2287138149
Two bugs, both invisible to every test written so far, because those tests
post to wp-login.php over HTTP and a browser does not.
**The submit was blocked.** WordPress marks its username and password inputs
`required`. The wallet path deliberately leaves both empty — the signature is
the credential — so `form.requestSubmit()` ran constraint validation, refused,
and pointed a "Please fill out this field" bubble at an input the visitor is
not supposed to touch, with a valid signature already sitting in the form.
Nothing happened and nothing explained why. The wallet submit now turns
validation off for that submission only; password sign-in keeps it.
**`hidden` did not hide.** The attribute works through a UA rule that any
author rule with a `display` outranks, and WordPress ships exactly such a
rule — `.wp-core-ui .button { display: inline-block }`. So the two buttons
this plugin ships hidden were on screen regardless. That inverted the whole
progressive-enhancement story: "Use the browser wallet" was offered on every
browser including those without one, and a visitor with JavaScript disabled
would have been shown a sign-in button that could never do anything, instead
of the paste-a-signature box that works without scripts.
Found by opening the login page in a browser and clicking the button, which
is the one thing 178 passing checks had not done.
185 lines
3.9 KiB
CSS
185 lines
3.9 KiB
CSS
/*
|
|
* Sign-in screen styling.
|
|
*
|
|
* Sits on top of whatever wp-login.php already looks like rather than
|
|
* replacing it, so a site using a login-branding plugin keeps its branding.
|
|
* The only strong visual claim made here is hierarchy: the wallet block reads
|
|
* as the way in, and the password field above it reads as a leftover.
|
|
*/
|
|
|
|
/*
|
|
* Make the `hidden` attribute actually hide things.
|
|
*
|
|
* `hidden` works through a UA rule — `[hidden] { display: none }` — which any
|
|
* author rule carrying a `display` outranks. WordPress ships exactly such a
|
|
* rule: `.wp-core-ui .button { display: inline-block }` in buttons.css, which
|
|
* matches every button in this block.
|
|
*
|
|
* Without this the whole progressive-enhancement story silently inverts. The
|
|
* markup ships with the sign-in button, the browser-wallet button and the
|
|
* phrase field hidden, and the script reveals only the ones that can work.
|
|
* Defeat `hidden` and a visitor with JavaScript off is offered a button that
|
|
* does nothing, and everyone is offered a browser wallet that is not there.
|
|
*/
|
|
.sirius-wallet [hidden] {
|
|
display: none !important;
|
|
}
|
|
|
|
.sirius-wallet {
|
|
margin: 16px 0 8px;
|
|
padding: 16px;
|
|
border: 1px solid #dcdcde;
|
|
border-radius: 6px;
|
|
background: #fbfbfc;
|
|
}
|
|
|
|
.sirius-wallet__message {
|
|
width: 100%;
|
|
box-sizing: border-box;
|
|
font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
|
|
font-size: 11px;
|
|
line-height: 1.5;
|
|
color: #2c3338;
|
|
background: #fff;
|
|
border: 1px solid #dcdcde;
|
|
border-radius: 4px;
|
|
padding: 8px;
|
|
resize: vertical;
|
|
}
|
|
|
|
.sirius-wallet__actions {
|
|
display: flex;
|
|
flex-wrap: wrap;
|
|
gap: 8px;
|
|
margin: 12px 0 0;
|
|
}
|
|
|
|
.sirius-wallet__phrase {
|
|
margin-top: 14px;
|
|
}
|
|
|
|
.sirius-wallet__phrase label {
|
|
display: block;
|
|
font-weight: 600;
|
|
margin-bottom: 4px;
|
|
}
|
|
|
|
.sirius-wallet__phrase-input,
|
|
.sirius-wallet__signature,
|
|
.sirius-wallet__address-input,
|
|
#sirius_derive_phrase {
|
|
width: 100%;
|
|
box-sizing: border-box;
|
|
font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
|
|
font-size: 13px;
|
|
padding: 8px;
|
|
border: 1px solid #8c8f94;
|
|
border-radius: 4px;
|
|
/* A recovery phrase is the one secret on this page; never offer it to a
|
|
password manager or a spellchecker's network round trip. */
|
|
-webkit-text-security: none;
|
|
}
|
|
|
|
.sirius-wallet__hint,
|
|
.sirius-hint {
|
|
font-size: 12px;
|
|
color: #50575e;
|
|
margin: 6px 0 0;
|
|
line-height: 1.5;
|
|
}
|
|
|
|
.sirius-wallet__manual {
|
|
margin-top: 14px;
|
|
font-size: 13px;
|
|
}
|
|
|
|
.sirius-wallet__manual summary {
|
|
cursor: pointer;
|
|
color: #2271b1;
|
|
}
|
|
|
|
.sirius-wallet__status {
|
|
margin: 10px 0 0;
|
|
min-height: 1.4em;
|
|
font-size: 13px;
|
|
line-height: 1.4;
|
|
}
|
|
|
|
.sirius-wallet__status.is-error {
|
|
color: #b32d2e;
|
|
font-weight: 600;
|
|
}
|
|
|
|
.sirius-intro {
|
|
border-left-color: #2271b1 !important;
|
|
}
|
|
|
|
/* --- the recovery page ------------------------------------------------- */
|
|
|
|
.sirius-recovery {
|
|
background: #fff;
|
|
border: 1px solid #dcdcde;
|
|
border-radius: 6px;
|
|
padding: 20px 24px;
|
|
margin-top: 20px;
|
|
font-size: 14px;
|
|
line-height: 1.6;
|
|
}
|
|
|
|
.sirius-recovery h2 {
|
|
font-size: 15px;
|
|
margin: 20px 0 6px;
|
|
}
|
|
|
|
.sirius-recovery .message {
|
|
font-weight: 600;
|
|
border-left: 4px solid #dba617;
|
|
padding: 10px 12px;
|
|
background: #fcf9e8;
|
|
margin: 0 0 14px;
|
|
}
|
|
|
|
.sirius-derive {
|
|
margin-top: 10px;
|
|
padding: 12px;
|
|
background: #f6f7f7;
|
|
border-radius: 4px;
|
|
}
|
|
|
|
.sirius-derive label {
|
|
display: block;
|
|
font-weight: 600;
|
|
margin-bottom: 4px;
|
|
}
|
|
|
|
.sirius-derive__out {
|
|
font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
|
|
font-size: 12px;
|
|
word-break: break-all;
|
|
margin: 8px 0 0;
|
|
min-height: 1.4em;
|
|
}
|
|
|
|
.sirius-derive__out.is-address {
|
|
color: #007017;
|
|
font-weight: 700;
|
|
}
|
|
|
|
.sirius-derive__out.is-error {
|
|
color: #b32d2e;
|
|
}
|
|
|
|
@media (prefers-color-scheme: dark) {
|
|
/* wp-login.php has no dark mode of its own, so only soften what would
|
|
glare if a login-branding plugin has provided one. */
|
|
.sirius-wallet {
|
|
background: transparent;
|
|
}
|
|
}
|
|
|
|
.sirius-wallet__address-label {
|
|
display: block;
|
|
font-weight: 600;
|
|
margin: 10px 0 4px;
|
|
font-size: 13px;
|
|
}
|