WP Manifestindependent plugin directory
manifest / developer / sass-watcher

Sass Watcher WP Registry grade D+. High-severity findings · 2 findingsWP RegistryHigh-severity findings · 2 findingsOpen the reportD+

A PHP Sass compiler for WordPress. It's compatible with ACF 5 plugin and use SCSSPHP to compile Sass Codes

★ 9stars
v1.6.0latest · 11 years ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/reyhoun/sass-watcher/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

It's PHP SCSS Compiler for WordPress and it's compatible with Advanced Custom Field 5 to send parameters(variables) to your SCSS codes.

We use SCSSPHP to compile SCSS codes.

Features

  • Developer Mode: -- Auto compile in each page refresh
  • Manual Compile
  • ACF Compatible -- Send field values that field names start with s_ -- Compile codes every time ACF form saved -- Compatible with all ACF 5 fields: --- Repeater --- Flexible Content --- Typography --- Background --- and etc.

Getting Started

  • Important: Create an empty file in root of your theme with sass-watcher-config.txt name.
  • Download and Install Sass Watcher plugin(same as all WordPress plugins)
  • Open WordPress dashboard and navigate to Appearance > Sass Watcher
  • All Initial Settings are required. Complete all of them before continue.
    • Sass Watcher only read one SCSS file and compile it in one CSS file.
    • You can have separate SCSS files but you have to import all of them to one file for compile.
    • In this documentation, I use style.scss file name for your main SCSS file that wants to compile it.

Initial Settings

  • SCSS Directory Path: This folder include your style.scss and _theme-settings.scss file.

    • Prefix of all fields here is directory of active theme & we get it with get_template_directory() function
    • Directory path example: scss
    • _theme-settings.scss is a custom name for that file you wants to save your ACF 5 Sass variables on it.
  • Final SCSS file to compile: This is path of your main SCSS file(for example: style.scss) for compile.

  • File for save variables sent from ACF: This is path of your _theme-settings.scss file.

    • Variables file example: settings/_theme-settings.scss
    • If this file doesn't exist, Sass Watcher created it.
  • CSS output file: This is path of your main CSS file(for example: style.css) for output of compiled SCSS codes.

Developer Options

  • Developer Option: Enable auto compile in each page refresh.
  • Compile Now: When you want to compile your code manually use it.

ACF Config

If you want set variable in your Sass codes with custom ACF field just add a s_ before your field name and it's create a Sass variable with your field's name and store value of this field on it.

  • Some fields like Repeater and Flexible Content includes more than a field. If you add a s_ before of this Repeater's field name, it's create a variable and store all sub fields value as a Sass array on it.
  • If you want don't store value of one of those sub fields, just add ns_ before your sub field.

Bugs that we know

  • After save cache and display old data in Config Form. It's work correctly but you have to refresh page to see your changes.
  • I'm sorry! But at this moment, you have to write something for File for save variables sent from ACF but it's not important if you don't use it.
  • It implements SCSS 3.2.12 and it's related to SCSSPHP project.

Releases

5 releases.

Tag
Published
v1.6.0 latest
Jan 26, 2015 11 years ago
Jan 21, 2015 11 years ago
Jan 4, 2015 11 years ago
Nov 22, 2014 11 years ago
Nov 22, 2014 11 years ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

D+ grade

Security

Sass Watcher 1.6.0 · audited by WP Registry

High-severity findings.

2 high
Audited release
1.6.0
Findings
2
Worst severity
high
Content hash
57543c3e72220566d160a2b0…

Findings

  • high CSRF and path traversal in Sass Watcher config write/compile

    csrf

    adminPageContant processes POST (sasswatcher_hidden) with no nonce verification. Paths sasswatcher_sassdir, sassfile, cssdir, and varfilename are taken from $_POST unsanitized and later joined to get_template_directory() for file_get_contents/file_put_contents during compile and ACF save. Values containing ../ escape the theme directory, allowing CSRF'd activate_plugins users (or session riders) to overwrite arbitrary files the PHP user can write (e.g. outside theme). Manual compile and auto-compile in wp_head use the same stored paths.

    sass-watcher.php:73-92

    Recommendation

    Add check_admin_referer; re-check current_user_can('activate_plugins'); resolve paths with realpath and require them to stay under get_template_directory(); reject .. segments.

  • high Unvalidated theme-relative paths enable arbitrary file write on compile

    file_access

    compile() and watcher_acf_save_post build $scss_style / $varfilename as get_template_directory() . '/' . $conf['cssdir|varfilename'] without canonicalization. file_put_contents then writes compiler output or raw ACF-derived SCSS variables to that path. Combined with traversable config values this is arbitrary file write.

    sass-watcher.php:46-56

    Recommendation

    Validate and realpath all configured paths; only allow writes under the active theme directory (or a dedicated writable cache dir).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.