CodeRabbit

Good job replacing strip_tags with wp_strip_all_tags. The latter is more secure as it removes all HTML tags including script and style. This change enhances the security of your code.

- $value   = strip_tags( $rooms->item_title( '', '', false ) );
+ $value   = wp_strip_all_tags( $rooms->item_title( '', '', false ) );

CodeRabbit

The use of @phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared is a red flag. It's generally not a good practice to ignore warnings from static analysis tools like PHP CodeSniffer, especially when it comes to database queries where SQL injection vulnerabilities can occur.

Instead of ignoring the warning, you should properly prepare the SQL statement. The $wpdb->prepare() function should be used with placeholders for all variables in the query to prevent SQL injection attacks. However, since $ids is an array and IN clause is used in the SQL, you need to generate placeholders for each item in the array.

Here's how you can do it:

- AND ID IN (%s)
+ AND ID IN (" . implode(',', array_fill(0, count($ids), '%s')) . ")

- // @phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
- return (int) $wpdb->get_var( $wpdb->prepare( $query, $ids ) );
+ return (int) $wpdb->get_var( $wpdb->prepare( $query, ...$ids ) );

This way, each id in the $ids array will have its own placeholder, and the prepare method will correctly sanitize each id.

CodeRabbit

The removal of the wp_head function, add_modal_attributes, and output_modals functions indicates a significant change in functionality. The modal feature seems to have been removed. If this is intentional and all dependencies on these functions have been addressed, then this change is fine. However, if the modal feature is still required, you might need to reintroduce these functions or provide an alternative implementation.

CodeRabbit

The removal of the global $post; statement suggests that the $post global variable is no longer used in the body_class function. This is a good practice as it reduces the reliance on global state. However, ensure that there are no side effects due to this removal, especially if other methods in the class or hooks rely on this global variable being set here.

CodeRabbit

While the use of @phpcs:ignore WordPress.Security.NonceVerification.Recommended is understandable to suppress warnings from PHP CodeSniffer, it's not a good practice to ignore nonce verification. Nonce verification is crucial for security as it helps protect against certain types of misuse, malicious or otherwise. Consider adding nonce verification here.

- // @phpcs:ignore WordPress.Security.NonceVerification.Recommended
- if ( isset( $_GET['welcome-page'] ) ) {
-     // @phpcs:ignore WordPress.Security.NonceVerification.Recommended
+ if ( isset( $_GET['welcome-page'] ) && check_admin_referer('welcome_nonce_action', 'welcome_nonce_field') ) {
      $display_page = sanitize_text_field( $_GET['welcome-page'] );
      $display_page = ! empty( $display_page ) ? $display_page : '';
  }

CodeRabbit

Similar to the previous comment, ignoring nonce verification is not recommended. It's better to add nonce verification to enhance security.

- // @phpcs:ignore WordPress.Security.NonceVerification.Recommended
- if ( isset( $_POST[ $key ] ) ) {
+ if ( isset( $_POST[ $key ] ) && check_admin_referer('post_nonce_action', 'post_nonce_field') ) {
      $save = sanitize_text_field( $_POST[ $key ] );
  } else if ( isset( $field['default'] ) ) {
      $save = $field['default'];
  }

CodeRabbit

Again, ignoring nonce verification is not a good practice. Please consider adding nonce verification.

- // @phpcs:ignore WordPress.Security.NonceVerification.Recommended
- if ( isset( $_POST[ $tab_index . '_' . $key ] ) ) {
+ if ( isset( $_POST[ $tab_index . '_' . $key ] ) && check_admin_referer('tab_nonce_action', 'tab_nonce_field') ) {
      $save = wp_unslash( $_POST[ $tab_index . '_' . $key ] );
  } else if ( isset( $field['default'] ) ) {
      $save = $field['default'];
  }

CodeRabbit

The function checks which plugin is active, and grabs those forms seems to be missing its implementation. Please ensure that the function body is included in the commit.

 	/**
 	 * checks which plugin is active, and grabs those forms.
 	 */
+473:    public function check_active_plugin_and_grab_forms() {
+474:        // Implementation goes here...
+475:    }

CodeRabbit

The removal of the content_meta function might have an impact on the display of tour meta data in modals. If this functionality is being moved elsewhere, ensure that it's properly handled and there are no regressions. If this function is not used anymore, then the removal is fine. However, without more context, it's hard to say if this change could introduce bugs or not. Please make sure you've tested all the related functionalities thoroughly after removing this function.

CodeRabbit

The changes seem to be removing the inclusion of several files (addons.php, accommodation.php, destination.php, tour.php, videos.php). If these files are no longer needed, this change is fine. However, if they contain necessary functionality, their removal could cause issues. Please ensure that all necessary functions from these files have been moved elsewhere or are no longer needed before proceeding with this change.

- 	require_once( LSX_TO_PATH . 'includes/template-tags/addons.php' );
- 	require_once( LSX_TO_PATH . 'includes/template-tags/accommodation.php' );
- 	require_once( LSX_TO_PATH . 'includes/template-tags/destination.php' );
- 	require_once( LSX_TO_PATH . 'includes/template-tags/tour.php' );
- 	require_once( LSX_TO_PATH . 'includes/template-tags/maps.php' );
- 	require_once( LSX_TO_PATH . 'includes/template-tags/videos.php' );
+  	require_once( LSX_TO_PATH . 'includes/template-tags/general.php' );
+  	require_once( LSX_TO_PATH . 'includes/template-tags/helpers.php' );
+  	require_once( LSX_TO_PATH . 'includes/template-tags/maps.php' );