings.php

Lines changed: 82 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -3,104 +3,102 @@
33
?>
44
<div id="mc4wp-admin" class="wrap mc4wp-settings">
55

6-
<p class="mc4wp-breadcrumbs">
7-
<span class="prefix"><?php echo esc_html__('You are here: ', 'mailchimp-for-wp'); ?></span>
8-
<span class="current-crumb"><strong>Mailchimp for WordPress</strong></span>
9-
</p>
10-
11-
12-
<div class="mc4wp-row">
13-
14-
<!-- Main Content -->
15-
<div class="main-content mc4wp-col">
16-
17-
<h1 class="mc4wp-page-title">
18-
Mailchimp for WordPress: <?php echo esc_html__('API Settings', 'mailchimp-for-wp'); ?>
19-
</h1>
20-
21-
<h2 style="display: none;"></h2>
22-
<?php
23-
settings_errors();
24-
$this->messages->show();
25-
?>
26-
27-
<form action="<?php echo admin_url('options.php'); ?>" method="post">
28-
<?php settings_fields('mc4wp_settings'); ?>
29-
30-
<table class="form-table">
31-
32-
<tr valign="top">
33-
<th scope="row">
34-
<?php echo esc_html__('Status', 'mailchimp-for-wp'); ?>
35-
</th>
36-
<td>
37-
<?php
38-
if ($connected) {
39-
?>
40-
<span class="mc4wp-status positive"><?php echo esc_html__('CONNECTED', 'mailchimp-for-wp'); ?></span>
41-
<?php
42-
} else {
43-
?>
44-
<span class="mc4wp-status neutral"><?php echo esc_html__('NOT CONNECTED', 'mailchimp-for-wp'); ?></span>
45-
<?php
46-
}
47-
?>
48-
</td>
49-
</tr>
50-
51-
52-
<tr valign="top">
53-
<th scope="row"><label for="mailchimp_api_key"><?php echo esc_html__('API Key', 'mailchimp-for-wp'); ?></label></th>
54-
<td>
55-
<input type="text" class="widefat" placeholder="<?php echo esc_html__('Your Mailchimp API key', 'mailchimp-for-wp'); ?>" id="mailchimp_api_key" name="mc4wp[api_key]" value="<?php echo esc_attr($obfuscated_api_key); ?>" <?php echo defined('MC4WP_API_KEY') ? 'readonly="readonly"' : ''; ?> />
56-
<p class="description">
57-
<?php echo esc_html__('The API key for connecting with your Mailchimp account.', 'mailchimp-for-wp'); ?>
58-
<a target="_blank" href="https://admin.mailchimp.com/account/api"><?php echo esc_html__('Get your API key here.', 'mailchimp-for-wp'); ?></a>
59-
</p>
60-
61-
<?php
62-
if (defined('MC4WP_API_KEY')) {
63-
echo '<p class="description">', wp_kses(__('You defined your Mailchimp API key using the <code>MC4WP_API_KEY</code> constant.', 'mailchimp-for-wp'), array( 'code' => array() )), '</p>';
64-
}
65-
?>
66-
</td>
6+
<p class="mc4wp-breadcrumbs">
7+
<span class="prefix"><?php echo esc_html__('You are here: ', 'mailchimp-for-wp'); ?></span>
8+
<span class="current-crumb"><strong>Mailchimp for WordPress</strong></span>
9+
</p>
10+
11+
<div class="mc4wp-row">
12+
<!-- Main Content -->
13+
<div class="main-content mc4wp-col">
14+
15+
<h1 class="mc4wp-page-title">
16+
Mailchimp for WordPress: <?php echo esc_html__('API Settings', 'mailchimp-for-wp'); ?>
17+
</h1>
18+
19+
<h2 style="display: none;"></h2>
20+
<?php
21+
settings_errors();
22+
$this->messages->show();
23+
?>
24+
25+
<form action="<?php echo esc_attr(admin_url('options.php')); ?>" method="post">
26+
<?php settings_fields('mc4wp_settings'); ?>
27+
28+
<table class="form-table">
29+
30+
<tr valign="top">
31+
<th scope="row">
32+
<?php echo esc_html__('Status', 'mailchimp-for-wp'); ?>
33+
</th>
34+
<td>
35+
<?php
36+
if ($connected) {
37+
?>
38+
<span class="mc4wp-status positive"><?php echo esc_html__('CONNECTED', 'mailchimp-for-wp'); ?></span>
39+
<?php
40+
} else {
41+
?>
42+
<span class="mc4wp-status neutral"><?php echo esc_html__('NOT CONNECTED', 'mailchimp-for-wp'); ?></span>
43+
<?php
44+
}
45+
?>
46+
</td>
47+
</tr>
48+
49+
50+
<tr valign="top">
51+
<th scope="row"><label for="mailchimp_api_key"><?php echo esc_html__('API Key', 'mailchimp-for-wp'); ?></label></th>
52+
<td>
53+
<input type="text" class="widefat" placeholder="<?php echo esc_attr__('Your Mailchimp API key', 'mailchimp-for-wp'); ?>" id="mailchimp_api_key" name="mc4wp[api_key]" value="<?php echo esc_attr($obfuscated_api_key); ?>" <?php echo defined('MC4WP_API_KEY') ? 'readonly="readonly"' : ''; ?> />
54+
<p class="description">
55+
<?php echo esc_html__('The API key for connecting with your Mailchimp account.', 'mailchimp-for-wp'); ?>
56+
<a target="_blank" href="https://admin.mailchimp.com/account/api"><?php echo esc_html__('Get your API key here.', 'mailchimp-for-wp'); ?></a>
57+
</p>
58+
59+
<?php
60+
if (defined('MC4WP_API_KEY')) {
61+
echo '<p class="description">', wp_kses(__('You defined your Mailchimp API key using the <code>MC4WP_API_KEY</code> constant.', 'mailchimp-for-wp'), array( 'code' => array() )), '</p>';
62+
}
63+
?>
64+
</td>
6765

6866
</tr>
6967

70-
</table>
68+
</table>
7169

72-
<?php submit_button(); ?>
70+
<?php submit_button(); ?>
7371

74-
</form>
72+
</form>
7573

76-
<?php
74+
<?php
7775

78-
/**
79-
* Runs right after general settings are outputted in admin.
80-
*
81-
* @since 3.0
82-
* @ignore
83-
*/
76+
/**
77+
* Runs right after general settings are outputted in admin.
78+
*
79+
* @since 3.0
80+
* @ignore
81+
*/
8482

85-
do_action('mc4wp_admin_after_general_settings');
83+
do_action('mc4wp_admin_after_general_settings');
8684

87-
if (! empty($opts['api_key'])) {
88-
echo '<hr />';
89-
include __DIR__ . '/parts/lists-overview.php';
90-
}
85+
if (! empty($opts['api_key'])) {
86+
echo '<hr />';
87+
include __DIR__ . '/parts/lists-overview.php';
88+
}
9189

92-
require __DIR__ . '/parts/admin-footer.php';
90+
require __DIR__ . '/parts/admin-footer.php';
9391

94-
?>
95-
</div>
92+
?>
93+
</div>
9694

97-
<!-- Sidebar -->
98-
<div class="mc4wp-sidebar mc4wp-col">
99-
<?php require __DIR__ . '/parts/admin-sidebar.php'; ?>
100-
</div>
95+
<!-- Sidebar -->
96+
<div class="mc4wp-sidebar mc4wp-col">
97+
<?php require __DIR__ . '/parts/admin-sidebar.php'; ?>
98+
</div>
10199

102100

103-
</div>
101+
</div>
104102

105103
</div>
106104

tests/FunctionsTest.php

Lines changed: 96 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -7,97 +7,102 @@
77
*/
88
class FunctionsTest extends TestCase
99
{
10-
public $tests = array(
11-
array(
12-
'input' => array(),
13-
'output' => array(),
14-
),
15-
array(
16-
'input' => array(
17-
'SOME_FIELD' => 'Some value',
18-
'SOME_OTHER_FIELD' => 'Some other value'
19-
),
20-
'output' => array(
21-
'SOME_FIELD' => 'Some value',
22-
'SOME_OTHER_FIELD' => 'Some other value'
23-
),
24-
),
25-
array(
26-
'input' => array(
27-
'NAME' => 'Danny van Kooten'
28-
),
29-
'output' => array(
30-
'NAME' => 'Danny van Kooten',
31-
'FNAME' => 'Danny',
32-
'LNAME' => 'van Kooten'
33-
),
34-
),
35-
array(
36-
'input' => array(
37-
'NAME' => 'Danny'
38-
),
39-
'output' => array(
40-
'NAME' => 'Danny',
41-
'FNAME' => 'Danny',
42-
),
43-
),
44-
);
45-
46-
47-
/**
48-
* @covers mc4wp_obfuscate_email_addresses()
49-
*/
50-
public function test_mc4wp_obfuscate_email_addresses()
51-
{
52-
53-
// by no means should the two strings be similar
54-
$string = 'Mailchimp API error: Recipient "johnnydoe@gmail.com" has too many recent signup requests';
55-
$obfuscated = mc4wp_obfuscate_email_addresses($string);
56-
self::assertNotEquals($string, $obfuscated);
57-
58-
// less than 70% of the string should be similar
59-
$string = 'johnnydoe@gmail.com';
60-
$obfuscated = mc4wp_obfuscate_email_addresses($string);
61-
similar_text($string, $obfuscated, $percentage);
62-
self::assertTrue($percentage <= 70);
63-
}
64-
65-
/**
66-
* @covers mc4wp_obfuscate_string
67-
*/
68-
public function test_mc4wp_obfuscate_string()
69-
{
70-
71-
// by no means should the two strings be similar
72-
$string = 'super-secret-string';
73-
$obfuscated = mc4wp_obfuscate_string($string);
74-
self::assertNotEquals($string, $obfuscated);
75-
76-
// less than 50% of the string should be similar
77-
similar_text($string, $obfuscated, $percentage);
78-
self::assertTrue($percentage <= 50);
79-
}
80-
81-
/**
82-
* @covers mc4wp_add_name_data
83-
*/
84-
public function test_mc4wp_add_name_data()
85-
{
86-
foreach ($this->tests as $test) {
87-
self::assertEquals(mc4wp_add_name_data($test['input']), $test['output']);
88-
}
89-
}
90-
91-
/**
92-
* @covers mc4wp_array_get
93-
*/
94-
public function test_mc4wp_array_get()
95-
{
96-
self::assertEquals(mc4wp_array_get(array( 'foo' => 'bar' ), 'foo'), 'bar');
97-
self::assertEquals(mc4wp_array_get(array( 'foo' => 'bar' ), 'foofoo', 'default'), 'default');
98-
self::assertEquals(mc4wp_array_get(array( 'foo' => array( 'bar' => 'foobar' ) ), 'foo.bar'), 'foobar');
99-
self::assertEquals(mc4wp_array_get(array( 'foo' => array( 'bar' => 'foobar' ) ), 'foo.foo', 'default'), 'default');
100-
}
10+
public $tests = array(
11+
array(
12+
'input' => array(),
13+
'output' => array(),
14+
),
15+
array(
16+
'input' => array(
17+
'SOME_FIELD' => 'Some value',
18+
'SOME_OTHER_FIELD' => 'Some other value'
19+
),
20+
'output' => array(
21+
'SOME_FIELD' => 'Some value',
22+
'SOME_OTHER_FIELD' => 'Some other value'
23+
),
24+
),
25+
array(
26+
'input' => array(
27+
'NAME' => 'Danny van Kooten'
28+
),
29+
'output' => array(
30+
'NAME' => 'Danny van Kooten',
31+
'FNAME' => 'Danny',
32+
'LNAME' => 'van Kooten'
33+
),
34+
),
35+
array(
36+
'input' => array(
37+
'NAME' => 'Danny'
38+
),
39+
'output' => array(
40+
'NAME' => 'Danny',
41+
'FNAME' => 'Danny',
42+
),
43+
),
44+
);
45+
46+
47+
/**
48+
* @covers mc4wp_obfuscate_email_addresses()
49+
*/
50+
public function test_mc4wp_obfuscate_email_addresses()
51+
{
52+
// by no means should the two strings be similar
53+
$string = 'Mailchimp API error: Recipient "johnnydoe@gmail.com" has too many recent signup requests';
54+
$obfuscated = mc4wp_obfuscate_email_addresses($string);
55+
self::assertNotEquals($string, $obfuscated);
56+
57+
// less than 70% of the string should be similar
58+
$string = 'johnnydoe@gmail.com';
59+
$obfuscated = mc4wp_obfuscate_email_addresses($string);
60+
similar_text($string, $obfuscated, $percentage);
61+
self::assertTrue($percentage <= 70);
62+
}
63+
64+
/**
65+
* @covers mc4wp_obfuscate_string
66+
*/
67+
public function test_mc4wp_obfuscate_string()
68+
{
69+
self::assertEquals('', mc4wp_obfuscate_string(''));
70+
self::assertEquals('a', mc4wp_obfuscate_string('a'));
71+
self::assertEquals('aa', mc4wp_obfuscate_string('aa'));
72+
self::assertEquals('a*a', mc4wp_obfuscate_string('aaa'));
73+
self::assertEquals('a**a', mc4wp_obfuscate_string('aaaa'));
74+
self::assertEquals('abcd****************************-us1', mc4wp_obfuscate_string('abcdefghijklmnopqrstuvwxyzabcdef-us1'));
75+
76+
// by no means should the two strings be similar
77+
$string = 'super-secret-string';
78+
$obfuscated = mc4wp_obfuscate_string($string);
79+
self::assertNotEquals($string, $obfuscated);
80+
81+
// less than 50% of the string should be similar
82+
similar_text($string, $obfuscated, $percentage);
83+
self::assertTrue($percentage <= 50);
84+
}
85+
86+
/**
87+
* @covers mc4wp_add_name_data
88+
*/
89+
public function test_mc4wp_add_name_data()
90+
{
91+
foreach ($this->tests as $test) {
92+
self::assertEquals(mc4wp_add_name_data($test['input']), $test['output']);
93+
}
94+
}
95+
96+
/**
97+
* @covers mc4wp_array_get
98+
*/
99+
public function test_mc4wp_array_get()
100+
{
101+
self::assertEquals(mc4wp_array_get(array( 'foo' => 'bar' ), 'foo'), 'bar');
102+
self::assertEquals(mc4wp_array_get(array( 'foo' => 'bar' ), 'foofoo', 'default'), 'default');
103+
self::assertEquals(mc4wp_array_get(array( 'foo' => array( 'bar' => 'foobar' ) ), 'foo.bar'), 'foobar');
104+
self::assertEquals(mc4wp_array_get(array( 'foo' => array( 'bar' => 'foobar' ) ), 'foo.foo', 'default'), 'default');
105+
}
101106

102107
public function test_mc4wp_get_request_ip_address()
103108
{

0 commit comments

Comments
 (0)