phpcs & phpstan fixes

Author: aristath

classes/admin/class-page-settings.php

@@ -193,8 +193,8 @@ public function store_settings_form_options() {
 	 */
 	public function save_settings() {
 		// Nonce is already checked in store_settings_form_options() which calls this method.
-		$redirect_on_login = isset( $_POST['prpl-redirect-on-login'] )
-			? \sanitize_text_field( \wp_unslash( $_POST['prpl-redirect-on-login'] ) )
+		$redirect_on_login = isset( $_POST['prpl-redirect-on-login'] ) // phpcs:ignore WordPress.Security.NonceVerification.Missing
+			? \sanitize_text_field( \wp_unslash( $_POST['prpl-redirect-on-login'] ) ) // phpcs:ignore WordPress.Security.NonceVerification.Missing
 			: false;
 
 		\update_user_meta( \get_current_user_id(), 'prpl_redirect_on_login', (bool) $redirect_on_login );
@@ -207,8 +207,8 @@ public function save_settings() {
 	 */
 	public function save_post_types() {
 		// Nonce is already checked in store_settings_form_options() which calls this method.
-		$include_post_types = isset( $_POST['prpl-post-types-include'] )
-			? \array_map( 'sanitize_text_field', \wp_unslash( $_POST['prpl-post-types-include'] ) ) // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
+		$include_post_types = isset( $_POST['prpl-post-types-include'] ) // phpcs:ignore WordPress.Security.NonceVerification.Missing
+			? \array_map( 'sanitize_text_field', \wp_unslash( $_POST['prpl-post-types-include'] ) ) // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.NonceVerification.Missing
 			// If no post types are selected, use the default post types (post and page can be deregistered).
 			: \array_intersect( [ 'post', 'page' ], \progress_planner()->get_settings()->get_public_post_types() );
 

tests/phpunit/test-class-security.php

@@ -473,10 +473,10 @@ public function evaluate() {
 		};
 
 		// Test 1: Try to update a non-whitelisted option (should FAIL with fix).
-		$original_admin_email = \get_option( 'admin_email' );
-		$_POST['nonce']       = \wp_create_nonce( 'progress_planner' );
-		$_POST['setting']     = 'admin_email'; // Not in whitelist.
-		$_POST['value']       = 'hacker@evil.com';
+		$original_admin_email  = \get_option( 'admin_email' );
+		$_POST['nonce']        = \wp_create_nonce( 'progress_planner' );
+		$_POST['setting']      = 'admin_email'; // Not in whitelist.
+		$_POST['value']        = 'hacker@evil.com';
 		$_POST['setting_path'] = '[]';
 
 		\ob_start();
@@ -690,13 +690,13 @@ public function evaluate() {
 		};
 
 		$critical_options = [
-			'admin_email'         => 'admin@example.com',
-			'siteurl'             => 'https://example.com',
-			'home'                => 'https://example.com',
-			'users_can_register'  => '0',
-			'active_plugins'      => [],
-			'default_role'        => 'subscriber',
-			'wp_user_roles'       => [],
+			'admin_email'        => 'admin@example.com',
+			'siteurl'            => 'https://example.com',
+			'home'               => 'https://example.com',
+			'users_can_register' => '0',
+			'active_plugins'     => [],
+			'default_role'       => 'subscriber',
+			'wp_user_roles'      => [],
 		];
 
 		foreach ( $critical_options as $option => $malicious_value ) {