wpdev/2meet-data-optimizer
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases 1 Wiki Activity

chore(2meet-data-optimizer): address the 2.1 audit notes

Browse Source 
- The four public REST routes say why they are public (viewable posts only, show_in_rest fields only, per_page cap, one view per IP per post per hour).
- Admin ternary echoes of literal strings are escaped for their context: esc_attr() in attributes, esc_html() for text; the object-cache badge is an if/else and aria-current is always printed ("false" off the current tab).
- Exceptions in the migration engine and the health cron go to TMDO_Logger instead of error_log().
- Verify: audit greps (ternary echoes 23 → 0, error_log outside the logger 0); dev36 renders 8 admin tabs with the change, no PHP notice, one aria-current="page" each.
- PR: PR-078
This commit is contained in:
wpdev
2026-09-27 01:19:22 +08:00
parent f48df1a33f
commit ad7acc40b7
10 changed files with 53 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/class-tmdo-rest-api.php
+7
View File
@@ -37,6 +37,8 @@ class TMDO_REST_API {
array(
'methods' => WP_REST_Server::READABLE,
'callback' => array( $this, 'get_listings' ),
// Public by design: viewable post types and published posts only, fields
// declared show_in_rest only (1.1.1), per_page capped (wpdo_rest_max_per_page).
'permission_callback' => '__return_true',
'args' => $this->listings_args(),
)
@@ -48,6 +50,8 @@ class TMDO_REST_API {
array(
'methods' => WP_REST_Server::READABLE,
'callback' => array( $this, 'get_listing' ),
// Public by design: the post must be viewable to the request (assert_post_viewable_or_error:
// publicly viewable or read_post); fields declared show_in_rest only (1.1.1).
'permission_callback' => '__return_true',
'args' => array(
'id' => array(
@@ -65,6 +69,7 @@ class TMDO_REST_API {
array(
'methods' => WP_REST_Server::READABLE,
'callback' => array( $this, 'get_stats' ),
// Public by design: view / engagement counters of a post viewable to the request.
'permission_callback' => '__return_true',
'args' => array(
'id' => array(
@@ -82,6 +87,8 @@ class TMDO_REST_API {
array(
'methods' => WP_REST_Server::CREATABLE,
'callback' => array( $this, 'post_view' ),
// Public by design: anonymous visitors count views; viewable posts only, one view
// per IP per post per hour (rate limited).
'permission_callback' => '__return_true',
'args' => array(
'id' => array(
includes/diagnostic/class-tmdo-health-cron.php
+1 -1
View File
@@ -104,7 +104,7 @@ class TMDO_Health_Cron {
}
} catch ( Throwable $e ) {
// phpcs:ignore Generic.CodeAnalysis.EmptyStatement.DetectedCatch -- detector failure must not break health check.
error_log( '[WPDO] Module detector exception in health cron: ' . $e->getMessage() ); // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
TMDO_Logger::error( 'health_cron', 'module_detector', $e->getMessage() );
}
}
includes/engine/class-tmdo-entity-migration-engine.php
+18 -8
View File
@@ -144,13 +144,14 @@ final class TMDO_Entity_Migration_Engine {
}
} catch ( \Throwable $e ) {
++$stats['errors'];
error_log(
sprintf(
'[UAE Migration] Error %s/%s ID=%d: %s',
$entity_type,
$group_name,
$entity_id,
$e->getMessage()
TMDO_Logger::error(
'migration_engine',
'migrate_group',
$e->getMessage(),
array(
'entity_type' => $entity_type,
'group' => $group_name,
'entity_id' => $entity_id,
)
);
}
@@ -383,7 +384,16 @@ final class TMDO_Entity_Migration_Engine {
++$batch_migrated;
}
} catch ( \Throwable $e ) {
error_log( sprintf( '[UAE Migration Batch] Error %s/%s ID=%d: %s', $entity_type, $group_name, $entity_id, $e->getMessage() ) );
TMDO_Logger::error(
'migration_engine',
'migrate_group_batch',
$e->getMessage(),
array(
'entity_type' => $entity_type,
'group' => $group_name,
'entity_id' => $entity_id,
)
);
}
$last_id = $entity_id;
}