Skip to content

Commit 48ef19d

Browse files
PDowneyPDowney
authored
Updates
1 parent 6c47177 commit 48ef19d

3 files changed

Lines changed: 202 additions & 9 deletions

File tree

‎.github/workflows/wp-compatibility-test.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,9 @@ jobs:
129129
composer global config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
130130
composer global require --dev squizlabs/php_codesniffer:"^3.7"
131131
composer global require --dev wp-coding-standards/wpcs:"^3.0"
132+
composer global require --dev phpcompatibility/php-compatibility:"^9.3"
133+
composer global require --dev phpcompatibility/phpcompatibility-wp:"^2.1"
134+
132135
composer global require --dev dealerdirect/phpcodesniffer-composer-installer:"^1.0"
133136
134137
# Add composer bin to PATH

‎phpcs.xml‎

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
<?xml version="1.0"?>
2+
<ruleset name="Simple WP Site Exporter PHPCS Rules">
3+
<description>PHP_CodeSniffer configuration for Simple WP Site Exporter WordPress plugin</description>
4+
5+
<!-- Include the WordPress coding standards -->
6+
<rule ref="WordPress">
7+
<!-- Exclude rules that are not applicable for plugins or cause false positives -->
8+
<exclude name="WordPress.Files.FileName.InvalidClassFileName"/>
9+
<exclude name="WordPress.Files.FileName.NotHyphenatedLowercase"/>
10+
11+
<!-- Allow short array syntax [] instead of array() -->
12+
<exclude name="Generic.Arrays.DisallowShortArraySyntax"/>
13+
14+
<!-- Allow superglobal access with proper sanitization -->
15+
<exclude name="WordPress.Security.ValidatedSanitizedInput.InputNotSanitized"/>
16+
17+
<!-- Allow direct filesystem operations for controlled export operations -->
18+
<exclude name="WordPress.WP.AlternativeFunctions.file_system_read_readfile"/>
19+
<exclude name="WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents"/>
20+
</rule>
21+
22+
<!-- Include WordPress Extra rules for enhanced security and best practices -->
23+
<rule ref="WordPress-Extra">
24+
<!-- Exclude overly strict filename rules for single-file plugins -->
25+
<exclude name="WordPress.Files.FileName"/>
26+
27+
<!-- Allow inline comments for complex security validations -->
28+
<exclude name="Squiz.Commenting.InlineComment.InvalidEndChar"/>
29+
</rule>
30+
31+
<!-- Include WordPress Docs rules for proper documentation -->
32+
<rule ref="WordPress-Docs"/>
33+
34+
<!-- Include WordPress VIP rules for security and performance -->
35+
<rule ref="WordPressVIPMinimum">
36+
<!-- Allow necessary functions for export operations -->
37+
<exclude name="WordPressVIPMinimum.Functions.RestrictedFunctions.shell_exec_shell_exec"/>
38+
<exclude name="WordPressVIPMinimum.Functions.RestrictedFunctions.file_exists_file_exists"/>
39+
<exclude name="WordPressVIPMinimum.Functions.RestrictedFunctions.escapeshellarg_escapeshellarg"/>
40+
<exclude name="WordPressVIPMinimum.Files.IncludingFile.UsingVariable"/>
41+
42+
<!-- Allow direct filesystem operations for export functionality -->
43+
<exclude name="WordPressVIPMinimum.Performance.FetchingRemoteData.FileGetContentsUnknown"/>
44+
</rule>
45+
46+
<!-- Specify file extensions to check -->
47+
<arg name="extensions" value="php"/>
48+
49+
<!-- Show progress and use colors -->
50+
<arg value="ps"/>
51+
52+
<!-- Check all files in the plugin directory -->
53+
<file>.</file>
54+
55+
<!-- Exclude certain directories and files -->
56+
<exclude-pattern>*/vendor/*</exclude-pattern>
57+
<exclude-pattern>*/node_modules/*</exclude-pattern>
58+
<exclude-pattern>*/tests/*</exclude-pattern>
59+
<exclude-pattern>*/build/*</exclude-pattern>
60+
<exclude-pattern>*/dist/*</exclude-pattern>
61+
<exclude-pattern>*/.git/*</exclude-pattern>
62+
63+
<!-- Configure specific rules -->
64+
65+
<!-- Set minimum PHP version for compatibility checks -->
66+
<config name="minimum_supported_wp_version" value="5.0"/>
67+
<config name="testVersion" value="7.4-"/>
68+
69+
<!-- WordPress.NamingConventions.PrefixAllGlobals -->
70+
<rule ref="WordPress.NamingConventions.PrefixAllGlobals">
71+
<properties>
72+
<!-- Define the plugin prefix -->
73+
<property name="prefixes" type="array">
74+
<element value="sse"/>
75+
<element value="SSE"/>
76+
<element value="Simple_WP_Site_Exporter"/>
77+
<element value="ES_WP_SITE_EXPORTER"/>
78+
</property>
79+
</properties>
80+
</rule>
81+
82+
<!-- WordPress.WP.I18n -->
83+
<rule ref="WordPress.WP.I18n">
84+
<properties>
85+
<!-- Define the text domain -->
86+
<property name="text_domain" type="array">
87+
<element value="Simple-WP-Site-Exporter"/>
88+
</property>
89+
</properties>
90+
</rule>
91+
92+
<!-- Generic.Commenting.DocComment -->
93+
<rule ref="Generic.Commenting.DocComment">
94+
<!-- Allow @SuppressWarnings annotations for PHPMD -->
95+
<exclude name="Generic.Commenting.DocComment.TagValueIndent"/>
96+
<exclude name="Generic.Commenting.DocComment.NonParamGroup"/>
97+
</rule>
98+
99+
<!-- Squiz.Commenting.FunctionComment -->
100+
<rule ref="Squiz.Commenting.FunctionComment">
101+
<!-- Allow missing parameter comments for simple functions -->
102+
<exclude name="Squiz.Commenting.FunctionComment.MissingParamTag"/>
103+
<exclude name="Squiz.Commenting.FunctionComment.ParamCommentFullStop"/>
104+
<exclude name="Squiz.Commenting.FunctionComment.ThrowsNotCapital"/>
105+
</rule>
106+
107+
<!-- WordPress.Security.EscapeOutput -->
108+
<rule ref="WordPress.Security.EscapeOutput">
109+
<!-- Allow specific contexts where escaping is handled differently -->
110+
<properties>
111+
<property name="customAutoEscapedFunctions" type="array">
112+
<element value="wp_die"/>
113+
<element value="esc_html__"/>
114+
<element value="esc_attr__"/>
115+
</property>
116+
</properties>
117+
</rule>
118+
119+
<!-- Generic.Files.LineLength -->
120+
<rule ref="Generic.Files.LineLength">
121+
<properties>
122+
<!-- Allow longer lines for complex security validations and URLs -->
123+
<property name="lineLimit" value="120"/>
124+
<property name="absoluteLineLimit" value="150"/>
125+
</properties>
126+
<!-- Exclude specific contexts where long lines are acceptable -->
127+
<exclude-pattern>*/phpcs.xml</exclude-pattern>
128+
</rule>
129+
130+
<!-- WordPress.Arrays.MultipleStatementAlignment -->
131+
<rule ref="WordPress.Arrays.MultipleStatementAlignment">
132+
<properties>
133+
<!-- Allow flexible array alignment for better readability -->
134+
<property name="exact" value="false"/>
135+
<property name="maxColumn" value="1000"/>
136+
</properties>
137+
</rule>
138+
139+
<!-- PSR2.Methods.FunctionCallSignature -->
140+
<rule ref="PSR2.Methods.FunctionCallSignature">
141+
<!-- Allow flexible function call formatting -->
142+
<exclude name="PSR2.Methods.FunctionCallSignature.SpaceAfterCloseBracket"/>
143+
<exclude name="PSR2.Methods.FunctionCallSignature.ContentAfterOpenBracket"/>
144+
<exclude name="PSR2.Methods.FunctionCallSignature.CloseBracketLine"/>
145+
</rule>
146+
147+
<!-- WordPress.PHP.YodaConditions -->
148+
<rule ref="WordPress.PHP.YodaConditions">
149+
<!-- Allow non-Yoda conditions for better readability in some contexts -->
150+
<properties>
151+
<property name="allow" value="comparison,assignment"/>
152+
</properties>
153+
</rule>
154+
155+
<!-- Generic.Commenting.Fixme -->
156+
<rule ref="Generic.Commenting.Fixme">
157+
<!-- Treat TODO and FIXME as warnings instead of errors -->
158+
<type>warning</type>
159+
</rule>
160+
161+
<!-- Squiz.PHP.CommentedOutCode -->
162+
<rule ref="Squiz.PHP.CommentedOutCode">
163+
<!-- Treat commented out code as warnings -->
164+
<type>warning</type>
165+
</rule>
166+
167+
<!-- Custom exclusions for specific security contexts -->
168+
169+
<!-- Allow direct superglobal access with proper sanitization -->
170+
<rule ref="WordPress.Security.ValidatedSanitizedInput.InputNotValidated">
171+
<!-- These are specifically validated and sanitized in our code -->
172+
<exclude-pattern>*simple-wp-site-exporter.php</exclude-pattern>
173+
</rule>
174+
175+
<!-- Allow necessary shell operations for WP-CLI -->
176+
<rule ref="WordPress.PHP.DiscouragedPHPFunctions">
177+
<properties>
178+
<property name="exclude" type="array">
179+
<element value="shell_exec"/>
180+
<element value="escapeshellarg"/>
181+
</property>
182+
</properties>
183+
</rule>
184+
185+
<!-- Allow direct file operations for controlled export operations -->
186+
<rule ref="WordPress.WP.AlternativeFunctions">
187+
<exclude-pattern>*simple-wp-site-exporter.php</exclude-pattern>
188+
</rule>
189+
190+
</ruleset>

‎simple-wp-site-exporter.php‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,7 @@ function sse_exporter_page_html() {
196196
$display_path = str_replace( ABSPATH, '', $export_dir_path );
197197
?>
198198
<div class="wrap">
199-
<h1><?php echo esc_html( get_admin_page_title() ); ?></h1>
199+
<h1><?php echo esc_html( get_admin_page_title() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- esc_html() used for proper escaping ?></h1>
200200
<p><?php esc_html_e( 'Click the button below to generate a zip archive containing your WordPress files and a database dump (.sql file).', 'Simple-WP-Site-Exporter' ); ?></p>
201201
<p><strong><?php esc_html_e( 'Warning:', 'Simple-WP-Site-Exporter' ); ?></strong> <?php esc_html_e( 'This can take a long time and consume significant server resources, especially on large sites. Ensure your server has sufficient disk space and execution time.', 'Simple-WP-Site-Exporter' ); ?></p>
202202
<p style="margin-top: 15px;">
@@ -273,12 +273,12 @@ function sse_handle_export() {
273273
* @return bool True if request is valid, false otherwise.
274274
*/
275275
function sse_validate_export_request() { // phpcs:ignore WordPress.Security.NonceVerification.Missing
276-
$post_action = isset( $_POST['action'] ) ? sanitize_key( $_POST['action'] ) : '';
276+
$post_action = isset( $_POST['action'] ) ? sanitize_key( $_POST['action'] ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verification happens below
277277
if ( 'sse_export_site' !== $post_action ) {
278278
return false;
279279
}
280280

281-
$post_nonce = isset( $_POST['sse_export_nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['sse_export_nonce'] ) ) : '';
281+
$post_nonce = isset( $_POST['sse_export_nonce'] ) ? sanitize_text_field( wp_unslash( $_POST['sse_export_nonce'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- This line retrieves nonce for verification
282282
if ( ! $post_nonce || ! wp_verify_nonce( $post_nonce, 'sse_export_action' ) ) {
283283
wp_die( esc_html__( 'Nonce verification failed! Please try again.', 'Simple-WP-Site-Exporter' ), 403 );
284284
}
@@ -344,13 +344,13 @@ function sse_setup_export_directories() {
344344
*/
345345
function sse_create_index_file( $export_dir ) {
346346
$index_file_path = trailingslashit( $export_dir ) . 'index.php';
347-
if ( file_exists( $index_file_path ) ) {
347+
if ( file_exists( $index_file_path ) ) { // phpcs:ignore WordPressVIPMinimum.Functions.RestrictedFunctions.file_exists_file_exists -- Checking controlled export directory
348348
return;
349349
}
350350

351351
global $wp_filesystem;
352352
if ( ! $wp_filesystem ) {
353-
require_once ABSPATH . 'wp-admin/includes/file.php';
353+
require_once ABSPATH . 'wp-admin/includes/file.php'; // phpcs:ignore WordPressVIPMinimum.Files.IncludingFile.UsingVariable -- WordPress core filesystem API
354354
if ( ! WP_Filesystem() ) {
355355
sse_log('Failed to initialize WordPress filesystem API', 'error');
356356
return;
@@ -393,14 +393,14 @@ function sse_export_database( $export_dir ) {
393393

394394
$command = sprintf(
395395
'%s db export %s --path=%s --allow-root',
396-
escapeshellarg($wp_cli_path),
397-
escapeshellarg($db_filepath),
398-
escapeshellarg(ABSPATH)
396+
escapeshellarg($wp_cli_path), // phpcs:ignore WordPressVIPMinimum.Functions.RestrictedFunctions.escapeshellarg_escapeshellarg -- Required for shell command security
397+
escapeshellarg($db_filepath), // phpcs:ignore WordPressVIPMinimum.Functions.RestrictedFunctions.escapeshellarg_escapeshellarg -- Required for shell command security
398+
escapeshellarg(ABSPATH) // phpcs:ignore WordPressVIPMinimum.Functions.RestrictedFunctions.escapeshellarg_escapeshellarg -- Required for shell command security
399399
);
400400

401401
$output = shell_exec($command . ' 2>&1');
402402

403-
if ( ! file_exists( $db_filepath ) || filesize( $db_filepath ) <= 0 ) {
403+
if ( ! file_exists( $db_filepath ) || filesize( $db_filepath ) <= 0 ) { // phpcs:ignore WordPressVIPMinimum.Functions.RestrictedFunctions.file_exists_file_exists -- Validating WP-CLI export success
404404
$error_message = ! empty($output) ? trim($output) : 'WP-CLI command failed silently.';
405405
return new WP_Error( 'db_export_failed', $error_message );
406406
}

0 commit comments

Comments
 (0)