Jose Castaneda 7:04 pm on February 3, 2015

Theme Review Chat Notes

Topic: Custom CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site.

Discourage usage in favor of pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party
If used, must take security, permissions, escaping into account ( pingPing The act of sending a very small amount of data to an end point. Ping is used in computer science to illicit a response from a target server to test it’s connection. Ping is also a term used by Slack users to @ someone or send them a direct message (DM). Users might say something along the lines of “Ping me when the meeting starts.” somebody capable of doing such review )
Security is biggest concern
Need good examples of _doing_it_right_

Sub-topic: requirement examples

Add items to https://make.wordpress.org/themes/handbook/review/required/explanations-and-examples
Encourage commenting but will have a weekly after meeting for examples

Next Week’s topic: Review Quality

Security
no-comment-approvals

Link to meeting in Slack: https://wordpress.slack.com/archives/themereview/p1422986425001223

Jose Castaneda 7:54 pm on February 3, 2015

Addendum to next week’s topic(s):
Child themes: https://wordpress.slack.com/archives/themereview/p1422990661001394 brought up by @cais
- Jose Castaneda 12:23 am on February 5, 2015
  
  Admins: as well as: https://wordpress.slack.com/archives/themereview/p1423082176001521
Tammie 1:41 am on February 4, 2015

Thanks for the update and leading the meeting.
Ulrich 7:22 pm on February 4, 2015

I am looking into the “Custom CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site.” at the moment. Proper sanitization would require the use of CSSTiday? Do we require something for escaping the CSS before output? PingPing The act of sending a very small amount of data to an end point. Ping is used in computer science to illicit a response from a target server to test it’s connection. Ping is also a term used by Slack users to @ someone or send them a direct message (DM). Users might say something along the lines of “Ping me when the meeting starts.” @greenshady

Can this be added to the requirements/documentation please?
- Justin Tadlock 8:17 pm on February 4, 2015
  
  I’d really like to see if we can get @nacin and/or @otto42 to weigh in on what’s proper. Or, maybe someone from the Jetpack team who’s worked on this feature. I’m not really in favor of themes doing this, but if we’re allowing it, I’d like to bring in someone I trust to tell us the best method.
  
  To sanitize, CSSTidy is probably the best place to start. I’d really look into what Jetpack is doing and study their code. If someone could break that down, it’d be nice.
  
  The correct capability would probably be edit_themes. That seems to make the most sense to me since anyone with that cap can directly edit theme files.
  - George Stephanis 8:50 pm on February 4, 2015
    
    Yeah, it’s super tricky to do right and will necessitate a large sanitization library. The Custom CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site. code in Jetpack itself is about 600k+ — but that’s including the Sass and Less preprocessors that we bundle. CSSTidy by itself looks to be about 160k.
    
    Honestly, my recommendation would be to tell themers to suggest an external pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party. Norcross has one as well — https://wordpress.org/plugins/reaktiv-css-builder/ — and there’s a version of the Jetpack one that’s been spun off into its own plugin (yay GPLGPL GPL is an acronym for GNU Public License. It is the standard license WordPress uses for Open Source licensing https://wordpress.org/about/license/. The GPL is a ‘copyleft’ license https://www.gnu.org/licenses/copyleft.en.html. This means that derivative work can only be distributed under the same license terms. This is in distinction to permissive free software licenses, of which the BSD license and the MIT License are widely used examples.!) here: https://wordpress.org/plugins/jp-custom-css/ if they don’t want to recommend Jetpack itself.
    - Jose Castaneda 8:54 pm on February 4, 2015
      
      Yeah, the library is about 140K. I’ve been tinkering with it the last few days, only really needs 4 files.
      
      Thanks for sharing those @georgestephanis almost forgot about the sans-pack version of Custom CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site.. 🙂
    - Ulrich 9:00 pm on February 4, 2015
      
      I could not find much sanitization in Reaktiv CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site. Builder.
      - Jose Castaneda 9:01 pm on February 4, 2015
        
        It creates a CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site. file rather than saving to the db.
- Andrew Nacin 5:22 am on February 5, 2015
  
  Despite CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site. not being JavaScriptJavaScript JavaScript or JS is an object-oriented computer programming language commonly used to create interactive effects within web browsers. WordPress makes extensive use of JS for a better user experience. While PHP is executed on the server, JS executes within a user’s browser. https://www.javascript.com/., it is just as dangerous. There is no good way to escape arbitrary CSS. There is no good way to sanitize arbitrary CSS. There is no way to do this correctly. A theme should not do this, because libraries can barely do this correctly. They’re patching the CSS sanitization libraries running on WordPress.comWordPress.com An online implementation of WordPress code that lets you immediately access a new WordPress environment to publish your content. WordPress.com is a private company owned by Automattic that hosts the largest multisite in the world. This is arguably the best place to start blogging if you have never touched WordPress before. https://wordpress.com/ all the time.
  
  This is pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party material, even before weighing all of the additional security concerns.
Dovy Paukstys 8:54 pm on February 5, 2015

Given the response here, and the query of Justin Tadlock, Redux Framework has integrated the CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site. sterilization found in JetPack.

I’ve also isolated the required code that you could pass to any developers to ensure they comply with these requirements: https://github.com/ReduxFramework/wp-custom-css-validation
- Dovy Paukstys 9:06 pm on February 5, 2015
  
  On a side note, I don’t know why this isn’t just added to WordPress coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress.. It’s only 195kb in all and would be a very useful function. I’ll gladly contribute it if you think it would be accepted. 😉
- Justin Tadlock 9:11 pm on February 5, 2015
  
  @dovyp Thanks for taking the time to flesh out the code in your framework for those theme authors who are using it. That’s definitely a step forward.
Kadence Themes 3:18 am on February 6, 2015

Hey, I’ll add in, I am for security but strongly disagree that because it’s not easy to do it should be put on pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party developers. I really don’t understand how css needing to be properly sanitized turns into this should only be in plugins? What are the hundreds of themes that have css boxes supposed to do? remove and have all there users lose there css? Come on, we should be promoting safe ways to do this not pushing it off the review team.

If we are for making sites more secure then themes should be able to lead the way. I took a look around what plugins are available for custom css and it’s not like they are all doing it so well that theme developer should just hand in the towel.

I could argue all day that I think themes should have the option to add this. But I think that has to be a different point. The point is all css boxes need security and there should be an accepted way to do that. If jetpack has the answer then why can’t we promote the use of jetpack as a plugin or it’s code as a solution?
- Justin Tadlock 5:44 am on February 6, 2015
  
  I am for security but strongly disagree that because it’s not easy to do it should be put on pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party developers. I really don’t understand how css needing to be properly sanitized turns into this should only be in plugins?
  
  I just want to point out that no one is arguing this at all. The security and plugin territory issues are two separate and unrelated issues.

Welcome to the Themes team!

Handbooks and review requirements

Coding standards and plugins

Code Packages

Communication

Theme Review Chat Notes

Topic: Custom CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site.

Sub-topic: requirement examples

Next Week’s topic: Review Quality

Welcome to the Themes team!

Handbooks and review requirements

Coding standards and plugins

Code Packages

Communication

Topic: Custom CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site.

Sub-topic: requirement examples

Next Week’s topic: Review Quality

Share this: