fix: resolve WordPress Plugin Check security and readme warnings#2909
Merged
Conversation
Resolves Plugin Check mismatched_plugin_name and license identifier warnings. Co-authored-by: Cursor <cursoragent@cursor.com>
Avoids Plugin Check wrong-version errors while keeping function_exists guards. Co-authored-by: Cursor <cursoragent@cursor.com>
Adds wp_unslash() for $_GET, $_POST, $_COOKIE, and $_SERVER inputs flagged by Plugin Check. Co-authored-by: Cursor <cursoragent@cursor.com>
Replaces _e() with esc_html_e() in WooCommerce Builder metabox templates. Co-authored-by: Cursor <cursoragent@cursor.com>
Resolves Plugin Check short URL warning for get_docs_url(). Co-authored-by: Cursor <cursoragent@cursor.com>
pirate-bot
added
the
pr-checklist-incomplete
Contributor
Bundle Size Diff
|
Contributor
|
Plugin build for 197f559 is ready 🛎️!
|
Contributor
E2E TestsPlaywright Test Status: See serial and parallel matrix jobs Performance ResultsserverResponse: {"q25":461.3,"q50":484.8,"q75":498.8,"cnt":10}, firstPaint: {"q25":1390.2,"q50":1562.85,"q75":1960.2,"cnt":10}, domContentLoaded: {"q25":3866.1,"q50":3883.45,"q75":3913.8,"cnt":10}, loaded: {"q25":3868.1,"q50":3885.05,"q75":3915.6,"cnt":10}, firstContentfulPaint: {"q25":4392.3,"q50":4405.6,"q75":4438.3,"cnt":10}, firstBlock: {"q25":14946.8,"q50":14989.3,"q75":15061.1,"cnt":10}, type: {"q25":26,"q50":27.86,"q75":31.66,"cnt":10}, typeWithoutInspector: {"q25":22.7,"q50":26.04,"q75":28.96,"cnt":10}, typeWithTopToolbar: {"q25":33.79,"q50":35.43,"q75":38.16,"cnt":10}, typeContainer: {"q25":17.79,"q50":19.08,"q75":20.12,"cnt":10}, focus: {"q25":133.52,"q50":141.36,"q75":149.92,"cnt":10}, inserterOpen: {"q25":46.9,"q50":47.95,"q75":49.5,"cnt":10}, inserterSearch: {"q25":16.72,"q50":17.92,"q75":19.02,"cnt":10}, inserterHover: {"q25":5.26,"q50":5.64,"q75":6.06,"cnt":20}, loadPatterns: {"q25":1879.86,"q50":1888.33,"q75":1944.02,"cnt":10}, listViewOpen: {"q25":245.58,"q50":256.22,"q75":259.66,"cnt":10} |
This reverts commit 0c9c973.
Soare-Robert-Daniel
added
the
pr-checklist-skip
pirate-bot
added
pr-checklist-complete
abaicus
approved these changes
Jul 2, 2026
|
|
||
| if ( isset( $_COOKIE[ $condition['cookie_key'] ] ) ) { // phpcs:ignore WordPressVIPMinimum.Variables.RestrictedVariables.cache_constraints___COOKIE | ||
| $cookie = esc_attr( $_COOKIE[ $condition['cookie_key'] ] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPressVIPMinimum.Variables.RestrictedVariables.cache_constraints___COOKIE | ||
| $cookie = esc_attr( sanitize_text_field( wp_unslash( $_COOKIE[ $condition['cookie_key'] ] ) ) ); // phpcs:ignore WordPressVIPMinimum.Variables.RestrictedVariables.cache_constraints___COOKIE |
Contributor
There was a problem hiding this comment.
I don't think esc_attr is needed here. Escaping is usually done for echoing output.
| @@ -1,12 +1,12 @@ | |||
| === Otter Blocks - Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE === | |||
| === Otter – Page Builder Blocks & Extensions for Gutenberg === | |||
Contributor
There was a problem hiding this comment.
I think we should check with marketing cc: @harshitarora-in before changing this. It can possibly break ranking and search results. As the plugin check is not running on update, I think we can ignore it for now if we don't want to change/sync them both in the admin dashboard and on wp.org.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
readme.txtlicense and plugin name with the plugin header for WordPress.org Plugin Checkwp_unslash()before sanitizing$_GET,$_POST,$_COOKIE, and$_SERVERinputs_e()output withesc_html_e()in WooCommerce Builder metabox templatescall_user_func()to satisfy minimum-version static analysis while keepingfunction_exists()guardsTest plan
plugin_repo/securityfindings on this branchMade with Cursor