-
Notifications
You must be signed in to change notification settings - Fork 142
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
VIP linter fixes #820
base: master
Are you sure you want to change the base?
VIP linter fixes #820
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Changes look good, just curious if this sanitization will pass the linter checks.
(Also it would be good to update the coding standards here so that they include VIP coding standards. I'll do that in a followup.)
@goldenapples Yes you are correct I thought it would be impossible to get rid of the one remaining warning but the code as it stands doesn't raise any linter issues. Would you mind reviewing? Thanks :) |
@@ -94,6 +94,12 @@ public function action_wp_ajax_shortcode_ui_post_field() { | |||
$requested_shortcode = isset( $_GET['shortcode'] ) ? sanitize_text_field( $_GET['shortcode'] ) : null; | |||
$requested_attr = isset( $_GET['attr'] ) ? sanitize_text_field( $_GET['attr'] ) : null; | |||
|
|||
$include = filter_input( INPUT_GET, 'include', FILTER_SANITIZE_NUMBER_INT, FILTER_REQUIRE_ARRAY ); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure I'm following what FILTER_SANITIZE_NUMBER_INT
is doing here, since you map intval
over the array a couple lines below. Is the sanitize_int filter just necessary to pass the lint rule?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes this seems like an overzealous linter change really, will revisit this PR and see if it's still relevant.
A couple of issues were highlighted by the wp linter bot.
Sanitizes unsafe $_GET['include'] use and defines $args as an empty array before using it.
Tested against
?include=12,23a
,?include[]=12&include[]=23a
and without parameter.