Skip to content

Tweak: Added more escaping #231

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
KingYes merged 5 commits into from
Aug 24, 2026
Merged

Tweak: Added more escaping #231

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
170b9c2
Tweak: Added more escaping
KingYes Aug 19, 2026
144398d
more escaping
KingYes Aug 19, 2026
4cb50df
Merge branch 'master' into tweak/lint-security
KingYes Aug 24, 2026
15974c2
fixing ci 429 error
KingYes Aug 24, 2026
08be34e
Tweak: Remove notifications legacy code (#232)
KingYes Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/php-coding-standards.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,5 +48,5 @@ jobs:
run: |
export PATH=$HOME/.composer/vendor/bin:$PATH
composer run lint -- --report=checkstyle
# Also show warnings as PR annotations (non-blocking)
# Errors (including EscapeOutput) fail the job; remaining Security sniffs stay warnings
vendor/bin/phpcs --standard=./ruleset.xml --extensions=php --error-severity=0 . --report=checkstyle || true
9 changes: 7 additions & 2 deletions .github/workflows/phpunit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,10 +68,15 @@ jobs:
cp -r /tmp/wordpress-develop/tests/phpunit/* /tmp/wordpress-tests-lib/

if [ "${{ matrix.wp-version }}" = "latest" ]; then
wget -O /tmp/wordpress.tar.gz https://wordpress.org/latest.tar.gz
WP_URL="https://wordpress.org/latest.tar.gz"
else
wget -O /tmp/wordpress.tar.gz https://wordpress.org/wordpress-${{ matrix.wp-version }}.tar.gz
WP_URL="https://wordpress.org/wordpress-${{ matrix.wp-version }}.tar.gz"
fi
for i in 1 2 3 4 5; do
wget -nv -O /tmp/wordpress.tar.gz "$WP_URL" && break
echo "Download attempt $i failed, retrying in $((i * 15))s..."
sleep $((i * 15))
done
tar -xzf /tmp/wordpress.tar.gz -C /tmp/
}

Expand Down
27 changes: 12 additions & 15 deletions aryo-activity-log.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@
include( 'classes/class-aal-settings.php' );
include( 'classes/class-aal-api.php' );
include( 'classes/class-aal-hooks.php' );
include( 'classes/class-aal-notifications.php' );
include( 'classes/class-aal-export.php' );
include( 'classes/class-aal-privacy.php' );
include( 'classes/abstract-class-aal-exporter.php' );
Expand Down Expand Up @@ -76,11 +75,6 @@ final class AAL_Main {
*/
public $api;

/**
* @var \AAL_Notifications
*/
public $notifications;

/**
* Construct
*/
Expand All @@ -91,7 +85,6 @@ protected function __construct() {
$this->hooks = new AAL_Hooks();
$this->settings = new AAL_Settings();
$this->api = new AAL_API();
$this->notifications = new AAL_Notifications();

new AAL_Export();
new AAL_Privacy();
Expand All @@ -112,10 +105,12 @@ protected function __construct() {
public function __clone() {
_doing_it_wrong(
__FUNCTION__,
sprintf(
/* translators: %s: Class name. */
__( 'Cloning instances of the singleton "%s" class is forbidden.', 'aryo-activity-log' ),
get_class( $this )
esc_html(
sprintf(
/* translators: %s: Class name. */
__( 'Cloning instances of the singleton "%s" class is forbidden.', 'aryo-activity-log' ),
get_class( $this )
)
),
'2.0.7'
);
Expand All @@ -130,10 +125,12 @@ public function __clone() {
public function __wakeup() {
_doing_it_wrong(
__FUNCTION__,
sprintf(
/* translators: %s: Class name. */
__( 'Unserializing instances of the singleton "%s" class is forbidden.', 'aryo-activity-log' ),
get_class( $this )
esc_html(
sprintf(
/* translators: %s: Class name. */
__( 'Unserializing instances of the singleton "%s" class is forbidden.', 'aryo-activity-log' ),
get_class( $this )
)
),
'2.0.7'
);
Expand Down
123 changes: 0 additions & 123 deletions assets/js/settings.js
View file
Open in desktop

This file was deleted.

17 changes: 12 additions & 5 deletions bin/install-wp-tests.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,18 @@ WP_TESTS_DIR=${WP_TESTS_DIR-$TMPDIR/wordpress-tests-lib}
WP_CORE_DIR=${WP_CORE_DIR-$TMPDIR/wordpress}

download() {
if [ `which curl` ]; then
curl -s "$1" > "$2";
elif [ `which wget` ]; then
wget -nv -O "$2" "$1"
fi
local max_retries=5
for i in $(seq 1 $max_retries); do
if [ `which curl` ]; then
curl -sSf --retry 3 --retry-delay 10 "$1" > "$2" && return 0
elif [ `which wget` ]; then
wget -nv --tries=3 --waitretry=10 -O "$2" "$1" && return 0
fi
echo "Download attempt $i/$max_retries failed for $1, retrying in $((i * 15))s..."
sleep $((i * 15))
done
echo "All download attempts failed for $1"
return 1
}

if [[ $WP_VERSION =~ ^[0-9]+\.[0-9]+\-(beta|RC)[0-9]+$ ]]; then
Expand Down
66 changes: 39 additions & 27 deletions classes/class-aal-activity-log-list-table.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -222,9 +222,9 @@ private function maybe_promotion_row( $object_type ) {
printf(
'<tr class="aal-table-promotion-row" data-promotion-id="%s" data-nonce="%s"><td colspan="' . count( $this->get_columns() ) . '"><div class="aal-table-promotion-inner">%s%s</div></td></tr>',
esc_attr( $object_type ),
wp_create_nonce( 'aal_promotion' ),
$promotion_html,
$dismiss_button
esc_attr( wp_create_nonce( 'aal_promotion' ) ),
$promotion_html, // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- escaped in get_promotion_html_by_object_type().
$dismiss_button // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- label escaped with esc_html__().
);
}

Expand Down Expand Up @@ -558,9 +558,21 @@ public function extra_tablenav_footer() {
<?php
// Is result filtering enabled?
if ( array_key_exists( 'aal-filter', $_GET ) ) {
echo sprintf( esc_html__( 'Export filtered records as %s', 'aryo-activity-log' ), $action_title );
echo esc_html(
sprintf(
/* translators: %s: export format title. */
__( 'Export filtered records as %s', 'aryo-activity-log' ),
$action_title
)
);
} else {
echo sprintf( esc_html__( 'Export as %s', 'aryo-activity-log' ), $action_title );
echo esc_html(
sprintf(
/* translators: %s: export format title. */
__( 'Export as %s', 'aryo-activity-log' ),
$action_title
)
);
}
?>
</button>
Expand Down Expand Up @@ -614,7 +626,7 @@ public function extra_tablenav( $which ) {
);
echo '<select name="dateshow" id="hs-filter-date">';
foreach ( $date_options as $key => $value )
printf( '<option value="%s"%s>%s</option>', $key, selected( $_REQUEST['dateshow'], $key, false ), $value );
printf( '<option value="%s"%s>%s</option>', esc_attr( $key ), selected( $_REQUEST['dateshow'], $key, false ), esc_html( $value ) );
echo '</select>';

submit_button( __( 'Filter', 'aryo-activity-log' ), 'button', 'aal-filter', false, array( 'id' => 'activity-query-submit' ) );
Expand All @@ -631,9 +643,9 @@ public function extra_tablenav( $which ) {

if ( ! empty( $output ) ) {
echo '<select name="capshow" id="hs-filter-capshow">';
printf( '<option value="">%s</option>', __( 'All Roles', 'aryo-activity-log' ) );
printf( '<option value="">%s</option>', esc_html__( 'All Roles', 'aryo-activity-log' ) );
foreach ( $output as $key => $value ) {
printf( '<option value="%s"%s>%s</option>', $key, selected( $_REQUEST['capshow'], $key, false ), $value );
printf( '<option value="%s"%s>%s</option>', esc_attr( $key ), selected( $_REQUEST['capshow'], $key, false ), esc_html( $value ) );
}
echo '</select>';
}
Expand All @@ -655,9 +667,9 @@ public function extra_tablenav( $which ) {

if ( ! empty( $output ) ) {
echo '<select name="usershow" id="hs-filter-usershow">';
printf( '<option value="">%s</option>', __( 'All Users', 'aryo-activity-log' ) );
printf( '<option value="">%s</option>', esc_html__( 'All Users', 'aryo-activity-log' ) );
foreach ( $output as $key => $value ) {
printf( '<option value="%s"%s>%s</option>', $key, selected( $_REQUEST['usershow'], $key, false ), $value );
printf( '<option value="%s"%s>%s</option>', esc_attr( $key ), selected( $_REQUEST['usershow'], $key, false ), esc_html( $value ) );
}
echo '</select>';
}
Expand All @@ -668,19 +680,16 @@ public function extra_tablenav( $which ) {
$_REQUEST['typeshow'] = '';
}

$output = array();
echo '<select name="typeshow" id="hs-filter-typeshow">';
printf( '<option value="">%s</option>', esc_html__( 'All Topics', 'aryo-activity-log' ) );
foreach ( $this->data_types as $object_type ) {
$output[] = sprintf(
printf(
'<option value="%s"%s>%s</option>',
$object_type,
esc_attr( $object_type ),
selected( $_REQUEST['typeshow'], $object_type, false ),
__( $object_type, 'aryo-activity-log' )
esc_html( $object_type )
);
}

echo '<select name="typeshow" id="hs-filter-typeshow">';
printf( '<option value="">%s</option>', __( 'All Topics', 'aryo-activity-log' ) );
echo implode( '', $output );
echo '</select>';
}

Expand All @@ -697,13 +706,16 @@ public function extra_tablenav( $which ) {
if ( ! isset( $_REQUEST['showaction'] ) )
$_REQUEST['showaction'] = '';

$output = array();
foreach ( $actions as $action )
$output[] = sprintf( '<option value="%s"%s>%s</option>', $action->action, selected( $_REQUEST['showaction'], $action->action, false ), $this->get_action_label( $action->action ) );

echo '<select name="showaction" id="hs-filter-showaction">';
printf( '<option value="">%s</option>', __( 'All Actions', 'aryo-activity-log' ) );
echo implode( '', $output );
printf( '<option value="">%s</option>', esc_html__( 'All Actions', 'aryo-activity-log' ) );
foreach ( $actions as $action ) {
printf(
'<option value="%s"%s>%s</option>',
esc_attr( $action->action ),
selected( $_REQUEST['showaction'], $action->action, false ),
esc_html( $this->get_action_label( $action->action ) )
);
}
echo '</select>';
}

Expand Down Expand Up @@ -740,7 +752,7 @@ public function extra_tablenav( $which ) {

foreach ( $filters as $filter ) {
if ( ! empty( $_REQUEST[ $filter ] ) ) {
echo '<a href="' . $this->get_filtered_link() . '" id="aal-reset-filter"><span class="dashicons dashicons-dismiss"></span>' . __( 'Reset Filters', 'aryo-activity-log' ) . '</a>';
echo '<a href="' . esc_url( $this->get_filtered_link() ) . '" id="aal-reset-filter"><span class="dashicons dashicons-dismiss"></span>' . esc_html__( 'Reset Filters', 'aryo-activity-log' ) . '</a>';
break;
}
}
Expand Down Expand Up @@ -881,8 +893,8 @@ public function search_box( $text, $input_id ) {
$input_id = $input_id . '-search-input';
?>
<p class="search-box">
<label class="screen-reader-text" for="<?php echo $input_id ?>"><?php echo $text; ?>:</label>
<input type="search" id="<?php echo $input_id ?>" name="s" value="<?php echo esc_attr( $search_data ); ?>" />
<label class="screen-reader-text" for="<?php echo esc_attr( $input_id ); ?>"><?php echo esc_html( $text ); ?>:</label>
<input type="search" id="<?php echo esc_attr( $input_id ); ?>" name="s" value="<?php echo esc_attr( $search_data ); ?>" />
<?php submit_button( $text, 'button', false, false, array('id' => 'search-submit') ); ?>
</p>
<?php
Expand Down
5 changes: 3 additions & 2 deletions classes/class-aal-admin-ui.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,12 +21,13 @@

public function activity_log_page_func() {
$this->get_list_table()->prepare_items();
$page_slug = isset( $_REQUEST['page'] ) ? sanitize_key( wp_unslash( $_REQUEST['page'] ) ) : 'activity-log-page';

Check warning on line 24 in classes/class-aal-admin-ui.php

View workflow job for this annotation

GitHub Actions / Lint PHP files 

Processing form data without nonce verification.

Check warning on line 24 in classes/class-aal-admin-ui.php

View workflow job for this annotation

GitHub Actions / Lint PHP files 

Processing form data without nonce verification.
?>
<div class="wrap">
<h1 class="aal-page-title"><?php _ex( 'Activity Log', 'Page and Menu Title', 'aryo-activity-log' ); ?></h1>
<h1 class="aal-page-title"><?php echo esc_html_x( 'Activity Log', 'Page and Menu Title', 'aryo-activity-log' ); ?></h1>

<form id="activity-filter" method="get">
<input type="hidden" name="page" value="<?php echo esc_attr( $_REQUEST['page'] ); ?>" />
<input type="hidden" name="page" value="<?php echo esc_attr( $page_slug ); ?>" />
<?php $this->get_list_table()->display(); ?>
</form>
</div>
Expand Down Expand Up @@ -92,7 +93,7 @@
}

public function ajax_aal_promotion_dismiss() {
if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'aal_promotion' ) ) {

Check warning on line 96 in classes/class-aal-admin-ui.php

View workflow job for this annotation

GitHub Actions / Lint PHP files 

Detected usage of a non-sanitized input variable: $_POST['nonce']

Check warning on line 96 in classes/class-aal-admin-ui.php

View workflow job for this annotation

GitHub Actions / Lint PHP files 

$_POST['nonce'] not unslashed before sanitization. Use wp_unslash() or similar
wp_send_json_error();
}

Expand All @@ -108,7 +109,7 @@
}

public function ajax_aal_promotion_campaign() {
if ( empty( $_POST['nonce'] ) || ! wp_verify_nonce( $_POST['nonce'], 'aal_promotion' ) ) {

Check warning on line 112 in classes/class-aal-admin-ui.php

View workflow job for this annotation

GitHub Actions / Lint PHP files 

Detected usage of a non-sanitized input variable: $_POST['nonce']

Check warning on line 112 in classes/class-aal-admin-ui.php

View workflow job for this annotation

GitHub Actions / Lint PHP files 

$_POST['nonce'] not unslashed before sanitization. Use wp_unslash() or similar
wp_send_json_error();
}

Expand Down
2 changes: 1 addition & 1 deletion classes/class-aal-api.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ protected function _get_ip_address() {

$visitor_ip_address = '';
if ( ! empty( $_SERVER[ $header_key ] ) ) {
$visitor_ip_address = $_SERVER[ $header_key ];
$visitor_ip_address = sanitize_text_field( wp_unslash( $_SERVER[ $header_key ] ) );
}

$remote_address = apply_filters( 'aal_get_ip_address', $visitor_ip_address );
Expand Down
Loading
Loading