From 8579a3637415b7e40f8d23ef92624242f333e226 Mon Sep 17 00:00:00 2001
From: Matt Friedman <maf675@gmail.com>
Date: Thu, 23 Jul 2026 09:26:42 -0700
Subject: [PATCH 1/3] Code improvements

---
 ext.php                    | 2 +-
 package.json               | 1 +
 ucp/controller/webpush.php | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/ext.php b/ext.php
index 56f2872..c6d4f70 100644
--- a/ext.php
+++ b/ext.php
@@ -78,7 +78,7 @@ protected function check_phpbb_version()
 	 */
 	protected function check_php_version()
 	{
-		if (phpbb_version_compare(PHP_VERSION_ID, '70300', '<'))
+		if (PHP_VERSION_ID < 70300)
 		{
 			$this->errors[] = 'PHP_VERSION_ERROR';
 		}
diff --git a/package.json b/package.json
index c366bf5..8e37252 100644
--- a/package.json
+++ b/package.json
@@ -1,4 +1,5 @@
 {
+	"private": true,
 	"name": "phpbb-web-push-notifications",
 	"author": "phpBB Limited",
 	"license": "GPL-2.0",
diff --git a/ucp/controller/webpush.php b/ucp/controller/webpush.php
index 2affea5..103688f 100644
--- a/ucp/controller/webpush.php
+++ b/ucp/controller/webpush.php
@@ -222,7 +222,7 @@ private function get_anonymous_notifications(): string
 			$user_lang = $row['user_lang'];
 
 			$expected_push_token = hash('sha256', $user_form_token . $push_token);
-			if ($expected_push_token === $token)
+			if (hash_equals($expected_push_token, $token))
 			{
 				if ($user_lang !== $this->language->get_used_language())
 				{

From e30d7e35bc309a110050aa954afd265b113d20d7 Mon Sep 17 00:00:00 2001
From: Matt Friedman <maf675@gmail.com>
Date: Thu, 23 Jul 2026 09:27:26 -0700
Subject: [PATCH 2/3] Fix migration reverting nothing / unused revert

---
 migrations/add_webpush.php | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/migrations/add_webpush.php b/migrations/add_webpush.php
index 70743d3..0fa2773 100644
--- a/migrations/add_webpush.php
+++ b/migrations/add_webpush.php
@@ -79,14 +79,4 @@ public function update_data(): array
 			]]],
 		];
 	}
-
-	public function revert_data(): array
-	{
-		return [
-			['config.remove', ['wpn_webpush_enable']],
-			['config.remove', ['wpn_webpush_vapid_public']],
-			['config.remove', ['wpn_webpush_vapid_private']],
-			['module.remove', ['acp', 'ACP_BOARD_CONFIGURATION', 'ACP_WEBPUSH_EXT_SETTINGS']]
-		];
-	}
 }

From 8e53d882838dae4df7eab0250d80ac532f717657 Mon Sep 17 00:00:00 2001
From: Matt Friedman <maf675@gmail.com>
Date: Thu, 23 Jul 2026 09:27:49 -0700
Subject: [PATCH 3/3] Escape Javascript variables and fix expirationTime

---
 .../template/ucp_notifications_webpush.html    | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/styles/all/template/ucp_notifications_webpush.html b/styles/all/template/ucp_notifications_webpush.html
index 2967f1f..38929ef 100644
--- a/styles/all/template/ucp_notifications_webpush.html
+++ b/styles/all/template/ucp_notifications_webpush.html
@@ -1,21 +1,21 @@
 <script>
 	phpbbWebpushOptions = {
-		serviceWorkerUrl: '{{ U_WEBPUSH_WORKER_URL }}',
-		subscribeUrl: '{{ U_WEBPUSH_SUBSCRIBE }}',
-		unsubscribeUrl: '{{ U_WEBPUSH_UNSUBSCRIBE }}',
-		togglePopupUrl: '{{ U_WEBPUSH_TOGGLE_POPUP }}',
+		serviceWorkerUrl: '{{ U_WEBPUSH_WORKER_URL|e('js') }}',
+		subscribeUrl: '{{ U_WEBPUSH_SUBSCRIBE|e('js') }}',
+		unsubscribeUrl: '{{ U_WEBPUSH_UNSUBSCRIBE|e('js') }}',
+		togglePopupUrl: '{{ U_WEBPUSH_TOGGLE_POPUP|e('js') }}',
 		ajaxErrorTitle: '{{ lang_js('AJAX_ERROR_TITLE') }}',
-		vapidPublicKey: '{{ VAPID_PUBLIC_KEY }}',
+		vapidPublicKey: '{{ VAPID_PUBLIC_KEY|e('js') }}',
 		formTokens: {
-			creationTime: '{{ WEBPUSH_FORM_TOKENS.creation_time }}',
-			formToken: '{{ WEBPUSH_FORM_TOKENS.form_token }}',
+			creationTime: {{ WEBPUSH_FORM_TOKENS.creation_time|int }},
+			formToken: '{{ WEBPUSH_FORM_TOKENS.form_token|e('js') }}',
 		},
 		subscriptions: [
 		{% for sub in SUBSCRIPTIONS %}
-			{endpoint: '{{ sub.endpoint }}', expiration: '{{ sub.expiration }}' },
+			{endpoint: '{{ sub.endpoint|e('js') }}', expirationTime: {{ sub.expirationTime|int }} },
 		{% endfor %}
 		],
-	}
+	};
 </script>
 
 {% INCLUDEJS '@phpbb_webpushnotifications/webpush.js' %}