Skip to content

Commit 96f290d

Browse files
akirkakirk
authored
Merge pull request #160 from mattwiebe/update/wpcom-lint
Linted for wpcom
2 parents e398a74 + 9853d8f commit 96f290d

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

54 files changed

+289
-255
lines changed

‎bin/extract-hooks.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ function sample_ini() {
102102
$comment = '';
103103
$hook = false;
104104

105-
for ( $j = $i; $j > max( 0, $i - 10 ); $j-- ) {
105+
for ( $j = $i, $l = max( 0, $i - 10 ); $j > $l; $j-- ) {
106106
if ( ! is_array( $tokens[ $j ] ) ) {
107107
continue;
108108
}
@@ -421,7 +421,7 @@ function parse_docblock( $raw_comment, $params ) {
421421
}
422422

423423

424-
$count += 1;
424+
++$count;
425425
$p = preg_split( '/ +/', $param, 3 );
426426
if ( '\\' === substr( $p[0], 0, 1 ) ) {
427427
$p[0] = substr( $p[0], 1 );

‎enable-mastodon-apps.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ function ( $full_class ) {
3434

3535
if ( strncmp( $full_class, $base, strlen( $base ) ) === 0 ) {
3636
$maybe_uppercase = str_replace( $base, '', $full_class );
37-
$class = strtolower( $maybe_uppercase );
37+
$class = strtolower( $maybe_uppercase );
3838
// All classes should be capitalized. If this is instead looking for a lowercase method, we ignore that.
3939
if ( $maybe_uppercase === $class ) {
4040
return;

‎includes/class-comment-cpt.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
* This class maps comments to a custom post type.
2424
*/
2525
class Comment_CPT {
26-
const CPT = 'comment';
26+
const CPT = 'comment';
2727
const META_KEY = 'comment_id';
2828

2929
/**
@@ -90,7 +90,7 @@ public static function create_comment_post( $comment_id, $comment ) {
9090
return;
9191
}
9292
$parent_post_id = $comment->comment_post_ID;
93-
$post = get_post( $parent_post_id );
93+
$post = get_post( $parent_post_id );
9494
if ( ! $post ) {
9595
return;
9696
}

‎includes/class-mastodon-admin.php‎

Lines changed: 45 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -51,13 +51,13 @@ public function process_admin() {
5151
return;
5252
}
5353

54-
if ( ! wp_verify_nonce( $_POST['_wpnonce'], 'enable-mastodon-apps' ) ) {
54+
if ( ! isset( $_POST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_key( $_POST['_wpnonce'] ), 'enable-mastodon-apps' ) ) {
5555
return;
5656
}
5757

58-
$tab = $_GET['tab'] ?? 'welcome';
58+
$tab = isset( $_GET['tab'] ) ? sanitize_key( $_GET['tab'] ) : 'welcome';
5959
if ( isset( $_POST['app'] ) ) {
60-
$app = Mastodon_App::get_by_client_id( $_POST['app'] );
60+
$app = Mastodon_App::get_by_client_id( sanitize_text_field( wp_unslash( $_POST['app'] ) ) );
6161
if ( $app ) {
6262
return $this->process_admin_app_page( $app );
6363
}
@@ -78,14 +78,16 @@ public function process_admin() {
7878

7979
public function admin_page() {
8080
$this->enable_debug = get_option( 'mastodon_api_enable_debug' );
81-
$tab = $_GET['tab'] ?? 'welcome';
81+
// phpcs:disable WordPress.Security.NonceVerification.Recommended
82+
$tab = isset( $_GET['tab'] ) ? sanitize_text_field( wp_unslash( $_GET['tab'] ) ) : 'welcome';
8283
if ( isset( $_GET['app'] ) ) {
83-
$app = Mastodon_App::get_by_client_id( $_GET['app'] );
84+
$app = Mastodon_App::get_by_client_id( sanitize_text_field( wp_unslash( $_GET['app'] ) ) );
8485
if ( $app ) {
8586
return $this->admin_app_page( $app );
8687
}
8788
$tab = 'registered-apps';
8889
}
90+
// phpcs:enable
8991
switch ( $tab ) {
9092
case 'welcome':
9193
$this->admin_welcome_page();
@@ -117,13 +119,13 @@ public function admin_welcome_page() {
117119
}
118120

119121
public function process_admin_settings_page() {
120-
if ( isset( $_POST['mastodon_api_enable_logins'] ) ) {
122+
if ( isset( $_POST['mastodon_api_enable_logins'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
121123
delete_option( 'mastodon_api_disable_logins' );
122124
} else {
123125
update_option( 'mastodon_api_disable_logins', true );
124126
}
125127

126-
if ( isset( $_POST['mastodon_api_enable_debug'] ) ) {
128+
if ( isset( $_POST['mastodon_api_enable_debug'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
127129
update_option( 'mastodon_api_enable_debug', true );
128130
} else {
129131
delete_option( 'mastodon_api_enable_debug' );
@@ -141,12 +143,12 @@ public function admin_settings_page() {
141143
}
142144

143145
public function process_admin_debug_page() {
144-
if ( isset( $_POST['mastodon_api_debug_mode'] ) ) {
146+
if ( isset( $_POST['mastodon_api_debug_mode'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
145147
update_option( 'mastodon_api_debug_mode', time() + 5 * MINUTE_IN_SECONDS );
146148
} else {
147149
delete_option( 'mastodon_api_debug_mode' );
148150
}
149-
if ( isset( $_POST['mastodon_api_auto_app_reregister'] ) ) {
151+
if ( isset( $_POST['mastodon_api_auto_app_reregister'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
150152
update_option( 'mastodon_api_auto_app_reregister', true );
151153
} else {
152154
delete_option( 'mastodon_api_auto_app_reregister' );
@@ -162,8 +164,10 @@ public function admin_tester_page() {
162164
}
163165

164166
public function process_admin_registered_apps_page() {
167+
// phpcs:ignore WordPress.Security.NonceVerification.Missing
165168
if ( isset( $_POST['delete-code'] ) ) {
166-
$deleted = $this->oauth->get_code_storage()->expireAuthorizationCode( $_POST['delete-code'] );
169+
// phpcs:ignore WordPress.Security.NonceVerification.Missing
170+
$deleted = $this->oauth->get_code_storage()->expireAuthorizationCode( sanitize_text_field( wp_unslash( $_POST['delete-code'] ) ) );
167171
add_settings_error(
168172
'enable-mastodon-apps',
169173
'deleted-codes',
@@ -177,8 +181,10 @@ public function process_admin_registered_apps_page() {
177181
return;
178182
}
179183

184+
// phpcs:ignore WordPress.Security.NonceVerification.Missing
180185
if ( isset( $_POST['delete-token'] ) ) {
181-
$deleted = $this->oauth->get_token_storage()->unsetAccessToken( $_POST['delete-token'] );
186+
// phpcs:ignore WordPress.Security.NonceVerification.Missing
187+
$deleted = $this->oauth->get_token_storage()->unsetAccessToken( sanitize_text_field( wp_unslash( $_POST['delete-token'] ) ) );
182188
add_settings_error(
183189
'enable-mastodon-apps',
184190
'deleted-tokens',
@@ -192,8 +198,10 @@ public function process_admin_registered_apps_page() {
192198
return;
193199
}
194200

201+
// phpcs:ignore WordPress.Security.NonceVerification.Missing
195202
if ( isset( $_POST['delete-app'] ) ) {
196-
$deleted = Mastodon_App::get_by_client_id( $_POST['delete-app'] )->delete();
203+
// phpcs:ignore WordPress.Security.NonceVerification.Missing
204+
$deleted = Mastodon_App::get_by_client_id( sanitize_text_field( wp_unslash( $_POST['delete-app'] ) ) )->delete();
197205
add_settings_error(
198206
'enable-mastodon-apps',
199207
'deleted-apps',
@@ -207,8 +215,10 @@ public function process_admin_registered_apps_page() {
207215
return;
208216
}
209217

218+
// phpcs:ignore WordPress.Security.NonceVerification.Missing
210219
if ( isset( $_POST['clear-app-logs'] ) ) {
211-
$deleted = Mastodon_App::get_by_client_id( $_POST['clear-app-logs'] )->delete_last_requests();
220+
// phpcs:ignore WordPress.Security.NonceVerification.Missing
221+
$deleted = Mastodon_App::get_by_client_id( sanitize_text_field( wp_unslash( $_POST['clear-app-logs'] ) ) )->delete_last_requests();
212222
if ( $deleted ) {
213223
add_settings_error(
214224
'enable-mastodon-apps',
@@ -226,12 +236,13 @@ public function process_admin_registered_apps_page() {
226236
}
227237
return;
228238
}
239+
// phpcs:ignore WordPress.Security.NonceVerification.Missing
229240
if ( isset( $_POST['clear-all-app-logs'] ) ) {
230241
$total_deleted = 0;
231242
foreach ( Mastodon_App::get_all() as $app ) {
232243
$deleted = $app->delete_last_requests();
233244
if ( $deleted ) {
234-
$total_deleted += 1;
245+
++$total_deleted;
235246
}
236247
}
237248
if ( $total_deleted ) {
@@ -256,15 +267,16 @@ public function process_admin_registered_apps_page() {
256267
return;
257268
}
258269

270+
// phpcs:ignore WordPress.Security.NonceVerification.Missing
259271
if ( isset( $_POST['delete-outdated'] ) ) {
260-
$apps = Mastodon_App::get_all();
272+
$apps = Mastodon_App::get_all();
261273
$deleted = OAuth2\Access_Token_Storage::cleanupOldTokens();
262274
if ( ! $deleted ) {
263275
$deleted = 0;
264276
}
265277
foreach ( OAuth2\Access_Token_Storage::getAll() as $token => $data ) {
266278
if ( ! isset( $apps[ $data['client_id'] ] ) ) {
267-
$deleted += 1;
279+
++$deleted;
268280
$this->oauth->get_token_storage()->unsetAccessToken( $token );
269281
}
270282
}
@@ -287,7 +299,7 @@ public function process_admin_registered_apps_page() {
287299
}
288300
foreach ( OAuth2\Authorization_Code_Storage::getAll() as $code => $data ) {
289301
if ( ! isset( $apps[ $data['client_id'] ] ) ) {
290-
$deleted += 1;
302+
++$deleted;
291303
$this->oauth->get_code_storage()->expireAuthorizationCode( $code );
292304
}
293305
}
@@ -321,11 +333,12 @@ public function process_admin_registered_apps_page() {
321333
return;
322334
}
323335

336+
// phpcs:ignore WordPress.Security.NonceVerification.Missing
324337
if ( isset( $_POST['delete-never-used'] ) ) {
325338
$deleted = 0;
326339
foreach ( Mastodon_App::get_all() as $app ) {
327340
if ( ! $app->get_last_used() ) {
328-
$deleted += 1;
341+
++$deleted;
329342
$app->delete();
330343
}
331344
}
@@ -345,7 +358,7 @@ public function process_admin_registered_apps_page() {
345358
foreach ( OAuth2\Access_Token_Storage::getAll() as $token => $data ) {
346359
if ( empty( $data['last_used'] ) ) {
347360
if ( $this->oauth->get_token_storage()->unsetAccessToken( $token ) ) {
348-
$deleted += 1;
361+
++$deleted;
349362
}
350363
}
351364
}
@@ -363,6 +376,7 @@ public function process_admin_registered_apps_page() {
363376
return;
364377
}
365378

379+
// phpcs:ignore WordPress.Security.NonceVerification.Missing
366380
if ( isset( $_POST['delete-apps-without-tokens'] ) ) {
367381
$app_tokens = array();
368382
foreach ( OAuth2\Access_Token_Storage::getAll() as $token => $data ) {
@@ -374,7 +388,7 @@ public function process_admin_registered_apps_page() {
374388
$deleted = 0;
375389
foreach ( Mastodon_App::get_all() as $app ) {
376390
if ( empty( $app_tokens[ $app->get_client_id() ] ) ) {
377-
$deleted += 1;
391+
++$deleted;
378392
$app->delete();
379393
}
380394
}
@@ -391,8 +405,10 @@ public function process_admin_registered_apps_page() {
391405
);
392406
return;
393407
}
408+
// phpcs:disable WordPress.Security.NonceVerification.Missing
394409
if ( isset( $_POST['app_post_formats'] ) && is_array( $_POST['app_post_formats'] ) ) {
395-
foreach ( $_POST['app_post_formats'] as $client_id => $post_formats ) {
410+
// phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
411+
foreach ( wp_unslash( $_POST['app_post_formats'] ) as $client_id => $post_formats ) {
396412
$post_formats = array_filter(
397413
$post_formats,
398414
function ( $post_format ) {
@@ -464,7 +480,7 @@ function ( $a, $b ) {
464480
public function process_admin_app_page( Mastodon_App $app ) {
465481

466482
if ( isset( $_POST['delete-app'] ) && $_POST['delete-app'] === $app->get_client_id() ) {
467-
$name = $app->get_client_name();
483+
$name = $app->get_client_name();
468484
$deleted = $app->delete();
469485
if ( $deleted ) {
470486
$message = sprintf(
@@ -487,7 +503,7 @@ public function process_admin_app_page( Mastodon_App $app ) {
487503
}
488504

489505
if ( isset( $_POST['delete-token'] ) ) {
490-
$deleted = $this->oauth->get_token_storage()->unsetAccessToken( $_POST['delete-token'] );
506+
$deleted = $this->oauth->get_token_storage()->unsetAccessToken( sanitize_text_field( wp_unslash( $_POST['delete-token'] ) ) );
491507
add_settings_error(
492508
'enable-mastodon-apps',
493509
'deleted-tokens',
@@ -524,7 +540,7 @@ public function process_admin_app_page( Mastodon_App $app ) {
524540
$post_formats = array();
525541
if ( isset( $_POST['post_formats'] ) && is_array( $_POST['post_formats'] ) ) {
526542
$post_formats = array_filter(
527-
$_POST['post_formats'],
543+
wp_unslash( $_POST['post_formats'] ),
528544
function ( $post_format ) {
529545
if ( ! in_array( $post_format, get_post_format_slugs(), true ) ) {
530546
return false;
@@ -545,15 +561,16 @@ function ( $post_type ) {
545561
)
546562
);
547563

548-
if ( isset( $_POST['create_post_type'] ) && $_POST['create_post_type'] ) {
549-
if ( isset( $post_types[ $_POST['create_post_type'] ] ) ) {
550-
$app->set_create_post_type( $_POST['create_post_type'] );
564+
if ( isset( $_POST['create_post_type'] ) ) {
565+
$create_post_type = sanitize_text_field( wp_unslash( $_POST['create_post_type'] ) );
566+
if ( isset( $post_types[ $create_post_type ] ) ) {
567+
$app->set_create_post_type( $create_post_type );
551568
}
552569
}
553570

554571
if ( isset( $_POST['view_post_types'] ) && is_array( $_POST['view_post_types'] ) ) {
555572
$view_post_types = array();
556-
foreach ( $_POST['view_post_types'] as $post_type ) {
573+
foreach ( wp_unslash( $_POST['view_post_types'] ) as $post_type ) {
557574
if ( isset( $post_types[ $post_type ] ) ) {
558575
$view_post_types[ $post_type ] = true;
559576
}

0 commit comments

Comments
 (0)