Update to 3.2.0

Author: lex127

CHANGELOG.md

@@ -1,5 +1,17 @@
 # WProofreader Plugin for WordPress Changelog
 
+## 3.2.0 - 2026-06-12
+
+* Fixed: post content corruption on save in the block editor. The content cleanup filter processed slashed post data, which added escaped quotes to attribute values (href, id, class) on every save, and it also ran on posts that merely contained "wsc-" in URLs rather than actual proofreading artifacts.
+* Reworked content cleanup to splice artifact markup out of the original byte stream (WP_HTML_Tag_Processor) instead of re-serializing the whole document; content outside removed tags is never modified. Removed the lossy DOMDocument and regex fallbacks.
+* Content cleanup now also covers autosaves and revisions, so restored autosaves no longer contain proofreading markup.
+* Fixed the editor re-init guard to use the data-wpr-instance attribute the SDK actually sets, preventing duplicate instances; added a temporary init marker with timeout recovery so failed initializations can retry safely.
+* Block editor integration now retries initialization while the editor is still rendering and picks up blocks added after load.
+* Corrections in the classic editor now mark TinyMCE as dirty so they are reliably saved.
+* The proofreading bundle is loaded once per document (previously it could be requested twice in iframed block editors).
+* Settings page: clearer message when the session nonce has expired; settings fields are only registered on the settings screen and when saving.
+* Version migration no longer writes options during REST/cron/front-end requests; uninstall now cleans options on all sites in multisite.
+
 ## 3.1.0 - 2026-04-24
 
 * Refactored plugin internals into focused classes while preserving the public WProofreader class, option names, filters, and AJAX action.

assets/classic-environment.js

@@ -2,8 +2,11 @@
     'use strict';
 
     const EDITOR_ID = 'content';
-    const INSTANCE_ATTRIBUTE = 'data-wsc-instance';
+    // Own marker (set below) plus the attribute the SDK sets on its container.
+    const OWN_INSTANCE_ATTRIBUTE = 'data-wsc-init';
+    const SDK_INSTANCE_ATTRIBUTE = 'data-wpr-instance';
     const INIT_DELAY = 100;
+    const INIT_TIMEOUT = 5000;
     const MAX_ATTEMPTS = 50;
 
     let attempts = 0;
@@ -24,9 +27,15 @@
     }
 
     function hasInstance(iframe) {
+        // The SDK marks the container (the iframe element) with data-wpr-instance;
+        // the temporary own marker prevents duplicate concurrent initialization.
+        if (iframe.hasAttribute(OWN_INSTANCE_ATTRIBUTE) || iframe.hasAttribute(SDK_INSTANCE_ATTRIBUTE)) {
+            return true;
+        }
+
         const body = iframe.contentDocument && iframe.contentDocument.body;
 
-        return Boolean(body && body.hasAttribute(INSTANCE_ATTRIBUTE));
+        return Boolean(body && (body.hasAttribute(OWN_INSTANCE_ATTRIBUTE) || body.hasAttribute(SDK_INSTANCE_ATTRIBUTE)));
     }
 
     function initializeClassicEditor() {
@@ -47,9 +56,27 @@
             return;
         }
 
-        window.WEBSPELLCHECKER.init(Object.assign({}, window.WEBSPELLCHECKER_CONFIG, {
-            container: iframe,
-        }));
+        iframe.setAttribute(OWN_INSTANCE_ATTRIBUTE, '1');
+
+        // The SDK merges the global WEBSPELLCHECKER_CONFIG itself; pass only the container
+        // (same convention as gutenberg-environment.js).
+        try {
+            window.WEBSPELLCHECKER.init({
+                container: iframe,
+            });
+
+            window.setTimeout(() => {
+                const body = iframe.contentDocument && iframe.contentDocument.body;
+                const sdkInstanceCreated = iframe.hasAttribute(SDK_INSTANCE_ATTRIBUTE) ||
+                    Boolean(body && body.hasAttribute(SDK_INSTANCE_ATTRIBUTE));
+
+                if (!sdkInstanceCreated) {
+                    iframe.removeAttribute(OWN_INSTANCE_ATTRIBUTE);
+                }
+            }, INIT_TIMEOUT);
+        } catch (e) {
+            iframe.removeAttribute(OWN_INSTANCE_ATTRIBUTE);
+        }
     }
 
     if (document.readyState === 'loading') {

assets/environmentChecker.js

@@ -3,22 +3,38 @@ window.addEventListener("load", (event) => {
     var bundlePath = serviceConfig.bundleUrl || 'https://svc.webspellchecker.net/spellcheck31/wscbundle/wscbundle.js';
 
     function loadScript(doc, src) {
+        // One bundle copy per document. This script runs both in the top frame
+        // and inside the editor-canvas iframe, and the top copy also injects
+        // into the iframe, so without the flag the bundle could load twice.
+        var win = doc.defaultView;
+        if (!win || win.__wscBundleRequested) {
+            return;
+        }
+        win.__wscBundleRequested = true;
+
         const script = doc.createElement('script');
         const appendTo = doc.head || doc.documentElement;
 
         script.type = 'text/javascript';
-        script.charset = 'UTF-8';
         script.async = false;
         script.src = src;
 
         appendTo.appendChild(script);
     }
 
+    if (!window.WEBSPELLCHECKER_CONFIG) {
+        return;
+    }
+
     window.gutenbergIframe = document.querySelector('[name=editor-canvas]');
-    window.WEBSPELLCHECKER_CONFIG.globalBadge = true;
 
     if (window.gutenbergIframe) {
-        window.WEBSPELLCHECKER_CONFIG.globalBadge = false;
+        // The iframe document hosts the editable content and shows the badge;
+        // the top frame keeps a badge-less SDK for classic metabox fields.
+        const iframeConfig = window.gutenbergIframe.contentWindow.WEBSPELLCHECKER_CONFIG;
+        if (iframeConfig && window.WEBSPELLCHECKER_CONFIG.globalBadge) {
+            window.WEBSPELLCHECKER_CONFIG.globalBadge = false;
+        }
         loadScript(window.gutenbergIframe.contentWindow.document, bundlePath);
         window.gutenbergIframe = null;
     }

assets/gutenberg-environment.js

@@ -8,8 +8,21 @@
         TABLE_CELL: 'wp-block-table__cell-content'
     };
 
-    const INSTANCE_ATTRIBUTE = 'data-wsc-instance';
+    // Own marker set right before init: keeps re-init idempotent even when the
+    // SDK instance fails to start (e.g. service unreachable).
+    const OWN_INSTANCE_ATTRIBUTE = 'data-wsc-init';
+    // Attribute the SDK sets on a container once an instance is created.
+    const SDK_INSTANCE_ATTRIBUTE = 'data-wpr-instance';
+
     const INIT_DELAY = 100;
+    const INIT_TIMEOUT = 5000;
+    const MAX_ATTEMPTS = 50;
+    const OBSERVER_DEBOUNCE = 250;
+
+    let attempts = 0;
+    let observer = null;
+    let observerTimer = null;
+    const pendingRoots = new Set();
 
     const isGutenbergActive = () => {
         return document.body.classList.contains(SELECTORS.GUTENBERG_PAGE) ||
@@ -19,8 +32,10 @@
     function isContentEditable(element) {
         return element.isContentEditable;
     }
+
     function isInstanceCreated(element) {
-        return element.hasAttribute(INSTANCE_ATTRIBUTE);
+        return element.hasAttribute(OWN_INSTANCE_ATTRIBUTE) ||
+            element.hasAttribute(SDK_INSTANCE_ATTRIBUTE);
     }
 
     function isGutenbergTableCell(element) {
@@ -44,24 +59,103 @@
     };
 
     const createInstance = (element) => {
-        WEBSPELLCHECKER.init({
-            container: element,
-        });
+        element.setAttribute(OWN_INSTANCE_ATTRIBUTE, '1');
+
+        try {
+            WEBSPELLCHECKER.init({
+                container: element,
+            });
+
+            // The SDK reports successful creation with data-wpr-instance. Do
+            // not let our pending marker suppress retries forever otherwise.
+            window.setTimeout(() => {
+                if (!element.hasAttribute(SDK_INSTANCE_ATTRIBUTE)) {
+                    element.removeAttribute(OWN_INSTANCE_ATTRIBUTE);
+                }
+            }, INIT_TIMEOUT);
+        } catch (e) {
+            // Allow a later retry if init threw synchronously.
+            element.removeAttribute(OWN_INSTANCE_ATTRIBUTE);
+        }
     };
 
-    const initializeElements = (selector) => {
-        document.querySelectorAll(selector).forEach((element) => {
+    const initializeElements = (selector, root = document) => {
+        let found = 0;
+        const elements = [];
+
+        if (root.nodeType === Node.ELEMENT_NODE && root.matches(selector)) {
+            elements.push(root);
+        }
+
+        root.querySelectorAll(selector).forEach((element) => {
+            elements.push(element);
+        });
+
+        elements.forEach((element) => {
+            found++;
+
             if (shouldIgnoreElement(element)) {
                 return;
             }
 
             createInstance(element);
         });
+
+        return found;
+    };
+
+    const initializeAll = (root = document) => {
+        return initializeElements(SELECTORS.RICH_TEXT, root) +
+            initializeElements(SELECTORS.MCE_CONTENT_BODY, root);
+    };
+
+    // Blocks added after load (new paragraphs, async patterns) get instances too.
+    const observeLateBlocks = () => {
+        if (observer || typeof MutationObserver === 'undefined') {
+            return;
+        }
+
+        observer = new MutationObserver((mutations) => {
+            mutations.forEach((mutation) => {
+                mutation.addedNodes.forEach((node) => {
+                    if (node.nodeType === Node.ELEMENT_NODE) {
+                        pendingRoots.add(node);
+                    }
+                });
+            });
+
+            if (pendingRoots.size === 0) {
+                return;
+            }
+
+            if (observerTimer) {
+                window.clearTimeout(observerTimer);
+            }
+
+            observerTimer = window.setTimeout(() => {
+                pendingRoots.forEach((root) => {
+                    if (root.isConnected) {
+                        initializeAll(root);
+                    }
+                });
+                pendingRoots.clear();
+            }, OBSERVER_DEBOUNCE);
+        });
+
+        observer.observe(document.body, { childList: true, subtree: true });
     };
 
     const handleGutenbergReady = () => {
-        initializeElements(SELECTORS.RICH_TEXT);
-        initializeElements(SELECTORS.MCE_CONTENT_BODY);
+        attempts++;
+
+        const found = initializeAll();
+
+        if (found === 0 && attempts < MAX_ATTEMPTS) {
+            window.setTimeout(handleGutenbergReady, INIT_DELAY);
+            return;
+        }
+
+        observeLateBlocks();
     };
 
     const handleGutenbergReadyWithDelay = () => {
@@ -75,4 +169,4 @@
 
         handleGutenbergReadyWithDelay();
     };
-})();
+})();

assets/instance.js

@@ -55,7 +55,9 @@ jQuery(function ($) {
                 })
                 .fail((jqXHR, textStatus) => {
                     let msg = 'Failed to load language list.';
-                    if (jqXHR && jqXHR.responseJSON && jqXHR.responseJSON.data && jqXHR.responseJSON.data.message) {
+                    if (jqXHR && jqXHR.status === 403) {
+                        msg = 'Your session has expired. Reload the page and try again.';
+                    } else if (jqXHR && jqXHR.responseJSON && jqXHR.responseJSON.data && jqXHR.responseJSON.data.message) {
                         msg = jqXHR.responseJSON.data.message;
                     } else if (textStatus) {
                         msg += ` (${textStatus})`;

assets/proofreaderConfig.js

@@ -14,6 +14,27 @@
     const serviceConfig = window.WSCServiceConfig || {};
     const proofreaderConfig = window.WSCProofreaderConfig || {};
 
+    // TinyMCE does not treat a bare DOM input event as an edit; without this the
+    // classic editor may consider the document unchanged and skip saving a correction.
+    function markTinyMceDirty(element) {
+        try {
+            const win = element.ownerDocument.defaultView;
+            const tinymce = win.tinymce || (win.parent && win.parent.tinymce);
+            if (!tinymce || !tinymce.editors) {
+                return;
+            }
+
+            Array.prototype.forEach.call(tinymce.editors, function (editor) {
+                const body = editor.getBody && editor.getBody();
+                if (body && (body === element || body.contains(element))) {
+                    editor.setDirty(true);
+                }
+            });
+        } catch (e) {
+            // Cross-frame access or missing TinyMCE — nothing to mark.
+        }
+    }
+
     const isBadgeEnabled = asBoolean(proofreaderConfig.enableBadgeButton, true);
     const badgeActions = isBadgeEnabled
         ? ['addWord', 'ignoreAll', 'settings', 'toggle', 'proofreadDialog']
@@ -37,6 +58,9 @@
         '#ping_sites',
         '#permalink_structure',
         '.inline-edit-password-input',
+        '#_sale_price',
+        '#_regular_price',
+        '#_weight',
     ];
 
     window.WEBSPELLCHECKER_CONFIG = {
@@ -66,14 +90,16 @@
             this.subscribe('replaceProblem', function () {
                 try {
                     const element = instance.getContainerNode();
+                    // Gutenberg's RichText syncs block state from the DOM on input.
                     element.dispatchEvent(new Event('input', { bubbles: true }));
+                    markTinyMceDirty(element);
                 } catch (e) {
                     // Container may have been detached by the host editor — safe to ignore.
                 }
             });
         },
         onBeforeAutoSearchInstanceCreate: function (activeElement) {
-            const id = activeElement.element.id;
+            const id = activeElement && activeElement.element ? activeElement.element.id : '';
             return !(id && id.indexOf('url-input-control') === 0);
         },
     };

includes/class-wproofreader-ajax.php

@@ -39,23 +39,39 @@ public static function get_proofreader_info() {
 		);
 	}
 
+	/** Upper bound for the getInfo JSON payload (a language list is a few KB). */
+	const MAX_PAYLOAD_BYTES = 65536;
+
 	/**
+	 * The SDK getInfo result arrives either as a JSON string or, when jQuery
+	 * serializes the result object into form fields, as a nested array.
+	 *
 	 * @param mixed $payload Raw POST payload.
 	 * @return array|null
 	 */
 	private static function parse_payload( $payload ) {
 		if ( is_string( $payload ) ) {
 			$payload = wp_unslash( $payload );
-			if ( '' === $payload ) {
+			if ( '' === $payload || strlen( $payload ) > self::MAX_PAYLOAD_BYTES ) {
 				return null;
 			}
 
 			$decoded = json_decode( $payload, true );
+
 			return ( JSON_ERROR_NONE === json_last_error() && is_array( $decoded ) ) ? $decoded : null;
 		}
 
 		if ( is_array( $payload ) ) {
-			return wp_unslash( $payload );
+			$payload = wp_unslash( $payload );
+
+			// jQuery may submit getInfoResult as nested form fields. Measure the
+			// normalized representation so this path cannot bypass the size cap.
+			$encoded = wp_json_encode( $payload );
+			if ( false === $encoded || strlen( $encoded ) > self::MAX_PAYLOAD_BYTES ) {
+				return null;
+			}
+
+			return $payload;
 		}
 
 		return null;