fix: pass WordPress Plugin Check (69 errors → 0)#35
Merged
Conversation
Resolve every Plugin Check ERROR reported against the plugin:
- DateTime.RestrictedFunctions (25): date() -> gmdate(). The rate limiter
also switches its window_start writes to current_time('mysql', true) so
both sides of the window comparison are GMT (fixes a latent offset;
window_start is never displayed). Blocker/detector/stats/templates keep
local storage because those values are rendered via
date_i18n(strtotime(...)); only the threshold formatting is switched
(WP pins PHP's default tz to UTC, so date()==gmdate() there).
- EscapeOutput.ExceptionNotEscaped (13): wrap WooCommerce RouteException
messages in esc_html(); annotate internal, never-echoed SDK exceptions
(Client/Parser/Tokenizer) with phpcs:ignore to keep the SDK
framework-agnostic.
- AlternativeFunctions.curl_* (12): remove the dead raw-cURL fallback in
the SDK Client; the WP HTTP API is always available in WordPress, and we
now throw WebDecoyException if it ever is not.
- wp_function_not_compatible_with_requires_wp (2): str_ends_with() ->
7.4-safe substr() check; guard wp_cache_flush_group() (WP 6.1+).
- AlternativeFunctions.parse_url (3): wp_parse_url() in webdecoy.php;
guarded wp_parse_url() fallback in the standalone SDK BotDetector.
- AlternativeFunctions.strip_tags (1): guarded wp_strip_all_tags() fallback
in the SDK SignalCollector.
- AlternativeFunctions.fclose (1): phpcs:ignore for CSV streaming to
php://output (not filesystem access).
- I18n.MissingTranslatorsComment (4): add translators comments.
- EscapeOutput.OutputNotEscaped (2): phpcs:ignore for template-generated
decoy content (no user input).
- missing_direct_file_access_protection (1): ABSPATH guard in GoodBotList.
- outdated_tested_upto_header (1): Tested up to 6.8 -> 6.7.
Keeps PHP 7.4 compatibility; tests still pass (41 passed, 0 failed).
…eck errors) - 'Tested up to: 7.0' (current WordPress release; the check requires the latest). - 'Requires at least: 6.1' — covers wp_cache_flush_group (WP 6.1+), which the static Plugin Check flags regardless of the function_exists guard.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ran the official Plugin Check tool (the one WordPress.org reviewers use) against the built
.orgZIP in a real WordPress 7.0-data environment. It found 69 errors — my earlier manual guideline review missed them. This fixes all 69; the plugin now reports 0 errors (378 advisory warnings remain, all the standard accepted kind).Errors fixed (69 → 0)
date()→gmdate()esc_html()(WooCommerce) / justifiedphpcs:ignore(internal SDK exceptions)Client.php; WP HTTP API path onlystr_ends_with()on PHP 7.4substrcheckwp_cache_flush_group()(WP 6.1+)parse_url→wp_parse_urlstrip_tags→wp_strip_all_tagsphpcs:ignore(template-generated decoy content;php://outputCSV stream)GoodBotList.phpVerified
wp plugin check webdecoy→ 0 ERRORS (was 69), rebuilt.orgZIP re-checked.php tests/run.php→ 41 passed.php -lclean on all 16 changed PHP files; PHP 7.4 compatible throughout.The 378 warnings are non-prefixed template variables, direct queries against the plugin's own custom tables, and input notices on request-inspection code — the normal, accepted set for a security plugin; none block approval.