Skip to content

Commit 170b9c2

Browse files
KingYesKingYes
committed
Tweak: Added more escaping
1 parent d37269c commit 170b9c2

9 files changed

Lines changed: 76 additions & 56 deletions

‎.github/workflows/php-coding-standards.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,5 +47,5 @@ jobs:
4747
run: |
4848
export PATH=$HOME/.composer/vendor/bin:$PATH
4949
composer run lint -- --report=checkstyle
50-
# Also show warnings as PR annotations (non-blocking)
50+
# Errors (including EscapeOutput) fail the job; remaining Security sniffs stay warnings
5151
vendor/bin/phpcs --standard=./ruleset.xml --extensions=php --error-severity=0 . --report=checkstyle || true

‎aryo-activity-log.php‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -112,10 +112,12 @@ protected function __construct() {
112112
public function __clone() {
113113
_doing_it_wrong(
114114
__FUNCTION__,
115-
sprintf(
116-
/* translators: %s: Class name. */
117-
__( 'Cloning instances of the singleton "%s" class is forbidden.', 'aryo-activity-log' ),
118-
get_class( $this )
115+
esc_html(
116+
sprintf(
117+
/* translators: %s: Class name. */
118+
__( 'Cloning instances of the singleton "%s" class is forbidden.', 'aryo-activity-log' ),
119+
get_class( $this )
120+
)
119121
),
120122
'2.0.7'
121123
);
@@ -130,10 +132,12 @@ public function __clone() {
130132
public function __wakeup() {
131133
_doing_it_wrong(
132134
__FUNCTION__,
133-
sprintf(
134-
/* translators: %s: Class name. */
135-
__( 'Unserializing instances of the singleton "%s" class is forbidden.', 'aryo-activity-log' ),
136-
get_class( $this )
135+
esc_html(
136+
sprintf(
137+
/* translators: %s: Class name. */
138+
__( 'Unserializing instances of the singleton "%s" class is forbidden.', 'aryo-activity-log' ),
139+
get_class( $this )
140+
)
137141
),
138142
'2.0.7'
139143
);

‎classes/class-aal-activity-log-list-table.php‎

Lines changed: 39 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -222,9 +222,9 @@ private function maybe_promotion_row( $object_type ) {
222222
printf(
223223
'<tr class="aal-table-promotion-row" data-promotion-id="%s" data-nonce="%s"><td colspan="' . count( $this->get_columns() ) . '"><div class="aal-table-promotion-inner">%s%s</div></td></tr>',
224224
esc_attr( $object_type ),
225-
wp_create_nonce( 'aal_promotion' ),
226-
$promotion_html,
227-
$dismiss_button
225+
esc_attr( wp_create_nonce( 'aal_promotion' ) ),
226+
$promotion_html, // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped in get_promotion_html_by_object_type().
227+
$dismiss_button // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- label escaped with esc_html__().
228228
);
229229
}
230230

@@ -558,9 +558,21 @@ public function extra_tablenav_footer() {
558558
<?php
559559
// Is result filtering enabled?
560560
if ( array_key_exists( 'aal-filter', $_GET ) ) {
561-
echo sprintf( esc_html__( 'Export filtered records as %s', 'aryo-activity-log' ), $action_title );
561+
echo esc_html(
562+
sprintf(
563+
/* translators: %s: export format title. */
564+
__( 'Export filtered records as %s', 'aryo-activity-log' ),
565+
$action_title
566+
)
567+
);
562568
} else {
563-
echo sprintf( esc_html__( 'Export as %s', 'aryo-activity-log' ), $action_title );
569+
echo esc_html(
570+
sprintf(
571+
/* translators: %s: export format title. */
572+
__( 'Export as %s', 'aryo-activity-log' ),
573+
$action_title
574+
)
575+
);
564576
}
565577
?>
566578
</button>
@@ -614,7 +626,7 @@ public function extra_tablenav( $which ) {
614626
);
615627
echo '<select name="dateshow" id="hs-filter-date">';
616628
foreach ( $date_options as $key => $value )
617-
printf( '<option value="%s"%s>%s</option>', $key, selected( $_REQUEST['dateshow'], $key, false ), $value );
629+
printf( '<option value="%s"%s>%s</option>', esc_attr( $key ), selected( $_REQUEST['dateshow'], $key, false ), esc_html( $value ) );
618630
echo '</select>';
619631

620632
submit_button( __( 'Filter', 'aryo-activity-log' ), 'button', 'aal-filter', false, array( 'id' => 'activity-query-submit' ) );
@@ -631,9 +643,9 @@ public function extra_tablenav( $which ) {
631643

632644
if ( ! empty( $output ) ) {
633645
echo '<select name="capshow" id="hs-filter-capshow">';
634-
printf( '<option value="">%s</option>', __( 'All Roles', 'aryo-activity-log' ) );
646+
printf( '<option value="">%s</option>', esc_html__( 'All Roles', 'aryo-activity-log' ) );
635647
foreach ( $output as $key => $value ) {
636-
printf( '<option value="%s"%s>%s</option>', $key, selected( $_REQUEST['capshow'], $key, false ), $value );
648+
printf( '<option value="%s"%s>%s</option>', esc_attr( $key ), selected( $_REQUEST['capshow'], $key, false ), esc_html( $value ) );
637649
}
638650
echo '</select>';
639651
}
@@ -655,9 +667,9 @@ public function extra_tablenav( $which ) {
655667

656668
if ( ! empty( $output ) ) {
657669
echo '<select name="usershow" id="hs-filter-usershow">';
658-
printf( '<option value="">%s</option>', __( 'All Users', 'aryo-activity-log' ) );
670+
printf( '<option value="">%s</option>', esc_html__( 'All Users', 'aryo-activity-log' ) );
659671
foreach ( $output as $key => $value ) {
660-
printf( '<option value="%s"%s>%s</option>', $key, selected( $_REQUEST['usershow'], $key, false ), $value );
672+
printf( '<option value="%s"%s>%s</option>', esc_attr( $key ), selected( $_REQUEST['usershow'], $key, false ), esc_html( $value ) );
661673
}
662674
echo '</select>';
663675
}
@@ -668,19 +680,16 @@ public function extra_tablenav( $which ) {
668680
$_REQUEST['typeshow'] = '';
669681
}
670682

671-
$output = array();
683+
echo '<select name="typeshow" id="hs-filter-typeshow">';
684+
printf( '<option value="">%s</option>', esc_html__( 'All Topics', 'aryo-activity-log' ) );
672685
foreach ( $this->data_types as $object_type ) {
673-
$output[] = sprintf(
686+
printf(
674687
'<option value="%s"%s>%s</option>',
675-
$object_type,
688+
esc_attr( $object_type ),
676689
selected( $_REQUEST['typeshow'], $object_type, false ),
677-
__( $object_type, 'aryo-activity-log' )
690+
esc_html( $object_type )
678691
);
679692
}
680-
681-
echo '<select name="typeshow" id="hs-filter-typeshow">';
682-
printf( '<option value="">%s</option>', __( 'All Topics', 'aryo-activity-log' ) );
683-
echo implode( '', $output );
684693
echo '</select>';
685694
}
686695

@@ -697,13 +706,16 @@ public function extra_tablenav( $which ) {
697706
if ( ! isset( $_REQUEST['showaction'] ) )
698707
$_REQUEST['showaction'] = '';
699708

700-
$output = array();
701-
foreach ( $actions as $action )
702-
$output[] = sprintf( '<option value="%s"%s>%s</option>', $action->action, selected( $_REQUEST['showaction'], $action->action, false ), $this->get_action_label( $action->action ) );
703-
704709
echo '<select name="showaction" id="hs-filter-showaction">';
705-
printf( '<option value="">%s</option>', __( 'All Actions', 'aryo-activity-log' ) );
706-
echo implode( '', $output );
710+
printf( '<option value="">%s</option>', esc_html__( 'All Actions', 'aryo-activity-log' ) );
711+
foreach ( $actions as $action ) {
712+
printf(
713+
'<option value="%s"%s>%s</option>',
714+
esc_attr( $action->action ),
715+
selected( $_REQUEST['showaction'], $action->action, false ),
716+
esc_html( $this->get_action_label( $action->action ) )
717+
);
718+
}
707719
echo '</select>';
708720
}
709721

@@ -740,7 +752,7 @@ public function extra_tablenav( $which ) {
740752

741753
foreach ( $filters as $filter ) {
742754
if ( ! empty( $_REQUEST[ $filter ] ) ) {
743-
echo '<a href="' . $this->get_filtered_link() . '" id="aal-reset-filter"><span class="dashicons dashicons-dismiss"></span>' . __( 'Reset Filters', 'aryo-activity-log' ) . '</a>';
755+
echo '<a href="' . esc_url( $this->get_filtered_link() ) . '" id="aal-reset-filter"><span class="dashicons dashicons-dismiss"></span>' . esc_html__( 'Reset Filters', 'aryo-activity-log' ) . '</a>';
744756
break;
745757
}
746758
}
@@ -881,8 +893,8 @@ public function search_box( $text, $input_id ) {
881893
$input_id = $input_id . '-search-input';
882894
?>
883895
<p class="search-box">
884-
<label class="screen-reader-text" for="<?php echo $input_id ?>"><?php echo $text; ?>:</label>
885-
<input type="search" id="<?php echo $input_id ?>" name="s" value="<?php echo esc_attr( $search_data ); ?>" />
896+
<label class="screen-reader-text" for="<?php echo esc_attr( $input_id ); ?>"><?php echo esc_html( $text ); ?>:</label>
897+
<input type="search" id="<?php echo esc_attr( $input_id ); ?>" name="s" value="<?php echo esc_attr( $search_data ); ?>" />
886898
<?php submit_button( $text, 'button', false, false, array('id' => 'search-submit') ); ?>
887899
</p>
888900
<?php

‎classes/class-aal-admin-ui.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ public function activity_log_page_func() {
2323
$this->get_list_table()->prepare_items();
2424
?>
2525
<div class="wrap">
26-
<h1 class="aal-page-title"><?php _ex( 'Activity Log', 'Page and Menu Title', 'aryo-activity-log' ); ?></h1>
26+
<h1 class="aal-page-title"><?php echo esc_html_x( 'Activity Log', 'Page and Menu Title', 'aryo-activity-log' ); ?></h1>
2727

2828
<form id="activity-filter" method="get">
2929
<input type="hidden" name="page" value="<?php echo esc_attr( $_REQUEST['page'] ); ?>" />

‎classes/class-aal-maintenance.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -242,7 +242,7 @@ public static function upgrade_notice() {
242242

243243
public static function handle_manual_upgrade() {
244244
if ( ! current_user_can( 'manage_options' ) ) {
245-
wp_die( __( 'You do not have sufficient permissions to access this page.', 'aryo-activity-log' ) );
245+
wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'aryo-activity-log' ) );
246246
}
247247

248248
check_admin_referer( 'aal_run_db_upgrade' );

‎classes/class-aal-notifications.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -296,7 +296,7 @@ public function load_handlers() {
296296
*/
297297
public function register_handler( $classname ) {
298298
if ( ! class_exists( $classname ) ) {
299-
trigger_error( __( 'The AAL notification handler you are trying to register does not exist.', 'aryo-activity-log' ) );
299+
trigger_error( esc_html__( 'The AAL notification handler you are trying to register does not exist.', 'aryo-activity-log' ) );
300300
return false;
301301
}
302302

‎classes/class-aal-settings.php‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -276,7 +276,7 @@ private function menu_print_tabs() {
276276
foreach ( $sections as $section_key => $section_caption ) {
277277
$active = $current_section === $section_key ? 'nav-tab-active' : '';
278278
$url = add_query_arg( 'aal_section', $section_key );
279-
echo '<a class="nav-tab ' . $active . '" href="' . esc_url( $url ) . '">' . esc_html( $section_caption ) . '</a>';
279+
echo '<a class="nav-tab ' . esc_attr( $active ) . '" href="' . esc_url( $url ) . '">' . esc_html( $section_caption ) . '</a>';
280280
}
281281
}
282282

@@ -297,7 +297,7 @@ public function display_settings_page() {
297297
<!-- Create a header in the default WordPress 'wrap' container -->
298298
<div class="wrap">
299299

300-
<h1 class="aal-page-title"><?php _e( 'Activity Log Settings', 'aryo-activity-log' ); ?></h1>
300+
<h1 class="aal-page-title"><?php esc_html_e( 'Activity Log Settings', 'aryo-activity-log' ); ?></h1>
301301
<?php settings_errors(); ?>
302302
<h2 class="nav-tab-wrapper"><?php $this->menu_print_tabs(); ?></h2>
303303

@@ -316,7 +316,7 @@ public function display_settings_page() {
316316
public function admin_notices() {
317317
switch ( filter_input( INPUT_GET, 'message' ) ) {
318318
case 'data_erased':
319-
printf( '<div class="updated"><p>%s</p></div>', __( 'All activities have been successfully deleted.', 'aryo-activity-log' ) );
319+
printf( '<div class="updated"><p>%s</p></div>', esc_html__( 'All activities have been successfully deleted.', 'aryo-activity-log' ) );
320320
break;
321321
}
322322
}
@@ -327,7 +327,7 @@ public function admin_footer() {
327327
<script type="text/javascript">
328328
jQuery( document ).ready( function( $ ) {
329329
$( '#aal-delete-log-activities' ).on( 'click', function( e ) {
330-
if ( ! confirm( '<?php echo __( 'Attention: We are going to DELETE ALL ACTIVITIES from the database. Are you sure you want to do that?', 'aryo-activity-log' ); ?>' ) ) {
330+
if ( ! confirm( '<?php echo esc_js( __( 'Attention: We are going to DELETE ALL ACTIVITIES from the database. Are you sure you want to do that?', 'aryo-activity-log' ) ); ?>' ) ) {
331331
e.preventDefault();
332332
}
333333
} );
@@ -338,7 +338,7 @@ public function admin_footer() {
338338

339339
public function ajax_aal_reset_items() {
340340
if ( ! check_ajax_referer( 'aal_reset_items', '_nonce', false ) || ! current_user_can( 'manage_options' ) ) {
341-
wp_die( __( 'You do not have sufficient permissions to access this page.', 'aryo-activity-log' ) );
341+
wp_die( esc_html__( 'You do not have sufficient permissions to access this page.', 'aryo-activity-log' ) );
342342
}
343343

344344
AAL_Main::instance()->api->erase_all_items();
@@ -395,13 +395,13 @@ final class AAL_Settings_Fields {
395395

396396
public static function general_settings_section_header() {
397397
?>
398-
<p><?php _e( 'These are some basic settings for Activity Log.', 'aryo-activity-log' ); ?></p>
398+
<p><?php esc_html_e( 'These are some basic settings for Activity Log.', 'aryo-activity-log' ); ?></p>
399399
<?php
400400
}
401401

402402
public static function email_notifications_section_header() {
403403
?>
404-
<p><?php _e( 'Serve yourself with custom-tailored notifications. First, define your conditions. Then, choose how the notifications will be sent.', 'aryo-activity-log' ); ?></p>
404+
<p><?php esc_html_e( 'Serve yourself with custom-tailored notifications. First, define your conditions. Then, choose how the notifications will be sent.', 'aryo-activity-log' ); ?></p>
405405
<?php
406406
}
407407

@@ -426,7 +426,7 @@ public static function text_field( $args ) {
426426
return;
427427

428428
?>
429-
<input type="text" id="<?php echo esc_attr( $args['id'] ); ?>" name="<?php echo esc_attr( $name ); ?>" value="<?php echo esc_attr( $value ); ?>" class="<?php echo implode( ' ', $args['classes'] ); ?>" />
429+
<input type="text" id="<?php echo esc_attr( $args['id'] ); ?>" name="<?php echo esc_attr( $name ); ?>" value="<?php echo esc_attr( $value ); ?>" class="<?php echo esc_attr( implode( ' ', $args['classes'] ) ); ?>" />
430430
<?php if ( ! empty( $desc ) ) : ?>
431431
<p class="description"><?php echo wp_kses_post( $desc ); ?></p>
432432
<?php endif;
@@ -446,7 +446,7 @@ public static function textarea_field( $args ) {
446446
return;
447447

448448
?>
449-
<textarea id="<?php echo esc_attr( $args['id'] ); ?>" name="<?php echo esc_attr( $name ); ?>" class="<?php echo implode( ' ', $args['classes'] ); ?>" rows="<?php echo absint( $args['rows'] ); ?>" cols="<?php echo absint( $args['cols'] ); ?>"><?php echo esc_textarea( $value ); ?></textarea>
449+
<textarea id="<?php echo esc_attr( $args['id'] ); ?>" name="<?php echo esc_attr( $name ); ?>" class="<?php echo esc_attr( implode( ' ', $args['classes'] ) ); ?>" rows="<?php echo absint( $args['rows'] ); ?>" cols="<?php echo absint( $args['cols'] ); ?>"><?php echo esc_textarea( $value ); ?></textarea>
450450

451451
<?php if ( ! empty( $desc ) ) : ?>
452452
<p class="description"><?php echo wp_kses_post( $desc ); ?></p>
@@ -467,7 +467,7 @@ public static function number_field( $args ) {
467467
return;
468468

469469
?>
470-
<input type="number" id="<?php echo esc_attr( $args['id'] ); ?>" name="<?php echo esc_attr( $name ); ?>" value="<?php echo esc_attr( $value ); ?>" class="<?php echo implode( ' ', $args['classes'] ); ?>" min="<?php echo esc_attr( $args['min'] ); ?>" step="<?php echo esc_attr( $args['step'] ); ?>" />
470+
<input type="number" id="<?php echo esc_attr( $args['id'] ); ?>" name="<?php echo esc_attr( $name ); ?>" value="<?php echo esc_attr( $value ); ?>" class="<?php echo esc_attr( implode( ' ', $args['classes'] ) ); ?>" min="<?php echo esc_attr( $args['min'] ); ?>" step="<?php echo esc_attr( $args['step'] ); ?>" />
471471
<?php if ( ! empty( $args['sub_desc'] ) ) echo wp_kses_post( $args['sub_desc'] ); ?>
472472
<?php if ( ! empty( $args['desc'] ) ) : ?>
473473
<p class="description"><?php echo wp_kses_post( $args['desc'] ); ?></p>
@@ -500,8 +500,8 @@ public static function yesno_field( $args ) {
500500
extract( $args, EXTR_SKIP );
501501

502502
?>
503-
<label class="tix-yes-no description"><input type="radio" name="<?php echo esc_attr( $name ); ?>" value="1" <?php checked( $value, true ); ?>> <?php _e( 'Yes', 'aryo-activity-log' ); ?></label>
504-
<label class="tix-yes-no description"><input type="radio" name="<?php echo esc_attr( $name ); ?>" value="0" <?php checked( $value, false ); ?>> <?php _e( 'No', 'aryo-activity-log' ); ?></label>
503+
<label class="tix-yes-no description"><input type="radio" name="<?php echo esc_attr( $name ); ?>" value="1" <?php checked( $value, true ); ?>> <?php esc_html_e( 'Yes', 'aryo-activity-log' ); ?></label>
504+
<label class="tix-yes-no description"><input type="radio" name="<?php echo esc_attr( $name ); ?>" value="0" <?php checked( $value, false ); ?>> <?php esc_html_e( 'No', 'aryo-activity-log' ); ?></label>
505505

506506
<?php if ( isset( $args['description'] ) ) : ?>
507507
<p class="description"><?php echo wp_kses_post( $args['description'] ); ?></p>
@@ -535,7 +535,7 @@ public static function email_notification_buffer_field( $args ) {
535535
// if empty, reset to one element with the key of 1
536536
$rows = empty( $rows ) ? array( array( 'key' => 1 ) ) : $rows;
537537
?>
538-
<p class="description"><?php _e( 'A notification will be sent upon a successful match with the following conditions:', 'aryo-activity-log' ); ?></p>
538+
<p class="description"><?php esc_html_e( 'A notification will be sent upon a successful match with the following conditions:', 'aryo-activity-log' ); ?></p>
539539
<div class="aal-notifier-settings">
540540
<ul>
541541
<?php foreach ( $rows as $rid => $row ) :
@@ -560,7 +560,7 @@ public static function email_notification_buffer_field( $args ) {
560560
<option value="<?php echo esc_attr( $option_key ); ?>" <?php selected( $option_key, $row_value ); ?>><?php echo esc_html( $option_value ); ?></option>
561561
<?php endforeach; ?>
562562
</select>
563-
<a href="#" class="aal-new-rule button"><small>+</small> <?php _e( 'and', 'aryo-activity-log' ); ?></a>
563+
<a href="#" class="aal-new-rule button"><small>+</small> <?php esc_html_e( 'and', 'aryo-activity-log' ); ?></a>
564564
<a href="#" class="aal-delete-rule button">&times;</a>
565565
</li>
566566
<?php endforeach; ?>

‎notifications/abstract-class-aal-notification-base.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ public function settings_fields() {}
4040
public function trigger( $args ) {}
4141

4242
public function _settings_section_callback() {
43-
echo '<p>' . $this->description . '</p>';
43+
echo '<p>' . esc_html( $this->description ) . '</p>';
4444
}
4545

4646
public function _settings_enabled_field_callback( $args = array() ) {

‎ruleset.xml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,18 @@
1414
<exclude-pattern>build/</exclude-pattern>
1515
<exclude-pattern>node_modules/</exclude-pattern>
1616
<exclude-pattern>tests/</exclude-pattern>
17+
<exclude-pattern>aryo-activity-log/</exclude-pattern>
1718

1819
<!--
19-
Security rules downgraded to warnings until legacy violations are resolved.
20-
TODO: Promote back to errors once the codebase is cleaned up.
20+
Remaining Security sniffs are warnings until nonce/sanitization debt is resolved.
21+
EscapeOutput is an error so unescaped output (including __()) fails CI.
2122
-->
2223
<rule ref="WordPress.Security">
2324
<type>warning</type>
2425
</rule>
26+
<rule ref="WordPress.Security.EscapeOutput">
27+
<type>error</type>
28+
</rule>
2529

2630
<rule ref="WordPress.WP.DeprecatedFunctions" />
2731

0 commit comments

Comments
 (0)