Put nonce and capability checks where Plugin Check can see them - #4
Open
jeffreyvr wants to merge 12 commits into
Open
Put nonce and capability checks where Plugin Check can see them#4jeffreyvr wants to merge 12 commits into
jeffreyvr wants to merge 12 commits into
Conversation
Drop the GitHub update checker, add a license and dist ignore list, and tighten settings, notices, and logging for Plugin Check. Co-authored-by: Cursor <cursoragent@cursor.com>
Owners can grant access from WordPress instead of pasting keys. Products now send short description, categories, tags, visible attributes, and SKU. Co-authored-by: Cursor <cursoragent@cursor.com>
Connect with Datalumo stays the main action. The URL field is still there for self-hosted installs, and opens when a non-cloud URL is already stored. Co-authored-by: Cursor <cursoragent@cursor.com>
fresh-site and ensure-index-php are maintainer tools, not something a WordPress site should receive. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep directory listing prep (no GitHub updater, documented service, dismissible notice) on top of 0.2.0 thumbnails and Connect/Woo work. Co-authored-by: Cursor <cursoragent@cursor.com>
Add translators comments, use wp_parse_url, and document the remaining scanner false positives. Co-authored-by: Cursor <cursoragent@cursor.com>
List jeffreyvr as the only contributor, document the remaining data sent, and treat visitor identity as an optional hook. Co-authored-by: Cursor <cursoragent@cursor.com>
Keep them in .wordpress-org so the release zip does not ship directory assets. Co-authored-by: Cursor <cursoragent@cursor.com>
…nch. Co-authored-by: Cursor <cursoragent@cursor.com>
… operator. Co-authored-by: Cursor <cursoragent@cursor.com>
Plugin Check / WPCS does not follow helper methods, so Ajax connect and syncId, plus the add-to-cart and host-navigation payload readers, now call check_ajax_referer (and manage_options where the action is admin) inline. Public guest handlers and the OAuth callback stay unchanged. Co-authored-by: Jeffrey van Rossum <rossum.jeffrey@gmail.com>
jeffreyvr
marked this pull request as ready for review
August 31, 2026 13:37
Require Jetpack Autoloader 6.0.0 and Action Scheduler 4.1.0. Raise Requires at least to 6.8 to match Action Scheduler. Drop bundled .po/.mo translations so WordPress.org can supply them via translate.wordpress.org; keep the .pot template and exclude locale files from the distribution zip. Co-authored-by: Jeffrey van Rossum <rossum.jeffrey@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This should land via the
wporg-readywork (open PR #2). Do not merge #2 from here; this branch is based onwporg-readyand targetsmain.Nonces (original)
WordPress.org / Plugin Check flagged Nonces and User Permissions Before Processing Requests. The handlers already had CSRF and capability checks; WPCS does not follow into helpers, so
$_POSTreads inAjax::connect(),Ajax::syncId(),AddToCart::requestPayload(), andHostNavigation::requestPayload()looked unprotected.check_ajax_referer('datalumo_admin')andcurrent_user_can('manage_options')are now in the same function as the$_POSTread.requestPayload()callscheck_ajax_refereronly (stillwp_ajax_nopriv_*).statevs the per-user transient +manage_options. No WP nonce.Out of date libraries
automattic/jetpack-autoloader^3.0→^6.0(resolves to v6.0.0). Bootstrap is stillvendor/autoload_packages.php.woocommerce/action-scheduler^3.0→^4.1(resolves to 4.1.0).action-scheduler.phppath andas_enqueue_async_action/as_schedule_single_action/as_unschedule_all_actions/as_has_scheduled_actionare unchanged. Hooks remaindatalumo_push_page,datalumo_push_batch,datalumo_delete_page.composer.lockstays gitignored (existing release convention:composer installon the tag). The GitHub release zip still buildsvendor/from these constraints.Translation files included
languages/*.poandlanguages/*.mo(nl_NL, zh_CN, zh_HK, zh_TW).languages/datalumo.pot(template, not a locale) andlanguages/index.php.datalumoandDomain Path: /languagesunchanged. Noload_plugin_textdomain(WordPress just-in-time loading). Sourceesc_html__/__calls unchanged..distignore,.gitignore, and the release zip excludes now droplanguages/*.po,languages/*.mo, and*.l10n.php.Tests
composer test— 90 passed (264 assertions).