Repository navigation
Fix PHPCS code errors: escaping, nonce order and a PHP 8 join() fatal - #239
Merged
Merged
Conversation
bordoni
force-pushed
the
fix/phpcs-code
branch
3 times, most recently
from
October 17, 2026 18:55
22c62c4 to
aa5189d
Compare
bordoni
force-pushed
the
fix/phpcs-code
branch
from
October 17, 2026 23:17
aa5189d to
6f6399b
Compare
…late - Container start: esc_attr() on the id and class attributes (values were already sanitized, output is unchanged). - Changelog: wp_kses_post() on the generated changelog HTML (p, ul, li, a, code only) and esc_html_e() for the heading. - Error page: esc_html_e() for the heading, a translators comment, and a local variable that no longer shadows the $locale global. - Raw field: documented phpcs:ignore, the field prints plugin-built markup by design. - components/field.php only held two var_dump() calls and is never rendered.
Reserved-word parameter names ($array, $default, $var, $class) stay as they are because renaming them breaks named arguments; each gets a targeted ignore. unset_var() documents why its catch is empty.
- Translators comments for the page title and the 'Faked %1$d new %2$s' notices. - 'Contact Support' link text uses esc_html__() (same output as esc_attr__()). - Split chained assignments in Admin::add_message() and Menu::add(); the stored objects are the same. - Group the Menu.php use statements. - Targeted ignores: underscore-prefixed hook callbacks and Menu::add( $parent ) are public API, the submenu relabel needs the $submenu global, and correctly_set_current_screen() keeps its hook argument.
- Translators comments on the permission errors and the batch success messages. - format_batched_success_message() passed a variable to _n(), which no string extractor can pick up. get_batched_item_label() now uses a literal _n() per known type (post, user, term, comment, attachment) and keeps the old fallback for anything else. - Rename the endpoint closure parameter $class to $endpoint_class. - Targeted ignores for the OpenAPI class name and the term-search 'exclude' argument; align the Terms arg arrays.
- Template lookup uses get_stylesheet_directory() / get_template_directory() instead of the deprecated STYLESHEETPATH / TEMPLATEPATH constants (same paths, WordPress 6.4 deprecated the constants). - Utils::attr() encodes non-scalar attributes with wp_json_encode(). - Targeted ignores for Template::get( $default ), Template::render( $echo ) and the rendered template echo.
- is_a( $container, __CLASS__ ) becomes $container instanceof self. - Fold the two empty if branches in Field::parse() into a single negated check (same result). - Option labels use esc_html() (same output as esc_attr()). - Empty __( '' ) calls become plain empty strings. - Meta template closures drop parameters they never used. - Targeted ignores for the public Field::plugin constant, output( $print ) and the balanceTags() echo.
PHP 8 removed the join( $pieces, $glue ) order, so Text\Base::sentence(), paragraph() and text() and the set() helper's error path threw a TypeError. Swapping the arguments gives the output the code always intended. Also drops the space in $paragraphs [].
- get_terms() uses the single-array signature (the taxonomy-first form is deprecated since WordPress 4.5); the taxonomy still wins over any 'taxonomy' in $args, as before. - Empty catch blocks in the date formatters set $max = null so the existing 'now' fallback runs, with a comment. - Split the chained $els[] = $element assignment in HTML::html_elements(). - Text\Base: rename the protected randomize_nb_elements() parameter; the Faker-style camelCase public API ($wordList, $nbWords, $asText, ...) stays behind a scoped disable, and mt_rand() stays because Faker seeds it. - WP_Comment: $comment_post_ID mirrors the WordPress field, scoped disable. - Drop the commented-out WP_Term::slug() stub. - Targeted ignores: LoremPicsum class name, the HTML 'exclude' element list, the random list-length loop, suppress_filters on the post pool, meta_type_raw( $default ).
query_posts() copied $_POST into $request and then checked $request->nonce. It now checks $_POST['nonce'] first (unslashed and sanitized; nonces are alphanumeric so the value is unchanged) and only then reads the rest of the request. Same accept/reject outcome. search_terms() uses get_terms() with a single array, and the term-search 'exclude' lines get targeted ignores.
- Attachment: wp_delete_file() for the download_url() temp files (core's wrapper around unlink(), filterable via wp_delete_file), translators comments, and the protected get_random_dimension( $default ) parameter becomes $fallback. - Post, Term, Comment, User: class imports before function imports. - Targeted ignores: fetch() meta_query / nopaging (lists every generated item for bulk delete and image reuse), Meta's own $data['meta_value'] key (not a query), the WP_DEBUG-only error_log() calls and the 5 second attribution lookup timeout.
Plugin::$_file, Plugin::$_ext_domain, Plugin::get( $default ) and the Field_Interface / Field_Abstract $default, $echo and $parent parameters are public API, so they keep their names with targeted ignores.
bordoni
force-pushed
the
fix/phpcs-code
branch
from
October 17, 2026 23:20
6f6399b to
109e582
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The code half of the PHPCS cleanup (docblocks are in #240).
Behaviour changes:
join()with the arguments reversed, which is fatal on PHP 8.Ajax::query_postsverifies the nonce before reading$_POST.var_dumpfield template.The rest is annotation and cleanup across the admin pages, modules, providers, REST and the deprecated legacy
Fieldclass.Stacked on #238.
Checked: WPUnit 108 on PHP 8.2 and 8.3, plus REST generation of all 21 meta types on all 5 modules.