Skip to content

Harden auditor-reported output and term counting #1235

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
repile merged 3 commits into from
Oct 14, 2026
Merged

Harden auditor-reported output and term counting #1235

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
675b757
fix: harden auditor output paths
codex Oct 5, 2026
4248faf
Merge remote-tracking branch 'origin/development' into pr-1235
Oct 14, 2026
f6885b7
Count terms with get_terms() so pagination works on WP 5.5
Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions core/Requirement/Prohibited_categories.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -193,12 +193,15 @@ private function get_list_categories($args = array('page' => 1, 'per_page' => 10
*/
private function get_total_count($args = array('search' => '', 'hide_empty' => 0))
{
$args_key = base64_encode($args['search']);
$args_key = hash('sha256', (string) $args['search']);
$cache_key = 'total_prohib_category_count_' . $args_key;

$total_categories = get_transient($cache_key);
if ($total_categories === false) {
$total_categories = wp_count_terms('category', $args);
// get_terms() with 'fields' => 'count' works the same from WP 5.5 to current,
// unlike the two wp_count_terms() signatures.
$total_categories = get_terms(array_merge($args, ['taxonomy' => 'category', 'fields' => 'count']));
$total_categories = is_wp_error($total_categories) ? 0 : (int) $total_categories;
set_transient($cache_key, $total_categories, $this->cache_expiration);
}

Expand Down
7 changes: 5 additions & 2 deletions core/Requirement/Prohibited_tags.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -199,12 +199,15 @@ private function get_list_tags($args = array('page' => 1, 'per_page' => 10, 'q'
*/
private function get_total_count($args = array('search' => '', 'hide_empty' => 0))
{
$args_key = base64_encode($args['search']);
$args_key = hash('sha256', (string) $args['search']);
$cache_key = 'total_prohib_tag_count_' . $args_key;

$total_tags = get_transient($cache_key);
if ($total_tags === false) {
$total_tags = wp_count_terms('post_tag', $args);
// get_terms() with 'fields' => 'count' works the same from WP 5.5 to current,
// unlike the two wp_count_terms() signatures.
$total_tags = get_terms(array_merge($args, ['taxonomy' => 'post_tag', 'fields' => 'count']));
$total_tags = is_wp_error($total_tags) ? 0 : (int) $total_tags;
set_transient($cache_key, $total_tags, $this->cache_expiration);
}

Expand Down
7 changes: 5 additions & 2 deletions core/Requirement/Required_categories.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -194,12 +194,15 @@ private function get_list_categories($args = array('page' => 1, 'per_page' => 10
*/
private function get_total_count($args = array('search' => '', 'hide_empty' => 0))
{
$args_key = base64_encode($args['search']);
$args_key = hash('sha256', (string) $args['search']);
$cache_key = 'total_require_category_count_' . $args_key;

$total_categories = get_transient($cache_key);
if ($total_categories === false) {
$total_categories = wp_count_terms('category', $args);
// get_terms() with 'fields' => 'count' works the same from WP 5.5 to current,
// unlike the two wp_count_terms() signatures.
$total_categories = get_terms(array_merge($args, ['taxonomy' => 'category', 'fields' => 'count']));
$total_categories = is_wp_error($total_categories) ? 0 : (int) $total_categories;
set_transient($cache_key, $total_categories, $this->cache_expiration);
}

Expand Down
7 changes: 5 additions & 2 deletions core/Requirement/Required_tags.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -199,12 +199,15 @@ private function get_list_tags($args = array('page' => 1, 'per_page' => 10, 'q'
*/
private function get_total_count($args = array('search' => '', 'hide_empty' => 0))
{
$args_key = base64_encode($args['search']);
$args_key = hash('sha256', (string) $args['search']);
$cache_key = 'total_required_tag_count_' . $args_key;

$total_tags = get_transient($cache_key);
if ($total_tags === false) {
$total_tags = wp_count_terms('post_tag', $args);
// get_terms() with 'fields' => 'count' works the same from WP 5.5 to current,
// unlike the two wp_count_terms() signatures.
$total_tags = get_terms(array_merge($args, ['taxonomy' => 'post_tag', 'fields' => 'count']));
$total_tags = is_wp_error($total_tags) ? 0 : (int) $total_tags;
set_transient($cache_key, $total_tags, $this->cache_expiration);
}

Expand Down
2 changes: 1 addition & 1 deletion modules/checklists/checklists.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1662,7 +1662,7 @@ public function redirect_on_activate()
{
if (get_option('ppch_activated')) {
delete_option('ppch_activated');
wp_redirect(admin_url("admin.php?page=ppch-checklists"));
wp_safe_redirect(admin_url("admin.php?page=ppch-checklists"));
exit;
}
}
Expand Down
39 changes: 32 additions & 7 deletions modules/checklists/templates/global-checklists.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,31 @@
<div class="pressshack-admin-wrapper pp-checklists-tabs-wrapper">
<div class="pp-checklists-tabs">
<?php
$allowed_svg_tags = [
'svg' => [
'aria-hidden' => true,
'class' => true,
'focusable' => true,
'height' => true,
'role' => true,
'version' => true,
'viewbox' => true,
'width' => true,
'xmlns' => true,
],
'g' => [
'clip-rule' => true,
'fill' => true,
'fill-rule' => true,
],
'path' => [
'clip-rule' => true,
'd' => true,
'fill' => true,
'fill-rule' => true,
],
];

/**
* Render field tabs
*/
Expand Down Expand Up @@ -59,7 +84,7 @@
data-post-type="<?php echo esc_attr($post_type_key); ?>"
href="#">
<span class="<?php echo esc_attr($args['icon']); ?>">
<?php if (isset($args['svg']) && !empty($args['svg'])) : echo $args['svg']; endif; ?>
<?php if (isset($args['svg']) && !empty($args['svg'])) : echo wp_kses($args['svg'], $allowed_svg_tags); endif; ?>
</span>
<span class="item"><?php echo esc_html($args['label']); ?></span>
<?php if ($enabled_count > 0) : ?>
Expand Down Expand Up @@ -98,10 +123,10 @@
<tbody id="<?php echo 'pp-checklists-tab-body-' . esc_attr($post_type_key); ?>" class="pp-checklists-tab-body <?php echo $i === 0 ? 'active' : ''; ?>" style="display: none;">
<?php
foreach ($context['tabs'][$post_type_key] as $group => $tabInfo) :
foreach ($context['requirements'] as $post_type => $post_type_requirements) : ?>
foreach ($context['requirements'] as $requirements_post_type => $post_type_requirements) : ?>
<?php
// Skip if the post type is not the current one
if ($post_type !== $post_type_key) continue;
if ($requirements_post_type !== $post_type_key) continue;
$group_has_requirements = false;
foreach ($post_type_requirements as $requirement) :
if ($requirement->group === $group) :
Expand All @@ -117,7 +142,7 @@
class="pp-checklists-requirement-row ppch-<?php echo esc_attr($requirement->group); ?>-group <?php echo $is_locked ? ' ppc-pro-locked-row' : ''; ?>"
style="display: none;"
data-id="<?php echo esc_attr($requirement->name); ?>"
data-post-type="<?php echo esc_attr($post_type); ?>">
data-post-type="<?php echo esc_attr($requirements_post_type); ?>">

<td>
<?php
Expand All @@ -137,7 +162,7 @@ class="pp-checklists-requirement-row ppch-<?php echo esc_attr($requirement->grou
*
* @return string
*/
do_action('publishpress_checklists_tasks_list_td', $requirement, $post_type);
do_action('publishpress_checklists_tasks_list_td', $requirement, $requirements_post_type);
?>
<td class="pp-checklists-task-params">
<?php
Expand All @@ -159,8 +184,8 @@ class="pp-checklists-requirement-row ppch-<?php echo esc_attr($requirement->grou
endif;
endforeach;
?>
<?php if ($post_type === $post_type_key && !$group_has_requirements) : ?>
<tr class="pp-checklists-requirement-row ppch-<?php echo esc_attr($group); ?>-group" data-post-type="<?php echo esc_attr($post_type); ?>">
<?php if ($requirements_post_type === $post_type_key && !$group_has_requirements) : ?>
<tr class="pp-checklists-requirement-row ppch-<?php echo esc_attr($group); ?>-group" data-post-type="<?php echo esc_attr($requirements_post_type); ?>">
<td colspan="4" id="empty-custom-rule">
<?php echo esc_html(sprintf(__('No %s requirements for this post type.', 'publishpress-checklists'), $group)); ?>
</td>
Expand Down
2 changes: 1 addition & 1 deletion modules/settings/settings.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1585,7 +1585,7 @@ public function settings_checklist_items_sort_order_option($args = [])
$hidden = $value === $sortValue ? '' : ' hidden';
echo '<p class="description ppch-sort-order-description"'
. ' data-sort-order="' . esc_attr($sortValue) . '"'
. $hidden . '>';
. esc_attr($hidden) . '>';
echo esc_html($sortDescription);
echo '</p>';
}
Expand Down