chore(2meet-data-optimizer): address the 2.1 audit notes

- The four public REST routes say why they are public (viewable posts only, show_in_rest fields only, per_page cap, one view per IP per post per hour). - Admin ternary echoes of literal strings are escaped for their context: esc_attr() in attributes, esc_html() for text; the object-cache badge is an if/else and aria-current is always printed ("false" off the current tab). - Exceptions in the migration engine and the health cron go to TMDO_Logger instead of error_log(). - Verify: audit greps (ternary echoes 23 → 0, error_log outside the logger 0); dev36 renders 8 admin tabs with the change, no PHP notice, one aria-current="page" each. - PR: PR-078
2026-09-27 01:19:22 +08:00
parent f48df1a33f
commit ad7acc40b7
10 changed files with 53 additions and 32 deletions
@@ -246,7 +246,7 @@ class TMDO_Dashboard_Widget {
 					'%2$s'
 				);
 			?>
-			<p class="wpdo-widget-notice <?php echo $total_eav > 0 ? 'wpdo-widget-notice-warn' : 'wpdo-widget-notice-ok'; ?>">
+			<p class="wpdo-widget-notice <?php echo esc_attr( $total_eav > 0 ? 'wpdo-widget-notice-warn' : 'wpdo-widget-notice-ok' ); ?>">
 				📦
 				<?php
 				if ( $total_eav > 0 ) {