Clean auditor-reported standards findings by stevejburge · Pull Request #1236 · publishpress/publishpress-checklists

stevejburge · 2026-10-05T16:44:34Z

Summary

add explicit GPL-2.0-or-later plugin metadata and full LICENSE
remove obsolete load_plugin_textdomain() call for WordPress 5.5+
replace print_r() error serialization with wp_json_encode()
split assignment from condition in block-editor detection

Auditor coverage

Addresses Medium Plugin Header, GPL License File, Discouraged Function, and Assignment in Condition findings plus the print_r() High/Medium debug findings from publishpress-checklists-free-2.29.0-plugin-auditor-report.pdf.

error_log() remains intentional: ErrorHandler is the plugin's runtime error-reporting path, not debug code left in a request handler.

chatgpt-codex-connector · 2026-10-05T16:44:45Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T16:48:49.912955Z	`601e2ae`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 601e2ae08e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-05T16:48:47Z

        // Initialize the API
        \PublishPress\Checklists\Core\API\Bootstrap::init();


Restore registration of the bundled translation path

On localized sites that rely on this plugin's shipped translations rather than an installed WordPress.org language pack, removing load_plugin_textdomain() leaves the custom /languages/ path unregistered, so the 40 bundled .mo/.l10n.php catalogs are never discovered and the admin UI falls back to English. The Domain Path header alone does not register that runtime path; retain a call that points the publishpress-checklists domain at the bundled directory.

Useful? React with 👍 / 👎.

repile · 2026-10-14T15:41:10Z

Review sweep before 2.30.0: verdict Not yet

Setup: fresh SandyWP sandboxes, not cloned from any customer site: WP 7.1.3 / PHP 8.3, and a WP 6.7 / PHP 8.3 site for the translation check. I installed development @ 358d914 first, then this PR @ 601e2ae. The PR merges cleanly into current development, and all four sweep PRs apply together without conflicts.

Check	`development`	This PR
`ErrorHandler::add('rv test', ['a'=>1,'b'=>['c'=>'d']])`	multi-line `print_r` block in debug.log	`rv test: {"a":1,"b":{"c":"d"}}` ✅
`LICENSE`	–	identical to the official GPL-2.0 text ✅
Plugin header License / License URI	–	present ✅
`isBlockEditorActive` refactor	–	no behaviour change ✅
Full admin/AJAX/save regression run (WP 7.1.3)	–	no new PHP warnings ✅

Why "Not yet": the Codex P1 is real for WP 5.5–6.7

Removing load_plugin_textdomain() relies on core registering the plugin's Domain Path header for just-in-time loading. That was only added in WP 6.8 (wp-settings.php), and the plugin still declares Requires at least: 5.5 and ships 40+ bundled catalogs in /languages.

Browser test on WP 6.7, site language German, no wp.org language pack for the plugin installed:

`development` on WP 6.7	This PR on WP 6.7
Plugin UI in German ("Checklisten", "Anzahl Zeichen in der Überschrift") ✅	Plugin UI falls back to English while core stays German ❌

On WP 7.1.3 the German UI still works with this PR, because core loads the Domain Path there.

Fix: keep the call on older cores, e.g. if (version_compare(get_bloginfo('version'), '6.8', '<')) { load_plugin_textdomain(...); }. Or raise Requires at least to 6.8 as a deliberate decision.

(Note: Yoast SEO was installed on the WP 6.7 test site. Without it, development/2.29.0 already fatals in wp-admin on WP ≤ 6.7, because modules/yoastseo/yoastseo.php:120 calls is_plugin_active() during init, before wp-admin/includes/plugin.php is loaded. Core only started loading that file early in 6.8. That bug is not caused by this PR and is being reported separately.)

Verdict: Not yet, because of the bundled-translation regression on WP < 6.8. Everything else checks out.

WordPress only loads translations from the Domain Path header just in time since 6.8, so keep load_plugin_textdomain() for older versions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

repile · 2026-10-14T17:46:27Z

Follow-up: bundled translations restored on WP < 6.8, verdict Safe to merge

What I changed

6b7accf merges current development into this branch (no conflicts).
2587423 restores Plugin::loadTextDomain() and calls it from init() at the same point as before. It now returns early on WP 6.8+, where core registers the Domain Path header itself (wp-settings.php:537, set_custom_path()) and loads the catalog just in time. On 5.5–6.7 it calls load_plugin_textdomain() as before. The call has a targeted phpcs:ignore PluginCheck.CodeAnalysis.DiscouragedFunctions.load_plugin_textdomainFound with the reason, and the docblock explains why the call is there. (I didn't run Plugin Check itself.)

How I tested

I used a fresh SandyWP sandbox (PHP 8.3, debug preset), not cloned from any customer site. The site language is German, and no wp.org language pack for the plugin is installed, so only the bundled /languages catalog can translate the UI. On WP 6.7, a test-only mu-plugin loads wp-admin/includes/plugin.php early to work around the unrelated #1238 fatal, which #1239 fixes.

WP 6.7, PR before (`601e2ae`)	WP 6.7, this fix	WP 6.8 (same site upgraded), this fix, call skipped
screenshot: core in German, plugin UI in English ❌	screenshot: "Checklisten", "Anzahl Zeichen in der Überschrift" ✅	screenshot: same bundled strings, loaded just in time by core ✅

(The links need a Repile login.)

On 6.8 the core update had also pulled the wp.org pack (wording "Anzahl der Zeichen im Titel"). I deleted it before the last screenshot, so that screenshot shows the bundled catalog. This confirms 6.8 is the right cutoff.
WP 7.1.3 was already confirmed working in the earlier review, and the new code path is the same early return as on 6.8.
php -l core/Plugin.php passes, and debug.log has no plugin entries on 6.7 or 6.8.

Verdict: ✅ Safe to merge. Bundled translations work again from 5.5 to 6.7, and nothing changes on 6.8+.

fix: clean auditor standards findings

601e2ae

chatgpt-codex-connector Bot reviewed Oct 5, 2026

View reviewed changes

stevejburge added this to the 2.30 milestone Oct 5, 2026

This was referenced Oct 14, 2026

Harden auditor-reported input handling #1233

Merged

Harden uninstall transient cleanup queries #1234

Merged

root and others added 2 commits October 14, 2026 19:43

Merge remote-tracking branch 'origin/development' into pr-1236

6b7accf

Load bundled translations on WordPress before 6.8

2587423

WordPress only loads translations from the Domain Path header just in time since 6.8, so keep load_plugin_textdomain() for older versions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

repile Bot merged commit b4d3129 into development Oct 14, 2026

repile Bot mentioned this pull request Oct 20, 2026

Release v2.30.0 #1246

Merged

rizaardiyanto1412 deleted the codex/auditor-standards-cleanup branch October 26, 2026 18:42

Navigation Menu

Repository navigation

Clean auditor-reported standards findings - #1236

Clean auditor-reported standards findings#1236
repile[bot] merged 3 commits into
developmentfrom
codex/auditor-standards-cleanup

stevejburge commented Oct 5, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 5, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 5, 2026

Uh oh!

repile Bot commented Oct 14, 2026 •

edited

Loading

Uh oh!

repile Bot commented Oct 14, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		// Initialize the API
		\PublishPress\Checklists\Core\API\Bootstrap::init();

Conversation

stevejburge commented Oct 5, 2026

Summary

Auditor coverage

Uh oh!

chatgpt-codex-connector Bot commented Oct 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 5, 2026

Choose a reason for hiding this comment

Uh oh!

repile Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review sweep before 2.30.0: verdict Not yet

Why "Not yet": the Codex P1 is real for WP 5.5–6.7

Uh oh!

repile Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Follow-up: bundled translations restored on WP < 6.8, verdict Safe to merge

What I changed

How I tested

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chatgpt-codex-connector Bot commented Oct 5, 2026 •

edited

Loading

repile Bot commented Oct 14, 2026 •

edited

Loading

repile Bot commented Oct 14, 2026 •

edited

Loading