tweak inline comments

Author: aristath

classes/admin/class-page-settings.php

@@ -133,7 +133,7 @@ public function store_settings_form_options() {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to update settings.', 'progress-planner' ) ] );
 		}
 
-		// SECURITY FIX: Use check_ajax_referer instead of check_admin_referer for AJAX handlers.
+		// Use check_ajax_referer instead of check_admin_referer for AJAX handlers.
 		// check_admin_referer is designed for form submissions, not AJAX requests.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );

classes/class-suggested-tasks.php

@@ -185,7 +185,7 @@ public function was_task_completed( $task_id ): bool {
 	 * Primarly this is used for deeplinking, ie user is testing if the emails are working
 	 * He gets an email with a link which automatically completes the task.
 	 *
-	 * SECURITY FIX: Added token verification to prevent CSRF attacks.
+	 * Verify token to prevent CSRF attacks.
 	 * Tokens are one-time use and expire after 24 hours.
 	 *
 	 * @return void
@@ -200,7 +200,7 @@ public function maybe_complete_task() {
 			return;
 		}
 
-		// SECURITY FIX: Verify token to prevent CSRF attacks.
+		// Verify token to prevent CSRF attacks.
 		if ( ! isset( $_GET['token'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
 			return;
 		}

classes/suggested-tasks/providers/class-email-sending.php

@@ -110,7 +110,7 @@ public function init() {
 
 		$this->email_subject = \esc_html__( 'Your Progress Planner test message!', 'progress-planner' );
 
-		// SECURITY FIX: Generate a secure token for the completion link to prevent CSRF.
+		// Generate a secure token for the completion link to prevent CSRF.
 		$user_id = \get_current_user_id();
 		$token   = \progress_planner()->get_suggested_tasks()->generate_task_completion_token( $this->get_task_id(), $user_id );
 
@@ -253,7 +253,7 @@ protected function is_there_sending_email_override() {
 	/**
 	 * Test email sending.
 	 *
-	 * SECURITY FIX: Changed to use check_ajax_referer and get email from $_POST.
+	 * Use check_ajax_referer and get email from $_POST.
 	 *
 	 * @return void
 	 */
@@ -263,12 +263,12 @@ public function ajax_test_email_sending() {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'You do not have permission to test email sending.', 'progress-planner' ) ] );
 		}
 
-		// SECURITY FIX: Use check_ajax_referer for AJAX handlers.
+		// Use check_ajax_referer for AJAX handlers.
 		if ( ! \check_ajax_referer( 'progress_planner', 'nonce', false ) ) {
 			\wp_send_json_error( [ 'message' => \esc_html__( 'Invalid nonce.', 'progress-planner' ) ] );
 		}
 
-		// SECURITY FIX: Get email from POST data (AJAX request).
+		// Get email from POST data (AJAX request).
 		$email_address = isset( $_POST['email_address'] ) ? \sanitize_email( \wp_unslash( $_POST['email_address'] ) ) : '';
 
 		if ( ! $email_address ) {

classes/suggested-tasks/providers/class-tasks-interactive.php

@@ -88,7 +88,7 @@ public function handle_interactive_task_submit() {
 		$value        = \sanitize_text_field( \wp_unslash( $_POST['value'] ) );
 		$setting_path = \json_decode( \sanitize_text_field( \wp_unslash( $_POST['setting_path'] ) ), true );
 
-		// SECURITY FIX: Whitelist allowed options to prevent arbitrary options update.
+		// Whitelist allowed options to prevent arbitrary options update.
 		// This prevents privilege escalation by restricting which options can be updated.
 		$allowed_options = $this->get_allowed_interactive_options();