Wonderbar for EllesmereUI (DEPRECATED)
- By
Wonderbar for EllesmereUI is an information bar addon community made, built natively for the EllesmereUI ecosystem.
What's new
## v1.6.1 — Character sheet & DataBar fixes
### Midnight taint compliance (critical)
- Fixed: opening the character sheet (default C / `TOGGLECHARACTER2`)
could crash with "attempt to compare a secret number value (execution
tainted by EllesmereUIWonderBar)" inside
`TextStatusBar.UpdateTextStringWithValues`. Root cause: CharInfo
attached an insecure `CharacterFrame:HookScript("OnShow", ...)`. Under
Midnight's secret-value model, an insecure script hook on a Blizzard
frame taints the *entire* OnShow dispatch — including Blizzard's own
body, which calls `ShowStatusBarText` on the PlayerFrame health bar and
compares the (secret) health value. The hook is removed; the on-open
refresh (per-slot iLvl/enchant/gem overlays + average iLvl) is now
driven entirely by the existing
`hooksecurefunc("PaperDollItemSlotButton_Update", ...)` post-call,
which runs *after* Blizzard's code and never back-propagates taint.
The average-iLvl update is debounced — the post-call fires once per
equipment slot (17× on open), so a single `UpdateAvgDisplay` runs per
batch instead of 17.
- Fixed: the Travel module spammed "attempt to compare local 'duration'
(a secret number value, while execution tainted by
EllesmereUIWonderBar)" once per second (its cooldown OnUpdate is
throttled to 1 s). Root cause: `C_Spell.GetSpellCooldown` now returns
`startTime` / `duration` as *secret values* for some spells (observed
on spell 556, Astral Recall). `type(duration)` still reports "number",
so the guard passed, but the subsequent `duration > 0` comparison —
like any arithmetic on a secret value under addon (tainted) execution —
throws. `GetRemainingCooldown` now isolates the computation in a
`pcall` and returns a three-state result: `0` (ready), `>0` (seconds
left), or `nil` (unreadable — value is secret). `GetPrimaryCooldown`
skips `nil` transports instead of treating them as ready, so the
hearthstone countdown stays visible from the readable items even when a
secret-cooldown spell (e.g. Astral Recall) is owned; the tooltip rows
coerce `nil` to "Ready". The remaining time of a secret cooldown cannot
be recovered by design (anti-automation) — this degrades gracefully
rather than crashing.
- Fixed: entering a vehicle could crash `UnitFrameHealthBar_Update`
("attempt to compare local 'maxValue' (a secret number value)") on the
vehicle health bar, spam `SetCooldown` "secret values are only allowed
during untainted execution" thousands of times on the OverrideActionBar
buttons, and block `EABButtonNN:SetAttribute()`. All three share one
root cause: our INSPECT_READY handler re-fed the player tooltip with
`GameTooltip:SetUnit("mouseover")`. v1.6.0 removed the *secret* unit
token (`GetUnit()`) from this path but left the `SetUnit` call itself —
and `SetUnit` rebuilds the whole unit tooltip, re-reading the unit's
secret health/max-health through Blizzard's *shared* unit-frame health
machinery (`UnitFrameHealthBar_Update`). Run from our tainted execution,
that propagates taint into the shared unit-frame state, which later
poisons the vehicle health bar and the OverrideActionBar action buttons
during `ActionBarController_UpdateAll`. The re-trigger now appends the
iLvl / M+ lines to the already-shown tooltip directly (`AddIlvlToTooltip`)
instead of calling `SetUnit`, so no secret value is ever re-read.
- Fixed: `EllesmereUIWonderBar:EnableMouse()` was blocked
(`ADDON_ACTION_BLOCKED`) whenever the bar's visibility updated during
combat. In Midnight `EnableMouse` is a protected action in combat, but
`UpdateVisibility` called `bar:EnableMouse(...)` unconditionally — and it
runs on `PLAYER_REGEN_DISABLED`, `ZONE_CHANGED_NEW_AREA` and
`PLAYER_ENTERING_WORLD`, all of which fire while in combat (entering
combat, or mounting a vehicle mid-fight). The blocked protected call is
now gated behind `not InCombatLockdown()`; the mouse state is re-applied
on leaving combat via the existing `PLAYER_REGEN_ENABLED` → `RefreshBar`
path, and the bar is hidden in combat under NO_COMBAT / MOUSEOVER anyway,
so nothing visible changes.
- Fixed: entering combat or a vehicle spammed thousands of "SetCooldown:
secret values are only allowed during untainted execution" errors on the
standard and OverrideActionBar action buttons (`EABButton*`,
`MultiBar*`), and intermittently blocked `SetShown` / `SetAttribute` on
them. Root cause: the MicroMenu combat-lock. With `combatEn` off
(default), each micro button registers a `[combat]` state driver whose
secure `_onstate-combatlock` snippet called `self:EnableMouse(false/true)`.
`EnableMouse` is a protected action in combat (Midnight); invoked from
the snippet — which the *shared* `SecureStateDriverManager` runs on every
combat/vehicle transition — it tainted that manager, and the manager also
drives Blizzard's action bars, so the taint spread to every action button
and persisted until reload (hence the thousands of repeats). The snippet
now toggles only `*type1`, which is sufficient to disable the button's
click in combat; mouse/hover is left enabled (tooltips keep working in
combat) and no protected function is called from the shared driver.
### Reliability
- Fixed: right-clicking the DataBar (XP / Reputation) while no faction
was being watched made it vanish permanently. Right-click toggles
XP ↔ Reputation by writing `db.mode`; forcing Reputation mode with no
watched faction caused `RefreshRep` to `Hide()` the frame. Hiding the
frame also hid its child click button, so the toggle became
unreachable — and because `db.mode = "rep"` is a SavedVariable, the bar
stayed hidden across every reload. `RefreshRep` now distinguishes the
two cases: in auto mode it still hides cleanly (self-restores via
`UPDATE_FACTION` once a faction is watched); in manually-forced
Reputation mode it falls back to the XP display, so the bar stays
visible and clickable and a second right-click toggles back. Saves
already stuck in the hidden state self-heal on the next refresh. The
hover tooltip follows the same fallback so it no longer renders empty.
This mod has no additional files