From 2a78e63357eaf182608abec5687a9748fd226dd1 Mon Sep 17 00:00:00 2001 From: Faisal Ahammad Date: Wed, 15 Jul 2026 17:21:02 +0600 Subject: [PATCH] Fix Plugin Check issues: scope PHPCS, escape shortcode output, drop WP < 5.5 fallback phpcs.ruleset.xml: exclude vendored libraries, test coverage, and build/dev artifacts from linting. Vendored barn2-lib, setup-wizard, and wptrt/admin-notices ship with their own text domains and PHPCS settings; scanning them produced ~140 false-positive TextDomainMismatch and OutputNotEscaped flags. Keep tests/ linted so test bugs still surface. src/Admin/Settings.php: remove the function_exists('add_allowed_options') fallback in both filter_allowed_options() and allowed_options(). The plugin requires WP 6.1+ and add_allowed_options has existed since WP 5.5, so the whitelist_options / add_option_whitelist branches were dead code and triggered the Plugin Check deprecation warnings. src/Admin/Settings_Tab/Search.php: add the missing translators comment above the __() call that uses a %s placeholder. src/Document_Library_Shortcode.php: wrap the table header and body echoes in wp_kses_post(). The get_attributes() output is pre-escaped in Simple_Document_Library::get_attributes() and is annotated with a scoped phpcs:ignore. The get_headers() and get_table('html') outputs are cell content from get_row_content() which is filterable via document_library_table_row_data_format, so wp_kses_post is the safe escape at the echo site. .distignore: new file. Excludes tests/, .env.example, .wp-env.json, build configs, and dev artifacts from the built plugin zip. Mirrors and extends .gitattributes export-ignore. The deprecated load_plugin_textdomain( $domain, false, $path ) call in dependencies/barn2/barn2-lib/src/Plugin/I18n.php:48 is left untouched: composer scoper regenerates dependencies/ on every run, so a manual patch would be wiped. The deprecation needs an upstream fix in barn2-lib. --- .distignore | 39 ++++++++++++++++++++++++++++++ phpcs.ruleset.xml | 25 ++++++++++++++++++- src/Admin/Settings.php | 13 ++-------- src/Admin/Settings_Tab/Search.php | 1 + src/Document_Library_Shortcode.php | 6 ++--- 5 files changed, 69 insertions(+), 15 deletions(-) create mode 100644 .distignore diff --git a/.distignore b/.distignore new file mode 100644 index 0000000..96c9451 --- /dev/null +++ b/.distignore @@ -0,0 +1,39 @@ +# Files and directories excluded from the built plugin zip. +# Mirrors and extends .gitattributes export-ignore. + +# Dev tooling directories +/.wordpress-org +/.github +/bin +/vendor-bin +/vendor +/composer.lock +/.env.example +/.wp-env.json + +# Build / dev configs +/webpack.config.js +/playwright.config.js +/package.json +/package-lock.json +/yarn.lock +/composer.json +/phpstan.neon +/phpcs.ruleset.xml +/phpunit.xml +/.gitattributes +/.gitignore +/.scoper.inc.php +/.claudeignore +/CLAUDE.md + +# Tests +/tests +/tests/coverage + +# Build outputs +/document-library-lite.zip +/dist + +# This file +/.distignore diff --git a/phpcs.ruleset.xml b/phpcs.ruleset.xml index b561610..e4b5f40 100644 --- a/phpcs.ruleset.xml +++ b/phpcs.ruleset.xml @@ -1,4 +1,27 @@ - \ No newline at end of file + + + dependencies/* + vendor/* + vendor-bin/* + bin/* + + + tests/coverage/* + + + webpack.config.js + playwright.config.js + package.json + package-lock.json + yarn.lock + composer.json + composer.lock + phpstan.neon + phpunit.xml + readme.txt + changelog.txt + license.txt + diff --git a/src/Admin/Settings.php b/src/Admin/Settings.php index e010d74..b4dbc9f 100644 --- a/src/Admin/Settings.php +++ b/src/Admin/Settings.php @@ -95,14 +95,9 @@ public function register_settings() { /** * Hook into the allowed_options filter. - * Back compatibility ( < 5.5 ) included with 'whitelist_options'. */ public function filter_allowed_options() { - if ( function_exists( 'add_allowed_options' ) ) { - add_filter( 'allowed_options', [ $this, 'allowed_options' ] ); - } else { - add_filter( 'whitelist_options', [ $this, 'allowed_options' ] ); - } + add_filter( 'allowed_options', [ $this, 'allowed_options' ] ); } /** @@ -121,11 +116,7 @@ public function allowed_options( $options ) { 'document_library_pro_advanced' => [ Options::SHORTCODE_OPTION_KEY, Options::MISC_OPTION_KEY ], ]; - if ( function_exists( 'add_allowed_options' ) ) { - $options = add_allowed_options( $new_options, $options ); - } else { - $options = add_option_whitelist( $new_options, $options ); - } + $options = add_allowed_options( $new_options, $options ); return $options; } diff --git a/src/Admin/Settings_Tab/Search.php b/src/Admin/Settings_Tab/Search.php index 1d19655..a20bc4e 100644 --- a/src/Admin/Settings_Tab/Search.php +++ b/src/Admin/Settings_Tab/Search.php @@ -116,6 +116,7 @@ private function get_search_settings() { 'document_search' => __( 'Document search', 'document-library-lite' ), ], 'desc' => sprintf( + /* translators: %s: global search link. */ __( 'When using the %s, this page will display your search results.', 'document-library-lite' ), Lib_Util::barn2_link( 'kb/document-library-search/#standalone-search-box', __( 'global search', 'document-library-lite' ), true ) ), diff --git a/src/Document_Library_Shortcode.php b/src/Document_Library_Shortcode.php index 805fd10..489e17b 100644 --- a/src/Document_Library_Shortcode.php +++ b/src/Document_Library_Shortcode.php @@ -86,14 +86,14 @@ public function do_shortcode( $atts, $content = '' ) { // Create table and return output ob_start(); ?> - get_attributes() ?>> +
get_attributes(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- attribute string is pre-escaped in Simple_Document_Library::get_attributes() ?>> get_headers(); + echo wp_kses_post( $table->get_headers() ); ?> args['lazy_load'] ) { - echo $table->get_table( 'html' ); + echo wp_kses_post( $table->get_table( 'html' ) ); } ?>