Automattic / Automattic/jetpack
Meta Tags Partially Discloses Content on Paid Newsletters
- Dominant language
- PHP
- Stars
- 1.8k
- Forks
- 898
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 774
Description
### Impacted plugin
Jetpack
### Quick summary
When using the paid newsletter feature, a portion of the content and an image (if available) will be used to generate meta tags for the post. This leads to a portion of the content being revealed.
### Steps to reproduce
1. Add a post for paid subscribers only
2. View the post as a non-paid subscriber and view the page source
3. Some content from the post will be auto-used to populate the meta tags in the `head`
### A clear and concise description of what you expected to happen.
I expect we wouldn't use the paid content and image (if added) by default and instead indicate that the post is for paid users.
### What actually happened
### Impact
Some (< 50%)
### Available workarounds?
No but the platform is still usable
### Platform (Simple and/or Atomic)
_No response_
### Logs or notes
- Related issue: #34342
- Internal reference: p1707275242069129-slack-C052XEUUBL4
Contributor guide
Research direction
Start by reproducing the paid-subscriber post scenario and inspect the page source for generated meta tags. Trace the Jetpack code that builds meta tags for paid newsletter posts, then verify that restricted content and images are not exposed and that the page instead indicates paid-only access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100