From ad7acc40b72b85faed351057c46f1f42ffb110f5 Mon Sep 17 00:00:00 2001 From: wpdev Date: Sun, 27 Sep 2026 01:19:22 +0800 Subject: [PATCH] chore(2meet-data-optimizer): address the 2.1 audit notes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - The four public REST routes say why they are public (viewable posts only, show_in_rest fields only, per_page cap, one view per IP per post per hour). - Admin ternary echoes of literal strings are escaped for their context: esc_attr() in attributes, esc_html() for text; the object-cache badge is an if/else and aria-current is always printed ("false" off the current tab). - Exceptions in the migration engine and the health cron go to TMDO_Logger instead of error_log(). - Verify: audit greps (ternary echoes 23 → 0, error_log outside the logger 0); dev36 renders 8 admin tabs with the change, no PHP notice, one aria-current="page" each. - PR: PR-078 --- admin/class-tmdo-admin.php | 20 ++++++++------ admin/class-tmdo-dashboard-widget.php | 2 +- admin/templates/comment-stress-test.php | 4 +-- admin/templates/migration-wizard.php | 6 ++--- admin/templates/post-migration-wizard.php | 2 +- admin/templates/post-stress-test.php | 12 ++++----- admin/templates/term-stress-test.php | 4 +-- includes/class-tmdo-rest-api.php | 7 +++++ .../diagnostic/class-tmdo-health-cron.php | 2 +- .../class-tmdo-entity-migration-engine.php | 26 +++++++++++++------ 10 files changed, 53 insertions(+), 32 deletions(-) diff --git a/admin/class-tmdo-admin.php b/admin/class-tmdo-admin.php index 9addced..288aaff 100644 --- a/admin/class-tmdo-admin.php +++ b/admin/class-tmdo-admin.php @@ -846,8 +846,8 @@ class TMDO_Admin { > + class="nav-tab " + aria-current=""> External' : 'Built-in'; ?> + + External + + Built-in + Flush Support @@ -1726,13 +1730,13 @@ class TMDO_Admin { ↑ @@ -2037,7 +2041,7 @@ class TMDO_Admin { -
+

@@ -2071,7 +2075,7 @@ class TMDO_Admin {
-
+

diff --git a/admin/class-tmdo-dashboard-widget.php b/admin/class-tmdo-dashboard-widget.php index 588434c..357c8e1 100644 --- a/admin/class-tmdo-dashboard-widget.php +++ b/admin/class-tmdo-dashboard-widget.php @@ -246,7 +246,7 @@ class TMDO_Dashboard_Widget { '%2$s' ); ?> -

+

📦 0 ) { diff --git a/admin/templates/comment-stress-test.php b/admin/templates/comment-stress-test.php index e27252d..643965d 100644 --- a/admin/templates/comment-stress-test.php +++ b/admin/templates/comment-stress-test.php @@ -211,7 +211,7 @@ $total_commentmeta = (int) $wpdb->get_var( "SELECT COUNT(*) FROM {$wpdb->comment

-
+

@@ -249,7 +249,7 @@ $total_commentmeta = (int) $wpdb->get_var( "SELECT COUNT(*) FROM {$wpdb->comment
-
+

diff --git a/admin/templates/migration-wizard.php b/admin/templates/migration-wizard.php index 23bb667..af7e45a 100644 --- a/admin/templates/migration-wizard.php +++ b/admin/templates/migration-wizard.php @@ -99,7 +99,7 @@ $failed = 'failed' === $state;
> + >
@@ -170,7 +170,7 @@ $failed = 'failed' === $state;
> + >

@@ -210,7 +210,7 @@ $failed = 'failed' === $state;
> + >

✅

diff --git a/admin/templates/post-migration-wizard.php b/admin/templates/post-migration-wizard.php index 4076d56..f5cf43a 100644 --- a/admin/templates/post-migration-wizard.php +++ b/admin/templates/post-migration-wizard.php @@ -218,7 +218,7 @@ $wpdo_format_msg = static function ( string $code ): string {
- diff --git a/admin/templates/post-stress-test.php b/admin/templates/post-stress-test.php index b81c850..51d4eaf 100644 --- a/admin/templates/post-stress-test.php +++ b/admin/templates/post-stress-test.php @@ -161,22 +161,22 @@ $post_type_options = array( - + disabled wp_postmeta 5 rows / flat 0 → 1:5（無優化） wp_postmeta 5 / flat 0 → 1:5（無優化） - + dual_write wp_postmeta 5 / flat 0 → 1:5 wp_postmeta 5 + flat 1 → 1:5（有 flat 但 wp_postmeta 不減） - + shadow_read wp_postmeta 5 / flat 0 → 1:5 wp_postmeta 5 + flat 1 → 1:5（讀走 flat，寫仍雙寫） - + aeav_only wp_postmeta 5（直 SQL 繞過 Hook Bus）/ flat 0 → 1:5 ⚠️ wp_postmeta 0 / flat 1 → 0:1（完全優化） ✅ @@ -291,7 +291,7 @@ $post_type_options = array(
-
+

@@ -329,7 +329,7 @@ $post_type_options = array(
-
+

diff --git a/admin/templates/term-stress-test.php b/admin/templates/term-stress-test.php index 09ba3e9..92a0ca6 100644 --- a/admin/templates/term-stress-test.php +++ b/admin/templates/term-stress-test.php @@ -207,7 +207,7 @@ $total_termmeta = (int) $wpdb->get_var( "SELECT COUNT(*) FROM {$wpdb->termmeta
-
+

@@ -245,7 +245,7 @@ $total_termmeta = (int) $wpdb->get_var( "SELECT COUNT(*) FROM {$wpdb->termmeta
-
+

diff --git a/includes/class-tmdo-rest-api.php b/includes/class-tmdo-rest-api.php index bdd554c..e135fb5 100644 --- a/includes/class-tmdo-rest-api.php +++ b/includes/class-tmdo-rest-api.php @@ -37,6 +37,8 @@ class TMDO_REST_API { array( 'methods' => WP_REST_Server::READABLE, 'callback' => array( $this, 'get_listings' ), + // Public by design: viewable post types and published posts only, fields + // declared show_in_rest only (1.1.1), per_page capped (wpdo_rest_max_per_page). 'permission_callback' => '__return_true', 'args' => $this->listings_args(), ) @@ -48,6 +50,8 @@ class TMDO_REST_API { array( 'methods' => WP_REST_Server::READABLE, 'callback' => array( $this, 'get_listing' ), + // Public by design: the post must be viewable to the request (assert_post_viewable_or_error: + // publicly viewable or read_post); fields declared show_in_rest only (1.1.1). 'permission_callback' => '__return_true', 'args' => array( 'id' => array( @@ -65,6 +69,7 @@ class TMDO_REST_API { array( 'methods' => WP_REST_Server::READABLE, 'callback' => array( $this, 'get_stats' ), + // Public by design: view / engagement counters of a post viewable to the request. 'permission_callback' => '__return_true', 'args' => array( 'id' => array( @@ -82,6 +87,8 @@ class TMDO_REST_API { array( 'methods' => WP_REST_Server::CREATABLE, 'callback' => array( $this, 'post_view' ), + // Public by design: anonymous visitors count views; viewable posts only, one view + // per IP per post per hour (rate limited). 'permission_callback' => '__return_true', 'args' => array( 'id' => array( diff --git a/includes/diagnostic/class-tmdo-health-cron.php b/includes/diagnostic/class-tmdo-health-cron.php index 3bf0e66..a08c166 100644 --- a/includes/diagnostic/class-tmdo-health-cron.php +++ b/includes/diagnostic/class-tmdo-health-cron.php @@ -104,7 +104,7 @@ class TMDO_Health_Cron { } } catch ( Throwable $e ) { // phpcs:ignore Generic.CodeAnalysis.EmptyStatement.DetectedCatch -- detector failure must not break health check. - error_log( '[WPDO] Module detector exception in health cron: ' . $e->getMessage() ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log + TMDO_Logger::error( 'health_cron', 'module_detector', $e->getMessage() ); } } diff --git a/includes/engine/class-tmdo-entity-migration-engine.php b/includes/engine/class-tmdo-entity-migration-engine.php index b891b75..72855f1 100644 --- a/includes/engine/class-tmdo-entity-migration-engine.php +++ b/includes/engine/class-tmdo-entity-migration-engine.php @@ -144,13 +144,14 @@ final class TMDO_Entity_Migration_Engine { } } catch ( \Throwable $e ) { ++$stats['errors']; - error_log( - sprintf( - '[UAE Migration] Error %s/%s ID=%d: %s', - $entity_type, - $group_name, - $entity_id, - $e->getMessage() + TMDO_Logger::error( + 'migration_engine', + 'migrate_group', + $e->getMessage(), + array( + 'entity_type' => $entity_type, + 'group' => $group_name, + 'entity_id' => $entity_id, ) ); } @@ -383,7 +384,16 @@ final class TMDO_Entity_Migration_Engine { ++$batch_migrated; } } catch ( \Throwable $e ) { - error_log( sprintf( '[UAE Migration Batch] Error %s/%s ID=%d: %s', $entity_type, $group_name, $entity_id, $e->getMessage() ) ); + TMDO_Logger::error( + 'migration_engine', + 'migrate_group_batch', + $e->getMessage(), + array( + 'entity_type' => $entity_type, + 'group' => $group_name, + 'entity_id' => $entity_id, + ) + ); } $last_id = $entity_id; }