Repository navigation
0.1.2: fix WordPress.org review issues - #5
Merged
Merged
Conversation
…en the auth endpoint - Remove load_plugin_textdomain(): WordPress loads translations for the hibira slug itself since 4.6, and the plugin requires 6.0. - Stop shipping .po/.mo files; translate.wordpress.org provides them. The .po files move to translations/ (export-ignored) for importing there. - REST /hibira/v1/auth: decide the channel in permission_callback, validate socket_id and channel_name, sanitize order_key and visitor. - Sanitize the secret and host settings, the order key from $_GET and live comment HTML (wp_kses_post). - Add phpcs.xml.dist (WordPress-Extra, PHPCompatibilityWP) and a CI job. - readme: source of the bundled pusher-js build. Version 0.1.2. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SHtsCDXecYDWvMV2LaCkYm
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Danny · project thread
Fixes the first-round WordPress.org Plugins Team review (slug
hibira), plus issues the deeper second round usually raises.Review items
languages/hibira.potstays; the .po files move totranslations/(export-ignored) so they can be imported into translate.wordpress.org after approval.tools/compile-mo.pyremoved.Ahead of the second round
/hibira/v1/auth: the per-channel decision now runs inpermission_callback(instead of__return_true),socket_id/channel_nameare validated,order_key/visitorsanitized.sanitize_text_field, host is reduced to a hostname (a pasted URL keeps its host).$_GET['key']usessanitize_text_field; live comment HTML passeswp_kses_postbefore it is sent.hibira_readers()moved tofunctions.php(functions and classes in separate files).dist/web/pusher.min.jsminus the source map comment, which pointed at a missing file).phpcs.xml.dist(WordPress-Extra + PHPCompatibilityWP) and aphpcsCI job.Testing
php tests/run.php: 21 passed.WP_DEBUGon, against a mock Hibira API: post page enqueue, presence/private auth (allowed, 403 for admin channel / draft post / wrong order key, 400 for bad socket ID), comment pending + approved events, post-updated event, settings save, test event (nonce checked), order status + new order events, guest order-received page, uninstall removes the option. No PHP notices from the plugin.Generated by Claude Code