Commit 86889579613 for woocommerce
commit 86889579613c82efebe54c8d83e663074f959978
Author: Darren Ethier <darren@roughsmootheng.in>
Date: Mon Aug 17 08:53:39 2026 -0400
Replace verified legacy WPCS suppression comments (#67752)
Dev: Replace verified legacy WPCS suppressions
diff --git a/plugins/woocommerce/changelog/wpcs-replacement b/plugins/woocommerce/changelog/wpcs-replacement
new file mode 100644
index 00000000000..928e1d14fb6
--- /dev/null
+++ b/plugins/woocommerce/changelog/wpcs-replacement
@@ -0,0 +1,4 @@
+Significance: patch
+Type: dev
+
+Replace legacy WPCS suppression comments with PHPCS directives.
diff --git a/plugins/woocommerce/includes/abstracts/abstract-wc-settings-api.php b/plugins/woocommerce/includes/abstracts/abstract-wc-settings-api.php
index 861e7c55841..08459bf8a8e 100644
--- a/plugins/woocommerce/includes/abstracts/abstract-wc-settings-api.php
+++ b/plugins/woocommerce/includes/abstracts/abstract-wc-settings-api.php
@@ -463,8 +463,8 @@ abstract class WC_Settings_API {
<td class="forminp">
<fieldset>
<legend class="screen-reader-text"><span><?php echo wp_kses_post( $data['title'] ); ?></span></legend>
- <input class="input-text regular-input <?php echo esc_attr( $data['class'] ); ?>" type="<?php echo esc_attr( $data['type'] ); ?>" name="<?php echo esc_attr( $field_key ); ?>" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" value="<?php echo esc_attr( $this->get_option( $key ) ); ?>" placeholder="<?php echo esc_attr( $data['placeholder'] ); ?>" <?php disabled( $data['disabled'], true ); ?> <?php echo $this->get_custom_attribute_html( $data ); // WPCS: XSS ok. ?> />
- <?php echo $this->get_description_html( $data ); // WPCS: XSS ok. ?>
+ <input class="input-text regular-input <?php echo esc_attr( $data['class'] ); ?>" type="<?php echo esc_attr( $data['type'] ); ?>" name="<?php echo esc_attr( $field_key ); ?>" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" value="<?php echo esc_attr( $this->get_option( $key ) ); ?>" placeholder="<?php echo esc_attr( $data['placeholder'] ); ?>" <?php disabled( $data['disabled'], true ); ?> <?php echo $this->get_custom_attribute_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_custom_attribute_html() escapes each attribute name and value. ?> />
+ <?php echo $this->get_description_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_description_html() sanitizes the description with wp_kses_post(). ?>
</fieldset>
</td>
</tr>
@@ -520,8 +520,8 @@ abstract class WC_Settings_API {
<td class="forminp">
<fieldset>
<legend class="screen-reader-text"><span><?php echo wp_kses_post( $data['title'] ); ?></span></legend>
- <input class="wc_input_price input-text regular-input <?php echo esc_attr( $data['class'] ); ?>" type="text" name="<?php echo esc_attr( $field_key ); ?>" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" value="<?php echo esc_attr( wc_format_localized_price( $this->get_option( $key ) ) ); ?>" placeholder="<?php echo esc_attr( $data['placeholder'] ); ?>" <?php disabled( $data['disabled'], true ); ?> <?php echo $this->get_custom_attribute_html( $data ); // WPCS: XSS ok. ?> />
- <?php echo $this->get_description_html( $data ); // WPCS: XSS ok. ?>
+ <input class="wc_input_price input-text regular-input <?php echo esc_attr( $data['class'] ); ?>" type="text" name="<?php echo esc_attr( $field_key ); ?>" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" value="<?php echo esc_attr( wc_format_localized_price( $this->get_option( $key ) ) ); ?>" placeholder="<?php echo esc_attr( $data['placeholder'] ); ?>" <?php disabled( $data['disabled'], true ); ?> <?php echo $this->get_custom_attribute_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_custom_attribute_html() escapes each attribute name and value. ?> />
+ <?php echo $this->get_description_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_description_html() sanitizes the description with wp_kses_post(). ?>
</fieldset>
</td>
</tr>
@@ -563,8 +563,8 @@ abstract class WC_Settings_API {
<td class="forminp">
<fieldset>
<legend class="screen-reader-text"><span><?php echo wp_kses_post( $data['title'] ); ?></span></legend>
- <input class="wc_input_decimal input-text regular-input <?php echo esc_attr( $data['class'] ); ?>" type="text" name="<?php echo esc_attr( $field_key ); ?>" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" value="<?php echo esc_attr( wc_format_localized_decimal( $this->get_option( $key ) ) ); ?>" placeholder="<?php echo esc_attr( $data['placeholder'] ); ?>" <?php disabled( $data['disabled'], true ); ?> <?php echo $this->get_custom_attribute_html( $data ); // WPCS: XSS ok. ?> />
- <?php echo $this->get_description_html( $data ); // WPCS: XSS ok. ?>
+ <input class="wc_input_decimal input-text regular-input <?php echo esc_attr( $data['class'] ); ?>" type="text" name="<?php echo esc_attr( $field_key ); ?>" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" value="<?php echo esc_attr( wc_format_localized_decimal( $this->get_option( $key ) ) ); ?>" placeholder="<?php echo esc_attr( $data['placeholder'] ); ?>" <?php disabled( $data['disabled'], true ); ?> <?php echo $this->get_custom_attribute_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_custom_attribute_html() escapes each attribute name and value. ?> />
+ <?php echo $this->get_description_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_description_html() sanitizes the description with wp_kses_post(). ?>
</fieldset>
</td>
</tr>
@@ -619,9 +619,9 @@ abstract class WC_Settings_API {
<fieldset>
<legend class="screen-reader-text"><span><?php echo wp_kses_post( $data['title'] ); ?></span></legend>
<span class="colorpickpreview" style="background:<?php echo esc_attr( $this->get_option( $key ) ); ?>;"> </span>
- <input class="colorpick <?php echo esc_attr( $data['class'] ); ?>" type="text" name="<?php echo esc_attr( $field_key ); ?>" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" value="<?php echo esc_attr( $this->get_option( $key ) ); ?>" placeholder="<?php echo esc_attr( $data['placeholder'] ); ?>" <?php disabled( $data['disabled'], true ); ?> <?php echo $this->get_custom_attribute_html( $data ); // WPCS: XSS ok. ?> />
+ <input class="colorpick <?php echo esc_attr( $data['class'] ); ?>" type="text" name="<?php echo esc_attr( $field_key ); ?>" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" value="<?php echo esc_attr( $this->get_option( $key ) ); ?>" placeholder="<?php echo esc_attr( $data['placeholder'] ); ?>" <?php disabled( $data['disabled'], true ); ?> <?php echo $this->get_custom_attribute_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_custom_attribute_html() escapes each attribute name and value. ?> />
<div id="colorPickerDiv_<?php echo esc_attr( $field_key ); ?>" class="colorpickdiv" style="z-index: 100; background: #eee; border: 1px solid #ccc; position: absolute; display: none;"></div>
- <?php echo $this->get_description_html( $data ); // WPCS: XSS ok. ?>
+ <?php echo $this->get_description_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_description_html() sanitizes the description with wp_kses_post(). ?>
</fieldset>
</td>
</tr>
@@ -663,8 +663,8 @@ abstract class WC_Settings_API {
<td class="forminp">
<fieldset>
<legend class="screen-reader-text"><span><?php echo wp_kses_post( $data['title'] ); ?></span></legend>
- <textarea rows="3" cols="20" class="input-text wide-input <?php echo esc_attr( $data['class'] ); ?>" type="<?php echo esc_attr( $data['type'] ); ?>" name="<?php echo esc_attr( $field_key ); ?>" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" placeholder="<?php echo esc_attr( $data['placeholder'] ); ?>" <?php disabled( $data['disabled'], true ); ?> <?php echo $this->get_custom_attribute_html( $data ); // WPCS: XSS ok. ?>><?php echo esc_textarea( $this->get_option( $key ) ); ?></textarea>
- <?php echo $this->get_description_html( $data ); // WPCS: XSS ok. ?>
+ <textarea rows="3" cols="20" class="input-text wide-input <?php echo esc_attr( $data['class'] ); ?>" type="<?php echo esc_attr( $data['type'] ); ?>" name="<?php echo esc_attr( $field_key ); ?>" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" placeholder="<?php echo esc_attr( $data['placeholder'] ); ?>" <?php disabled( $data['disabled'], true ); ?> <?php echo $this->get_custom_attribute_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_custom_attribute_html() escapes each attribute name and value. ?>><?php echo esc_textarea( $this->get_option( $key ) ); ?></textarea>
+ <?php echo $this->get_description_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_description_html() sanitizes the description with wp_kses_post(). ?>
</fieldset>
</td>
</tr>
@@ -711,8 +711,8 @@ abstract class WC_Settings_API {
<fieldset>
<legend class="screen-reader-text"><span><?php echo wp_kses_post( $data['title'] ); ?></span></legend>
<label for="<?php echo esc_attr( $field_key ); ?>">
- <input <?php disabled( $data['disabled'], true ); ?> class="<?php echo esc_attr( $data['class'] ); ?>" type="checkbox" name="<?php echo esc_attr( $field_key ); ?>" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" value="1" <?php checked( $this->get_option( $key ), 'yes' ); ?> <?php echo $this->get_custom_attribute_html( $data ); // WPCS: XSS ok. ?> /> <?php echo wp_kses_post( $data['label'] ); ?></label><br/>
- <?php echo $this->get_description_html( $data ); // WPCS: XSS ok. ?>
+ <input <?php disabled( $data['disabled'], true ); ?> class="<?php echo esc_attr( $data['class'] ); ?>" type="checkbox" name="<?php echo esc_attr( $field_key ); ?>" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" value="1" <?php checked( $this->get_option( $key ), 'yes' ); ?> <?php echo $this->get_custom_attribute_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_custom_attribute_html() escapes each attribute name and value. ?> /> <?php echo wp_kses_post( $data['label'] ); ?></label><br/>
+ <?php echo $this->get_description_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_description_html() sanitizes the description with wp_kses_post(). ?>
</fieldset>
</td>
</tr>
@@ -756,7 +756,7 @@ abstract class WC_Settings_API {
<td class="forminp">
<fieldset>
<legend class="screen-reader-text"><span><?php echo wp_kses_post( $data['title'] ); ?></span></legend>
- <select class="select <?php echo esc_attr( $data['class'] ); ?>" name="<?php echo esc_attr( $field_key ); ?>" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" <?php disabled( $data['disabled'], true ); ?> <?php echo $this->get_custom_attribute_html( $data ); // WPCS: XSS ok. ?>>
+ <select class="select <?php echo esc_attr( $data['class'] ); ?>" name="<?php echo esc_attr( $field_key ); ?>" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" <?php disabled( $data['disabled'], true ); ?> <?php echo $this->get_custom_attribute_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_custom_attribute_html() escapes each attribute name and value. ?>>
<?php foreach ( (array) $data['options'] as $option_key => $option_value ) : ?>
<?php if ( is_array( $option_value ) ) : ?>
<optgroup label="<?php echo esc_attr( $option_key ); ?>">
@@ -769,7 +769,7 @@ abstract class WC_Settings_API {
<?php endif; ?>
<?php endforeach; ?>
</select>
- <?php echo $this->get_description_html( $data ); // WPCS: XSS ok. ?>
+ <?php echo $this->get_description_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_description_html() sanitizes the description with wp_kses_post(). ?>
</fieldset>
</td>
</tr>
@@ -814,7 +814,7 @@ abstract class WC_Settings_API {
<td class="forminp">
<fieldset>
<legend class="screen-reader-text"><span><?php echo wp_kses_post( $data['title'] ); ?></span></legend>
- <select multiple="multiple" class="multiselect <?php echo esc_attr( $data['class'] ); ?>" name="<?php echo esc_attr( $field_key ); ?>[]" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" <?php disabled( $data['disabled'], true ); ?> <?php echo $this->get_custom_attribute_html( $data ); // WPCS: XSS ok. ?>>
+ <select multiple="multiple" class="multiselect <?php echo esc_attr( $data['class'] ); ?>" name="<?php echo esc_attr( $field_key ); ?>[]" id="<?php echo esc_attr( $field_key ); ?>" style="<?php echo esc_attr( $data['css'] ); ?>" <?php disabled( $data['disabled'], true ); ?> <?php echo $this->get_custom_attribute_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_custom_attribute_html() escapes each attribute name and value. ?>>
<?php foreach ( (array) $data['options'] as $option_key => $option_value ) : ?>
<?php if ( is_array( $option_value ) ) : ?>
<optgroup label="<?php echo esc_attr( $option_key ); ?>">
@@ -827,7 +827,7 @@ abstract class WC_Settings_API {
<?php endif; ?>
<?php endforeach; ?>
</select>
- <?php echo $this->get_description_html( $data ); // WPCS: XSS ok. ?>
+ <?php echo $this->get_description_html( $data ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_description_html() sanitizes the description with wp_kses_post(). ?>
<?php if ( $data['select_buttons'] ) : ?>
<br/><a class="select_all button" href="#"><?php esc_html_e( 'Select all', 'woocommerce' ); ?></a> <a class="select_none button" href="#"><?php esc_html_e( 'Select none', 'woocommerce' ); ?></a>
<?php endif; ?>
diff --git a/plugins/woocommerce/includes/abstracts/abstract-wc-shipping-method.php b/plugins/woocommerce/includes/abstracts/abstract-wc-shipping-method.php
index 6b621c21ce6..330ff3fa3b4 100644
--- a/plugins/woocommerce/includes/abstracts/abstract-wc-shipping-method.php
+++ b/plugins/woocommerce/includes/abstracts/abstract-wc-shipping-method.php
@@ -604,7 +604,7 @@ abstract class WC_Shipping_Method extends WC_Settings_API {
}
// Check we are processing the correct form for this instance.
- if ( ! isset( $_REQUEST['instance_id'] ) || absint( $_REQUEST['instance_id'] ) !== $this->instance_id ) { // WPCS: input var ok, CSRF ok.
+ if ( ! isset( $_REQUEST['instance_id'] ) || absint( $_REQUEST['instance_id'] ) !== $this->instance_id ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Instance ID is cast; settings save verifies capability and nonce.
return false;
}
diff --git a/plugins/woocommerce/includes/abstracts/abstract-wc-widget.php b/plugins/woocommerce/includes/abstracts/abstract-wc-widget.php
index bb7222ba4f4..4aab2cef4c8 100644
--- a/plugins/woocommerce/includes/abstracts/abstract-wc-widget.php
+++ b/plugins/woocommerce/includes/abstracts/abstract-wc-widget.php
@@ -258,7 +258,7 @@ abstract class WC_Widget extends WP_Widget {
case 'text':
?>
<p>
- <label for="<?php echo esc_attr( $this->get_field_id( $key ) ); ?>"><?php echo wp_kses_post( $setting['label'] ); ?></label><?php // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped ?>
+ <label for="<?php echo esc_attr( $this->get_field_id( $key ) ); ?>"><?php echo wp_kses_post( $setting['label'] ); ?></label>
<input class="widefat <?php echo esc_attr( $class ); ?>" id="<?php echo esc_attr( $this->get_field_id( $key ) ); ?>" name="<?php echo esc_attr( $this->get_field_name( $key ) ); ?>" type="text" value="<?php echo esc_attr( $value ); ?>" />
</p>
<?php
diff --git a/plugins/woocommerce/includes/admin/class-wc-admin-api-keys-table-list.php b/plugins/woocommerce/includes/admin/class-wc-admin-api-keys-table-list.php
index b99bf27ae21..70172c62bcc 100644
--- a/plugins/woocommerce/includes/admin/class-wc-admin-api-keys-table-list.php
+++ b/plugins/woocommerce/includes/admin/class-wc-admin-api-keys-table-list.php
@@ -212,12 +212,12 @@ class WC_Admin_API_Keys_Table_List extends WP_List_Table {
* @param string $input_id Input ID.
*/
public function search_box( $text, $input_id ) {
- if ( empty( $_REQUEST['s'] ) && ! $this->has_items() ) { // WPCS: input var okay, CSRF ok.
+ if ( empty( $_REQUEST['s'] ) && ! $this->has_items() ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only search; input is unslashed, sanitized, and SQL-escaped.
return;
}
$input_id = $input_id . '-search-input';
- $search_query = isset( $_REQUEST['s'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['s'] ) ) : ''; // WPCS: input var okay, CSRF ok.
+ $search_query = isset( $_REQUEST['s'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['s'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only search; input is unslashed, sanitized, and SQL-escaped.
echo '<p class="search-box">';
echo '<label class="screen-reader-text" for="' . esc_attr( $input_id ) . '">' . esc_html( $text ) . ':</label>';
@@ -251,8 +251,8 @@ class WC_Admin_API_Keys_Table_List extends WP_List_Table {
$search = '';
- if ( ! empty( $_REQUEST['s'] ) ) { // WPCS: input var okay, CSRF ok.
- $search = "AND description LIKE '%" . esc_sql( $wpdb->esc_like( wc_clean( wp_unslash( $_REQUEST['s'] ) ) ) ) . "%' "; // WPCS: input var okay, CSRF ok.
+ if ( ! empty( $_REQUEST['s'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only search; input is unslashed, sanitized, and SQL-escaped.
+ $search = "AND description LIKE '%" . esc_sql( $wpdb->esc_like( wc_clean( wp_unslash( $_REQUEST['s'] ) ) ) ) . "%' "; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only search; input is unslashed, sanitized, and SQL-escaped.
}
// Get the API keys.
@@ -260,9 +260,9 @@ class WC_Admin_API_Keys_Table_List extends WP_List_Table {
"SELECT key_id, user_id, description, permissions, truncated_key, last_access FROM {$wpdb->prefix}woocommerce_api_keys WHERE 1 = 1 {$search}" .
$wpdb->prepare( 'ORDER BY key_id DESC LIMIT %d OFFSET %d;', $per_page, $offset ),
ARRAY_A
- ); // WPCS: unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- The search fragment is escaped, pagination values are prepared, and the table name is trusted.
- $count = $wpdb->get_var( "SELECT COUNT(key_id) FROM {$wpdb->prefix}woocommerce_api_keys WHERE 1 = 1 {$search};" ); // WPCS: unprepared SQL ok.
+ $count = $wpdb->get_var( "SELECT COUNT(key_id) FROM {$wpdb->prefix}woocommerce_api_keys WHERE 1 = 1 {$search};" ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- The search fragment is escaped and the table name is trusted.
$this->items = $keys;
diff --git a/plugins/woocommerce/includes/admin/class-wc-admin-api-keys.php b/plugins/woocommerce/includes/admin/class-wc-admin-api-keys.php
index 29c6d127e6d..51d1ea91399 100644
--- a/plugins/woocommerce/includes/admin/class-wc-admin-api-keys.php
+++ b/plugins/woocommerce/includes/admin/class-wc-admin-api-keys.php
@@ -30,7 +30,7 @@ class WC_Admin_API_Keys {
* @return bool
*/
public function allow_save_settings( $allow ) {
- if ( ! isset( $_GET['create-key'], $_GET['edit-key'] ) ) { // WPCS: input var okay, CSRF ok.
+ if ( ! isset( $_GET['create-key'], $_GET['edit-key'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing; mutation helpers verify nonces and capabilities.
return false;
}
@@ -54,7 +54,7 @@ class WC_Admin_API_Keys {
$GLOBALS['hide_save_button'] = true;
if ( isset( $_GET['create-key'] ) || isset( $_GET['edit-key'] ) ) {
- $key_id = isset( $_GET['edit-key'] ) ? absint( $_GET['edit-key'] ) : 0; // WPCS: input var okay, CSRF ok.
+ $key_id = isset( $_GET['edit-key'] ) ? absint( $_GET['edit-key'] ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing; mutation helpers verify nonces and capabilities.
$key_data = self::get_key_data( $key_id );
$user_id = (int) $key_data['user_id'];
@@ -76,7 +76,7 @@ class WC_Admin_API_Keys {
public function screen_option() {
global $keys_table_list;
- if ( ! isset( $_GET['create-key'] ) && ! isset( $_GET['edit-key'] ) && $this->is_api_keys_settings_page() ) { // WPCS: input var okay, CSRF ok.
+ if ( ! isset( $_GET['create-key'] ) && ! isset( $_GET['edit-key'] ) && $this->is_api_keys_settings_page() ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing; mutation helpers verify nonces and capabilities.
$keys_table_list = new WC_Admin_API_Keys_Table_List();
// Add screen option.
@@ -166,12 +166,12 @@ class WC_Admin_API_Keys {
public function actions() {
if ( $this->is_api_keys_settings_page() ) {
// Revoke key.
- if ( isset( $_REQUEST['revoke-key'] ) ) { // WPCS: input var okay, CSRF ok.
+ if ( isset( $_REQUEST['revoke-key'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing; mutation helpers verify nonces and capabilities.
$this->revoke_key();
}
// Bulk actions.
- if ( isset( $_REQUEST['action'] ) && isset( $_REQUEST['key'] ) ) { // WPCS: input var okay, CSRF ok.
+ if ( isset( $_REQUEST['action'] ) && isset( $_REQUEST['key'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing; mutation helpers verify nonces and capabilities.
$this->bulk_actions();
}
}
@@ -181,8 +181,8 @@ class WC_Admin_API_Keys {
* Notices.
*/
public static function notices() {
- if ( isset( $_GET['revoked'] ) ) { // WPCS: input var okay, CSRF ok.
- $revoked = absint( $_GET['revoked'] ); // WPCS: input var okay, CSRF ok.
+ if ( isset( $_GET['revoked'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing; mutation helpers verify nonces and capabilities.
+ $revoked = absint( $_GET['revoked'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing; mutation helpers verify nonces and capabilities.
/* translators: %d: count */
WC_Admin_Settings::add_message( sprintf( _n( '%d API key permanently revoked.', '%d API keys permanently revoked.', $revoked, 'woocommerce' ), $revoked ) );
@@ -197,8 +197,8 @@ class WC_Admin_API_Keys {
check_admin_referer( 'revoke' );
- if ( isset( $_REQUEST['revoke-key'] ) ) { // WPCS: input var okay, CSRF ok.
- $key_id = absint( $_REQUEST['revoke-key'] ); // WPCS: input var okay, CSRF ok.
+ if ( isset( $_REQUEST['revoke-key'] ) ) {
+ $key_id = absint( $_REQUEST['revoke-key'] );
$user_id = (int) $wpdb->get_var( $wpdb->prepare( "SELECT user_id FROM {$wpdb->prefix}woocommerce_api_keys WHERE key_id = %d", $key_id ) );
if ( $key_id && $user_id && ( current_user_can( 'edit_user', $user_id ) || get_current_user_id() === $user_id ) ) {
@@ -222,9 +222,9 @@ class WC_Admin_API_Keys {
wp_die( esc_html__( 'You do not have permission to edit API Keys', 'woocommerce' ) );
}
- if ( isset( $_REQUEST['action'] ) ) { // WPCS: input var okay, CSRF ok.
- $action = sanitize_text_field( wp_unslash( $_REQUEST['action'] ) ); // WPCS: input var okay, CSRF ok.
- $keys = isset( $_REQUEST['key'] ) ? array_map( 'absint', (array) $_REQUEST['key'] ) : array(); // WPCS: input var okay, CSRF ok.
+ if ( isset( $_REQUEST['action'] ) ) {
+ $action = sanitize_text_field( wp_unslash( $_REQUEST['action'] ) );
+ $keys = isset( $_REQUEST['key'] ) ? array_map( 'absint', (array) $_REQUEST['key'] ) : array();
if ( 'revoke' === $action ) {
$this->bulk_revoke_key( $keys );
diff --git a/plugins/woocommerce/includes/admin/class-wc-admin-attributes.php b/plugins/woocommerce/includes/admin/class-wc-admin-attributes.php
index 5670e73ef24..95f24934d15 100644
--- a/plugins/woocommerce/includes/admin/class-wc-admin-attributes.php
+++ b/plugins/woocommerce/includes/admin/class-wc-admin-attributes.php
@@ -36,11 +36,11 @@ class WC_Admin_Attributes {
$action = '';
// Action to perform: add, edit, delete or none.
- if ( ! empty( $_POST['add_new_attribute'] ) ) { // WPCS: CSRF ok.
+ if ( ! empty( $_POST['add_new_attribute'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Action helpers verify nonces; fields are normalized before CRUD.
$action = 'add';
- } elseif ( ! empty( $_POST['save_attribute'] ) && ! empty( $_GET['edit'] ) ) { // WPCS: CSRF ok.
+ } elseif ( ! empty( $_POST['save_attribute'] ) && ! empty( $_GET['edit'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended -- Action helpers verify nonces; fields are normalized before CRUD.
$action = 'edit';
- } elseif ( ! empty( $_GET['delete'] ) ) {
+ } elseif ( ! empty( $_GET['delete'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Action helpers verify nonces; fields are normalized before CRUD.
$action = 'delete';
}
@@ -75,11 +75,11 @@ class WC_Admin_Attributes {
*/
private static function get_posted_attribute() {
$attribute = array(
- 'attribute_label' => isset( $_POST['attribute_label'] ) ? wc_clean( wp_unslash( $_POST['attribute_label'] ) ) : '', // WPCS: input var ok, CSRF ok.
- 'attribute_name' => isset( $_POST['attribute_name'] ) ? wc_sanitize_taxonomy_name( wp_unslash( $_POST['attribute_name'] ) ) : '', // WPCS: input var ok, CSRF ok, sanitization ok.
- 'attribute_type' => isset( $_POST['attribute_type'] ) ? wc_clean( wp_unslash( $_POST['attribute_type'] ) ) : 'select', // WPCS: input var ok, CSRF ok.
- 'attribute_orderby' => isset( $_POST['attribute_orderby'] ) ? wc_clean( wp_unslash( $_POST['attribute_orderby'] ) ) : '', // WPCS: input var ok, CSRF ok.
- 'attribute_public' => isset( $_POST['attribute_public'] ) ? 1 : 0, // WPCS: input var ok, CSRF ok.
+ 'attribute_label' => isset( $_POST['attribute_label'] ) ? wc_clean( wp_unslash( $_POST['attribute_label'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Action helpers verify nonces; fields are normalized before CRUD.
+ 'attribute_name' => isset( $_POST['attribute_name'] ) ? wc_sanitize_taxonomy_name( wp_unslash( $_POST['attribute_name'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Action helpers verify nonces; fields are normalized before CRUD.
+ 'attribute_type' => isset( $_POST['attribute_type'] ) ? wc_clean( wp_unslash( $_POST['attribute_type'] ) ) : 'select', // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Action helpers verify nonces; fields are normalized before CRUD.
+ 'attribute_orderby' => isset( $_POST['attribute_orderby'] ) ? wc_clean( wp_unslash( $_POST['attribute_orderby'] ) ) : '', // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Action helpers verify nonces; fields are normalized before CRUD.
+ 'attribute_public' => isset( $_POST['attribute_public'] ) ? 1 : 0, // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Action helpers verify nonces; fields are normalized before CRUD.
);
if ( empty( $attribute['attribute_type'] ) ) {
diff --git a/plugins/woocommerce/includes/admin/class-wc-admin-exporters.php b/plugins/woocommerce/includes/admin/class-wc-admin-exporters.php
index d86331d5d15..da8186d8371 100644
--- a/plugins/woocommerce/includes/admin/class-wc-admin-exporters.php
+++ b/plugins/woocommerce/includes/admin/class-wc-admin-exporters.php
@@ -125,12 +125,12 @@ class WC_Admin_Exporters {
* Serve the generated file.
*/
public function download_export_file() {
- if ( isset( $_GET['action'], $_GET['nonce'] ) && wp_verify_nonce( wp_unslash( $_GET['nonce'] ), 'product-csv' ) && 'download_product_csv' === wp_unslash( $_GET['action'] ) ) { // WPCS: input var ok, sanitization ok.
+ if ( isset( $_GET['action'], $_GET['nonce'] ) && wp_verify_nonce( wp_unslash( $_GET['nonce'] ), 'product-csv' ) && 'download_product_csv' === wp_unslash( $_GET['action'] ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- AJAX verifies nonce/capability; exporter setters sanitize values.
include_once WC_ABSPATH . 'includes/export/class-wc-product-csv-exporter.php';
$exporter = new WC_Product_CSV_Exporter();
- if ( ! empty( $_GET['filename'] ) ) { // WPCS: input var ok.
- $exporter->set_filename( wp_unslash( $_GET['filename'] ) ); // WPCS: input var ok, sanitization ok.
+ if ( ! empty( $_GET['filename'] ) ) {
+ $exporter->set_filename( wp_unslash( $_GET['filename'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- AJAX verifies nonce/capability; exporter setters sanitize values.
}
$exporter->export();
@@ -149,40 +149,40 @@ class WC_Admin_Exporters {
include_once WC_ABSPATH . 'includes/export/class-wc-product-csv-exporter.php';
- $step = isset( $_POST['step'] ) ? absint( $_POST['step'] ) : 1; // WPCS: input var ok, sanitization ok.
+ $step = isset( $_POST['step'] ) ? absint( $_POST['step'] ) : 1;
$exporter = new WC_Product_CSV_Exporter();
- if ( ! empty( $_POST['columns'] ) ) { // WPCS: input var ok.
- $exporter->set_column_names( wp_unslash( $_POST['columns'] ) ); // WPCS: input var ok, sanitization ok.
+ if ( ! empty( $_POST['columns'] ) ) {
+ $exporter->set_column_names( wp_unslash( $_POST['columns'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- AJAX verifies nonce/capability; exporter setters sanitize values.
}
- if ( ! empty( $_POST['selected_columns'] ) ) { // WPCS: input var ok.
- $exporter->set_columns_to_export( wp_unslash( $_POST['selected_columns'] ) ); // WPCS: input var ok, sanitization ok.
+ if ( ! empty( $_POST['selected_columns'] ) ) {
+ $exporter->set_columns_to_export( wp_unslash( $_POST['selected_columns'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- AJAX verifies nonce/capability; exporter setters sanitize values.
}
- if ( ! empty( $_POST['export_meta'] ) ) { // WPCS: input var ok.
+ if ( ! empty( $_POST['export_meta'] ) ) {
$exporter->enable_meta_export( true );
}
- if ( ! empty( $_POST['export_types'] ) ) { // WPCS: input var ok.
- $exporter->set_product_types_to_export( wp_unslash( $_POST['export_types'] ) ); // WPCS: input var ok, sanitization ok.
+ if ( ! empty( $_POST['export_types'] ) ) {
+ $exporter->set_product_types_to_export( wp_unslash( $_POST['export_types'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- AJAX verifies nonce/capability; exporter setters sanitize values.
}
- if ( ! empty( $_POST['export_category'] ) && is_array( $_POST['export_category'] ) ) {// WPCS: input var ok.
- $exporter->set_product_category_to_export( wp_unslash( array_values( $_POST['export_category'] ) ) ); // WPCS: input var ok, sanitization ok.
+ if ( ! empty( $_POST['export_category'] ) && is_array( $_POST['export_category'] ) ) {
+ $exporter->set_product_category_to_export( wp_unslash( array_values( $_POST['export_category'] ) ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- AJAX verifies nonce/capability; exporter setters sanitize values.
}
// Set specific product IDs if provided.
- if ( ! empty( $_POST['export_product_ids'] ) ) { // WPCS: input var ok.
- $ids_raw = explode( ',', sanitize_text_field( wp_unslash( $_POST['export_product_ids'] ) ) ); // WPCS: input var ok, sanitization ok.
+ if ( ! empty( $_POST['export_product_ids'] ) ) {
+ $ids_raw = explode( ',', sanitize_text_field( wp_unslash( $_POST['export_product_ids'] ) ) );
if ( ! empty( $ids_raw ) ) {
$exporter->set_product_ids_to_export( $ids_raw );
}
}
- if ( ! empty( $_POST['filename'] ) ) { // WPCS: input var ok.
- $exporter->set_filename( wp_unslash( $_POST['filename'] ) ); // WPCS: input var ok, sanitization ok.
+ if ( ! empty( $_POST['filename'] ) ) {
+ $exporter->set_filename( wp_unslash( $_POST['filename'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- AJAX verifies nonce/capability; exporter setters sanitize values.
}
$exporter->set_page( $step );
diff --git a/plugins/woocommerce/includes/admin/class-wc-admin-menus.php b/plugins/woocommerce/includes/admin/class-wc-admin-menus.php
index c0ec14282c4..5fb6a9f545c 100644
--- a/plugins/woocommerce/includes/admin/class-wc-admin-menus.php
+++ b/plugins/woocommerce/includes/admin/class-wc-admin-menus.php
@@ -89,7 +89,7 @@ class WC_Admin_Menus {
$woocommerce_icon = 'data:image/svg+xml;base64,PHN2ZyB2ZXJzaW9uPSIxLjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgdmlld0JveD0iMCAwIDg1LjkgNDcuNiI+CjxwYXRoIGZpbGw9IiNhMmFhYjIiIGQ9Ik03Ny40LDAuMWMtNC4zLDAtNy4xLDEuNC05LjYsNi4xTDU2LjQsMjcuN1Y4LjZjMC01LjctMi43LTguNS03LjctOC41cy03LjEsMS43LTkuNiw2LjVMMjguMywyNy43VjguOAoJYzAtNi4xLTIuNS04LjctOC42LTguN0g3LjNDMi42LDAuMSwwLDIuMywwLDYuM3MyLjUsNi40LDcuMSw2LjRoNS4xdjI0LjFjMCw2LjgsNC42LDEwLjgsMTEuMiwxMC44UzMzLDQ1LDM2LjMsMzguOWw3LjItMTMuNXYxMS40CgljMCw2LjcsNC40LDEwLjgsMTEuMSwxMC44czkuMi0yLjMsMTMtOC43bDE2LjYtMjhjMy42LTYuMSwxLjEtMTAuOC02LjktMTAuOEM3Ny4zLDAuMSw3Ny4zLDAuMSw3Ny40LDAuMXoiLz4KPC9zdmc+Cg==';
if ( self::can_view_woocommerce_menu_item() ) {
- $menu[] = array( '', 'read', 'separator-woocommerce', '', 'wp-menu-separator woocommerce' ); // WPCS: override ok.
+ $menu[] = array( '', 'read', 'separator-woocommerce', '', 'wp-menu-separator woocommerce' ); // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- WordPress uses the $menu global for admin menu registration.
}
add_menu_page( __( 'WooCommerce', 'woocommerce' ), __( 'WooCommerce', 'woocommerce' ), 'edit_others_shop_orders', 'woocommerce', null, $woocommerce_icon, '55.5' );
@@ -154,12 +154,12 @@ class WC_Admin_Menus {
WC_Admin_Settings::get_settings_pages();
// Add any posted messages.
- if ( ! empty( $_GET['wc_error'] ) ) { // WPCS: input var okay, CSRF ok.
- WC_Admin_Settings::add_error( wp_kses_post( wp_unslash( $_GET['wc_error'] ) ) ); // WPCS: input var okay, CSRF ok.
+ if ( ! empty( $_GET['wc_error'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only selector; settings mutations verify capability and nonce.
+ WC_Admin_Settings::add_error( wp_kses_post( wp_unslash( $_GET['wc_error'] ) ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only selector; settings mutations verify capability and nonce.
}
- if ( ! empty( $_GET['wc_message'] ) ) { // WPCS: input var okay, CSRF ok.
- WC_Admin_Settings::add_message( wp_kses_post( wp_unslash( $_GET['wc_message'] ) ) ); // WPCS: input var okay, CSRF ok.
+ if ( ! empty( $_GET['wc_message'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only selector; settings mutations verify capability and nonce.
+ WC_Admin_Settings::add_message( wp_kses_post( wp_unslash( $_GET['wc_message'] ) ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only selector; settings mutations verify capability and nonce.
}
do_action( 'woocommerce_settings_page_init' );
@@ -182,8 +182,8 @@ class WC_Admin_Menus {
WC_Admin_Settings::get_settings_pages();
// Get current tab/section.
- $current_tab = empty( $_GET['tab'] ) ? 'general' : sanitize_title( wp_unslash( $_GET['tab'] ) ); // WPCS: input var okay, CSRF ok.
- $current_section = empty( $_REQUEST['section'] ) ? '' : sanitize_title( wp_unslash( $_REQUEST['section'] ) ); // WPCS: input var okay, CSRF ok.
+ $current_tab = empty( $_GET['tab'] ) ? 'general' : sanitize_title( wp_unslash( $_GET['tab'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only selector; settings mutations verify capability and nonce.
+ $current_section = empty( $_REQUEST['section'] ) ? '' : sanitize_title( wp_unslash( $_REQUEST['section'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only selector; settings mutations verify capability and nonce.
// Save settings if data has been posted.
if ( '' !== $current_section && apply_filters( "woocommerce_save_settings_{$current_tab}_{$current_section}", ! empty( $_POST['save'] ) ) ) { // WPCS: input var okay, CSRF ok.
@@ -252,13 +252,13 @@ class WC_Admin_Menus {
switch ( $post_type ) {
case 'shop_order':
case 'shop_coupon':
- $parent_file = 'woocommerce'; // WPCS: override ok.
+ $parent_file = 'woocommerce'; // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- WordPress uses $parent_file to control admin menu highlighting.
break;
case 'product':
$screen = get_current_screen();
if ( $screen && taxonomy_is_product_attribute( $screen->taxonomy ) ) {
- $submenu_file = 'product_attributes'; // WPCS: override ok.
- $parent_file = 'edit.php?post_type=product'; // WPCS: override ok.
+ $submenu_file = 'product_attributes'; // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- $submenu_file is a WordPress admin menu routing global.
+ $parent_file = 'edit.php?post_type=product'; // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- $parent_file is a WordPress admin menu routing global.
}
break;
}
diff --git a/plugins/woocommerce/includes/admin/class-wc-admin-permalink-settings.php b/plugins/woocommerce/includes/admin/class-wc-admin-permalink-settings.php
index 04f4ddbd14f..536f3584876 100644
--- a/plugins/woocommerce/includes/admin/class-wc-admin-permalink-settings.php
+++ b/plugins/woocommerce/includes/admin/class-wc-admin-permalink-settings.php
@@ -170,20 +170,20 @@ class WC_Admin_Permalink_Settings {
}
// We need to save the options ourselves; settings api does not trigger save for the permalinks page.
- if ( isset( $_POST['permalink_structure'], $_POST['wc-permalinks-nonce'], $_POST['woocommerce_product_category_slug'], $_POST['woocommerce_product_tag_slug'], $_POST['woocommerce_product_attribute_slug'] ) && wp_verify_nonce( wp_unslash( $_POST['wc-permalinks-nonce'] ), 'wc-permalinks' ) ) { // WPCS: input var ok, sanitization ok.
+ if ( isset( $_POST['permalink_structure'], $_POST['wc-permalinks-nonce'], $_POST['woocommerce_product_category_slug'], $_POST['woocommerce_product_tag_slug'], $_POST['woocommerce_product_attribute_slug'] ) && wp_verify_nonce( wp_unslash( $_POST['wc-permalinks-nonce'] ), 'wc-permalinks' ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Nonce is verified; permalink tokens require domain-specific cleaning.
wc_switch_to_site_locale();
$permalinks = (array) get_option( 'woocommerce_permalinks', array() );
- $permalinks['category_base'] = wc_sanitize_permalink( wp_unslash( $_POST['woocommerce_product_category_slug'] ) ); // WPCS: input var ok, sanitization ok.
- $permalinks['tag_base'] = wc_sanitize_permalink( wp_unslash( $_POST['woocommerce_product_tag_slug'] ) ); // WPCS: input var ok, sanitization ok.
- $permalinks['attribute_base'] = wc_sanitize_permalink( wp_unslash( $_POST['woocommerce_product_attribute_slug'] ) ); // WPCS: input var ok, sanitization ok.
+ $permalinks['category_base'] = wc_sanitize_permalink( wp_unslash( $_POST['woocommerce_product_category_slug'] ) );
+ $permalinks['tag_base'] = wc_sanitize_permalink( wp_unslash( $_POST['woocommerce_product_tag_slug'] ) );
+ $permalinks['attribute_base'] = wc_sanitize_permalink( wp_unslash( $_POST['woocommerce_product_attribute_slug'] ) );
// Generate product base.
- $product_base = isset( $_POST['product_permalink'] ) ? wc_clean( wp_unslash( $_POST['product_permalink'] ) ) : ''; // WPCS: input var ok, sanitization ok.
+ $product_base = isset( $_POST['product_permalink'] ) ? wc_clean( wp_unslash( $_POST['product_permalink'] ) ) : '';
if ( 'custom' === $product_base ) {
- if ( isset( $_POST['product_permalink_structure'] ) ) { // WPCS: input var ok.
- $product_base = preg_replace( '#/+#', '/', '/' . str_replace( '#', '', trim( wp_unslash( $_POST['product_permalink_structure'] ) ) ) ); // WPCS: input var ok, sanitization ok.
+ if ( isset( $_POST['product_permalink_structure'] ) ) {
+ $product_base = preg_replace( '#/+#', '/', '/' . str_replace( '#', '', trim( wp_unslash( $_POST['product_permalink_structure'] ) ) ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Nonce is verified; permalink tokens require domain-specific cleaning.
} else {
$product_base = '/';
}
diff --git a/plugins/woocommerce/includes/admin/class-wc-admin-post-types.php b/plugins/woocommerce/includes/admin/class-wc-admin-post-types.php
index 21fde9f9e92..da241ff9462 100644
--- a/plugins/woocommerce/includes/admin/class-wc-admin-post-types.php
+++ b/plugins/woocommerce/includes/admin/class-wc-admin-post-types.php
@@ -378,7 +378,7 @@ class WC_Admin_Post_Types {
// Get the product and save.
$product = wc_get_product( $post );
- if ( ! empty( $request_data['woocommerce_quick_edit'] ) ) { // WPCS: input var ok.
+ if ( ! empty( $request_data['woocommerce_quick_edit'] ) ) {
$this->quick_edit_save( $post_id, $product );
} else {
$this->bulk_edit_save( $post_id, $product );
diff --git a/plugins/woocommerce/includes/admin/class-wc-admin-settings.php b/plugins/woocommerce/includes/admin/class-wc-admin-settings.php
index 87880c9e9fa..a4299f990df 100644
--- a/plugins/woocommerce/includes/admin/class-wc-admin-settings.php
+++ b/plugins/woocommerce/includes/admin/class-wc-admin-settings.php
@@ -397,8 +397,8 @@ if ( ! class_exists( 'WC_Admin_Settings', false ) ) :
value="<?php echo esc_attr( $option_value ); ?>"
class="<?php echo esc_attr( $value['class'] ); ?>"
placeholder="<?php echo esc_attr( $value['placeholder'] ); ?>"
- <?php echo implode( ' ', $custom_attributes ); // WPCS: XSS ok. ?>
- /><?php echo esc_html( $value['suffix'] ); ?> <?php echo $description; // WPCS: XSS ok. ?>
+ <?php echo implode( ' ', $custom_attributes ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $custom_attributes values are individually escaped before concatenation. ?>
+ /><?php echo esc_html( $value['suffix'] ); ?> <?php echo $description; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $description is sanitized with wp_kses_post(). ?>
</td>
</tr>
<?php
@@ -424,8 +424,8 @@ if ( ! class_exists( 'WC_Admin_Settings', false ) ) :
value="<?php echo esc_attr( $option_value ); ?>"
class="<?php echo esc_attr( $value['class'] ); ?>colorpick"
placeholder="<?php echo esc_attr( $value['placeholder'] ); ?>"
- <?php echo implode( ' ', $custom_attributes ); // WPCS: XSS ok. ?>
- />‎ <?php echo $description; // WPCS: XSS ok. ?>
+ <?php echo implode( ' ', $custom_attributes ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $custom_attributes values are individually escaped before concatenation. ?>
+ />‎ <?php echo $description; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $description is sanitized with wp_kses_post(). ?>
<div id="colorPickerDiv_<?php echo esc_attr( $value['id'] ); ?>" class="colorpickdiv" style="z-index: 100;background:#eee;border:1px solid #ccc;position:absolute;display:none;"></div>
</td>
</tr>
@@ -454,8 +454,8 @@ if ( ! class_exists( 'WC_Admin_Settings', false ) ) :
style="<?php echo esc_attr( $value['css'] ); ?>"
class="<?php echo esc_attr( $value['class'] ); ?>"
placeholder="<?php echo esc_attr( $value['placeholder'] ); ?>"
- <?php echo implode( ' ', $custom_attributes ); // WPCS: XSS ok. ?>
- ><?php echo esc_textarea( $option_value ); // WPCS: XSS ok. ?></textarea>
+ <?php echo implode( ' ', $custom_attributes ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $custom_attributes values are individually escaped before concatenation. ?>
+ ><?php echo esc_textarea( $option_value ); ?></textarea>
<?php
if ( $show_desc_at_end ) {
echo wp_kses_post( $description );
@@ -482,7 +482,7 @@ if ( ! class_exists( 'WC_Admin_Settings', false ) ) :
id="<?php echo esc_attr( $value['id'] ); ?>"
style="<?php echo esc_attr( $value['css'] ); ?>"
class="<?php echo esc_attr( $value['class'] ); ?>"
- <?php echo implode( ' ', $custom_attributes ); // WPCS: XSS ok. ?>
+ <?php echo implode( ' ', $custom_attributes ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $custom_attributes values are individually escaped before concatenation. ?>
<?php echo 'multiselect' === $value['type'] ? 'multiple="multiple"' : ''; ?>
>
<?php
@@ -502,7 +502,7 @@ if ( ! class_exists( 'WC_Admin_Settings', false ) ) :
<?php
}
?>
- </select> <?php echo $description; // WPCS: XSS ok. ?>
+ </select> <?php echo $description; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $description is sanitized with wp_kses_post(). ?>
</td>
</tr>
<?php
@@ -550,7 +550,7 @@ if ( ! class_exists( 'WC_Admin_Settings', false ) ) :
?>
style="<?php echo esc_attr( $value['css'] ); ?>"
class="<?php echo esc_attr( $value['class'] ); ?>"
- <?php echo implode( ' ', $custom_attributes ); // WPCS: XSS ok. ?>
+ <?php echo implode( ' ', $custom_attributes ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $custom_attributes values are individually escaped before concatenation. ?>
<?php checked( $key, $option_value ); ?>
/> <?php echo esc_html( $val ); ?></label>
</li>
@@ -636,8 +636,8 @@ if ( ! class_exists( 'WC_Admin_Settings', false ) ) :
class="<?php echo esc_attr( isset( $value['class'] ) ? $value['class'] : '' ); ?>"
value="1"
<?php checked( $option_value, 'yes' ); ?>
- <?php echo implode( ' ', $custom_attributes ); // WPCS: XSS ok. ?>
- /> <?php echo $description; // WPCS: XSS ok. ?>
+ <?php echo implode( ' ', $custom_attributes ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $custom_attributes values are individually escaped before concatenation. ?>
+ /> <?php echo $description; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $description is sanitized with wp_kses_post(). ?>
</label> <?php echo $tooltip_html; // WPCS: XSS ok. ?>
<?php
@@ -676,9 +676,9 @@ if ( ! class_exists( 'WC_Admin_Settings', false ) ) :
</th>
<td class="forminp image_width_settings">
- <input name="<?php echo esc_attr( $value['field_name'] ); ?>[width]" <?php echo $disabled_attr; // WPCS: XSS ok. ?> id="<?php echo esc_attr( $value['id'] ); ?>-width" type="text" size="3" value="<?php echo esc_attr( $width ); ?>" /> × <input name="<?php echo esc_attr( $value['id'] ); ?>[height]" <?php echo $disabled_attr; // WPCS: XSS ok. ?> id="<?php echo esc_attr( $value['id'] ); ?>-height" type="text" size="3" value="<?php echo esc_attr( $height ); ?>" />px
+ <input name="<?php echo esc_attr( $value['field_name'] ); ?>[width]" <?php echo $disabled_attr; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $disabled_attr is either empty or the fixed disabled attribute. ?> id="<?php echo esc_attr( $value['id'] ); ?>-width" type="text" size="3" value="<?php echo esc_attr( $width ); ?>" /> × <input name="<?php echo esc_attr( $value['id'] ); ?>[height]" <?php echo $disabled_attr; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $disabled_attr is either empty or the fixed disabled attribute. ?> id="<?php echo esc_attr( $value['id'] ); ?>-height" type="text" size="3" value="<?php echo esc_attr( $height ); ?>" />px
- <label><input name="<?php echo esc_attr( $value['field_name'] ); ?>[crop]" <?php echo $disabled_attr; // WPCS: XSS ok. ?> id="<?php echo esc_attr( $value['id'] ); ?>-crop" type="checkbox" value="1" <?php checked( 1, $crop ); ?> /> <?php esc_html_e( 'Hard crop?', 'woocommerce' ); ?></label>
+ <label><input name="<?php echo esc_attr( $value['field_name'] ); ?>[crop]" <?php echo $disabled_attr; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $disabled_attr is either empty or the fixed disabled attribute. ?> id="<?php echo esc_attr( $value['id'] ); ?>-crop" type="checkbox" value="1" <?php checked( 1, $crop ); ?> /> <?php esc_html_e( 'Hard crop?', 'woocommerce' ); ?></label>
</td>
</tr>
@@ -775,7 +775,7 @@ if ( ! class_exists( 'WC_Admin_Settings', false ) ) :
</th>
<td class="forminp"><select name="<?php echo esc_attr( $value['field_name'] ); ?>" id="<?php echo esc_attr( $value['id'] ); ?>" style="<?php echo esc_attr( $value['css'] ); ?>" data-placeholder="<?php esc_attr_e( 'Choose a country / region…', 'woocommerce' ); ?>" aria-label="<?php esc_attr_e( 'Country / Region', 'woocommerce' ); ?>" class="wc-enhanced-select">
<?php WC()->countries->country_dropdown_options( $country, $state ); ?>
- </select> <?php echo $description; // WPCS: XSS ok. ?>
+ </select> <?php echo $description; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $description is sanitized with wp_kses_post(). ?>
</td>
</tr>
<?php
@@ -809,11 +809,11 @@ if ( ! class_exists( 'WC_Admin_Settings', false ) ) :
<?php
if ( ! empty( $countries ) ) {
foreach ( $countries as $key => $val ) {
- echo '<option value="' . esc_attr( $key ) . '"' . wc_selected( $key, $selections ) . '>' . esc_html( $val ) . '</option>'; // WPCS: XSS ok.
+ echo '<option value="' . esc_attr( $key ) . '"' . wc_selected( $key, $selections ) . '>' . esc_html( $val ) . '</option>';
}
}
?>
- </select> <?php echo ( $description ) ? $description : ''; // WPCS: XSS ok. ?> <br /><a class="select_all button" href="#"><?php esc_html_e( 'Select all', 'woocommerce' ); ?></a> <a class="select_none button" href="#"><?php esc_html_e( 'Select none', 'woocommerce' ); ?></a>
+ </select> <?php echo ( $description ) ? $description : ''; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $description is sanitized with wp_kses_post(). ?> <br /><a class="select_all button" href="#"><?php esc_html_e( 'Select all', 'woocommerce' ); ?></a> <a class="select_none button" href="#"><?php esc_html_e( 'Select none', 'woocommerce' ); ?></a>
</td>
</tr>
<?php
@@ -844,7 +844,7 @@ if ( ! class_exists( 'WC_Admin_Settings', false ) ) :
placeholder="<?php echo esc_attr( $value['placeholder'] ); ?>"
step="1"
min="1"
- <?php echo implode( ' ', $custom_attributes ); // WPCS: XSS ok. ?>
+ <?php echo implode( ' ', $custom_attributes ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $custom_attributes values are individually escaped before concatenation. ?>
/>
<select name="<?php echo esc_attr( $value['field_name'] ); ?>[unit]" style="width: auto;">
<?php
@@ -852,7 +852,7 @@ if ( ! class_exists( 'WC_Admin_Settings', false ) ) :
echo '<option value="' . esc_attr( $value ) . '"' . selected( $option_value['unit'], $value, false ) . '>' . esc_html( $label ) . '</option>';
}
?>
- </select> <?php echo ( $description ) ? $description : ''; // WPCS: XSS ok. ?>
+ </select> <?php echo ( $description ) ? $description : ''; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $description is sanitized with wp_kses_post(). ?>
</td>
</tr>
<?php
diff --git a/plugins/woocommerce/includes/admin/class-wc-admin-setup-wizard.php b/plugins/woocommerce/includes/admin/class-wc-admin-setup-wizard.php
index ba16e7657da..0285cdeb38b 100644
--- a/plugins/woocommerce/includes/admin/class-wc-admin-setup-wizard.php
+++ b/plugins/woocommerce/includes/admin/class-wc-admin-setup-wizard.php
@@ -223,7 +223,7 @@ class WC_Admin_Setup_Wizard {
*/
public function setup_wizard() {
_deprecated_function( __CLASS__ . '::' . __FUNCTION__, '4.6.0', 'Onboarding is maintained in WooCommerce Admin.' );
- if ( empty( $_GET['page'] ) || 'wc-setup' !== $_GET['page'] ) { // WPCS: CSRF ok, input var ok.
+ if ( empty( $_GET['page'] ) || 'wc-setup' !== $_GET['page'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing; step is constrained with sanitize_key().
return;
}
$default_steps = array(
@@ -285,7 +285,7 @@ class WC_Admin_Setup_Wizard {
}
$this->steps = apply_filters( 'woocommerce_setup_wizard_steps', $default_steps );
- $this->step = isset( $_GET['step'] ) ? sanitize_key( $_GET['step'] ) : current( array_keys( $this->steps ) ); // WPCS: CSRF ok, input var ok.
+ $this->step = isset( $_GET['step'] ) ? sanitize_key( $_GET['step'] ) : current( array_keys( $this->steps ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing; step is constrained with sanitize_key().
// @codingStandardsIgnoreStart
if ( ! empty( $_POST['save_step'] ) && isset( $this->steps[ $this->step ]['handler'] ) ) {
diff --git a/plugins/woocommerce/includes/admin/class-wc-admin-status.php b/plugins/woocommerce/includes/admin/class-wc-admin-status.php
index fd5a9b81b00..3005212cc46 100644
--- a/plugins/woocommerce/includes/admin/class-wc-admin-status.php
+++ b/plugins/woocommerce/includes/admin/class-wc-admin-status.php
@@ -52,9 +52,9 @@ class WC_Admin_Status {
$tools = self::get_tools();
$tool_requires_refresh = false;
- if ( ! empty( $_GET['action'] ) && ! empty( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( wp_unslash( $_REQUEST['_wpnonce'] ), 'debug_action' ) ) { // WPCS: input var ok, sanitization ok.
+ if ( ! empty( $_GET['action'] ) && ! empty( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( wp_unslash( $_REQUEST['_wpnonce'] ), 'debug_action' ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Tools are allowlisted and nonce-protected; log handles are sanitized and confined.
$tools_controller = new WC_REST_System_Status_Tools_Controller();
- $action = wc_clean( wp_unslash( $_GET['action'] ) ); // WPCS: input var ok.
+ $action = wc_clean( wp_unslash( $_GET['action'] ) );
if ( array_key_exists( $action, $tools ) ) {
$response = $tools_controller->execute_tool( $action );
@@ -91,7 +91,7 @@ class WC_Admin_Status {
}
// Display message if settings settings have been saved.
- if ( isset( $_REQUEST['settings-updated'] ) ) { // WPCS: input var ok.
+ if ( isset( $_REQUEST['settings-updated'] ) ) {
echo '<div class="updated inline"><p>' . esc_html__( 'Your changes have been saved.', 'woocommerce' ) . '</p></div>';
}
@@ -125,15 +125,15 @@ class WC_Admin_Status {
public static function status_logs_file() {
$logs = self::scan_log_files();
- if ( ! empty( $_REQUEST['log_file'] ) && isset( $logs[ sanitize_title( wp_unslash( $_REQUEST['log_file'] ) ) ] ) ) { // WPCS: input var ok, CSRF ok.
- $viewed_log = $logs[ sanitize_title( wp_unslash( $_REQUEST['log_file'] ) ) ]; // WPCS: input var ok, CSRF ok.
+ if ( ! empty( $_REQUEST['log_file'] ) && isset( $logs[ sanitize_title( wp_unslash( $_REQUEST['log_file'] ) ) ] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Tools are allowlisted and nonce-protected; log handles are sanitized and confined.
+ $viewed_log = $logs[ sanitize_title( wp_unslash( $_REQUEST['log_file'] ) ) ]; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Tools are allowlisted and nonce-protected; log handles are sanitized and confined.
} elseif ( ! empty( $logs ) ) {
$viewed_log = current( $logs );
}
$handle = ! empty( $viewed_log ) ? self::get_log_file_handle( $viewed_log ) : '';
- if ( ! empty( $_REQUEST['handle'] ) ) { // WPCS: input var ok, CSRF ok.
+ if ( ! empty( $_REQUEST['handle'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Tools are allowlisted and nonce-protected; log handles are sanitized and confined.
self::remove_log();
}
@@ -306,13 +306,13 @@ class WC_Admin_Status {
* Remove/delete the chosen file.
*/
public static function remove_log() {
- if ( empty( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( wp_unslash( $_REQUEST['_wpnonce'] ), 'remove_log' ) ) { // WPCS: input var ok, sanitization ok.
+ if ( empty( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( wp_unslash( $_REQUEST['_wpnonce'] ), 'remove_log' ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Tools are allowlisted and nonce-protected; log handles are sanitized and confined.
wp_die( esc_html__( 'Action failed. Please refresh the page and retry.', 'woocommerce' ) );
}
- if ( ! empty( $_REQUEST['handle'] ) ) { // WPCS: input var ok.
+ if ( ! empty( $_REQUEST['handle'] ) ) {
$log_handler = new WC_Log_Handler_File();
- $log_handler->remove( wp_unslash( $_REQUEST['handle'] ) ); // WPCS: input var ok, sanitization ok.
+ $log_handler->remove( wp_unslash( $_REQUEST['handle'] ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Tools are allowlisted and nonce-protected; log handles are sanitized and confined.
}
wp_safe_redirect( esc_url_raw( admin_url( 'admin.php?page=wc-status&tab=logs' ) ) );
diff --git a/plugins/woocommerce/includes/admin/class-wc-admin-taxonomies.php b/plugins/woocommerce/includes/admin/class-wc-admin-taxonomies.php
index c13542b746e..4715a6998f9 100644
--- a/plugins/woocommerce/includes/admin/class-wc-admin-taxonomies.php
+++ b/plugins/woocommerce/includes/admin/class-wc-admin-taxonomies.php
@@ -314,11 +314,11 @@ class WC_Admin_Taxonomies {
* @param string $taxonomy Taxonomy slug.
*/
public function save_category_fields( $term_id, $tt_id = '', $taxonomy = '' ) {
- if ( isset( $_POST['display_type'] ) && 'product_cat' === $taxonomy ) { // WPCS: CSRF ok, input var ok.
+ if ( isset( $_POST['display_type'] ) && 'product_cat' === $taxonomy ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Core term-edit flow supplies authorization checks; IDs are cast.
update_term_meta( $term_id, 'display_type', esc_attr( $_POST['display_type'] ) ); // WPCS: CSRF ok, sanitization ok, input var ok.
}
- if ( isset( $_POST['product_cat_thumbnail_id'] ) && 'product_cat' === $taxonomy ) { // WPCS: CSRF ok, input var ok.
- update_term_meta( $term_id, 'thumbnail_id', absint( $_POST['product_cat_thumbnail_id'] ) ); // WPCS: CSRF ok, input var ok.
+ if ( isset( $_POST['product_cat_thumbnail_id'] ) && 'product_cat' === $taxonomy ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Core term-edit flow supplies authorization checks; IDs are cast.
+ update_term_meta( $term_id, 'thumbnail_id', absint( $_POST['product_cat_thumbnail_id'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Core term-edit flow supplies authorization checks; IDs are cast.
}
}
@@ -414,8 +414,8 @@ class WC_Admin_Taxonomies {
* Handle custom row actions.
*/
public function handle_product_cat_row_actions() {
- if ( isset( $_GET['action'], $_GET['tag_ID'], $_GET['_wpnonce'] ) && 'make_default' === $_GET['action'] ) { // WPCS: CSRF ok, input var ok.
- $make_default_id = absint( $_GET['tag_ID'] ); // WPCS: Input var ok.
+ if ( isset( $_GET['action'], $_GET['tag_ID'], $_GET['_wpnonce'] ) && 'make_default' === $_GET['action'] ) {
+ $make_default_id = absint( $_GET['tag_ID'] );
if ( wp_verify_nonce( $_GET['_wpnonce'], 'make_default_' . $make_default_id ) && current_user_can( 'edit_term', $make_default_id ) ) { // WPCS: Sanitization ok, input var ok, CSRF ok.
update_option( 'default_product_cat', $make_default_id );
diff --git a/plugins/woocommerce/includes/admin/class-wc-admin-webhooks-table-list.php b/plugins/woocommerce/includes/admin/class-wc-admin-webhooks-table-list.php
index c1b6f504784..dd12b8e0c35 100644
--- a/plugins/woocommerce/includes/admin/class-wc-admin-webhooks-table-list.php
+++ b/plugins/woocommerce/includes/admin/class-wc-admin-webhooks-table-list.php
@@ -213,7 +213,7 @@ class WC_Admin_Webhooks_Table_List extends WP_List_Table {
*/
public function process_bulk_action() {
$action = $this->current_action();
- $webhooks = isset( $_REQUEST['webhook'] ) ? array_map( 'absint', (array) $_REQUEST['webhook'] ) : array(); // WPCS: input var okay, CSRF ok.
+ $webhooks = isset( $_REQUEST['webhook'] ) ? array_map( 'absint', (array) $_REQUEST['webhook'] ) : array();
if ( false !== $action ) {
check_admin_referer( 'woocommerce-settings' );
@@ -256,12 +256,12 @@ class WC_Admin_Webhooks_Table_List extends WP_List_Table {
* @param string $input_id Input ID.
*/
public function search_box( $text, $input_id ) {
- if ( empty( $_REQUEST['s'] ) && ! $this->has_items() ) { // WPCS: input var okay, CSRF ok.
+ if ( empty( $_REQUEST['s'] ) && ! $this->has_items() ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filters are sanitized; bulk deletion verifies nonce/capability.
return;
}
$input_id = $input_id . '-search-input';
- $search_query = isset( $_REQUEST['s'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['s'] ) ) : ''; // WPCS: input var okay, CSRF ok.
+ $search_query = isset( $_REQUEST['s'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['s'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filters are sanitized; bulk deletion verifies nonce/capability.
echo '<p class="search-box">';
echo '<label class="screen-reader-text" for="' . esc_attr( $input_id ) . '">' . esc_html( $text ) . ':</label>';
@@ -292,12 +292,12 @@ class WC_Admin_Webhooks_Table_List extends WP_List_Table {
);
// Handle the status query.
- if ( ! empty( $_REQUEST['status'] ) ) { // WPCS: input var okay, CSRF ok.
- $args['status'] = sanitize_key( wp_unslash( $_REQUEST['status'] ) ); // WPCS: input var okay, CSRF ok.
+ if ( ! empty( $_REQUEST['status'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filters are sanitized; bulk deletion verifies nonce/capability.
+ $args['status'] = sanitize_key( wp_unslash( $_REQUEST['status'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filters are sanitized; bulk deletion verifies nonce/capability.
}
- if ( ! empty( $_REQUEST['s'] ) ) { // WPCS: input var okay, CSRF ok.
- $args['search'] = sanitize_text_field( wp_unslash( $_REQUEST['s'] ) ); // WPCS: input var okay, CSRF ok.
+ if ( ! empty( $_REQUEST['s'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filters are sanitized; bulk deletion verifies nonce/capability.
+ $args['search'] = sanitize_text_field( wp_unslash( $_REQUEST['s'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filters are sanitized; bulk deletion verifies nonce/capability.
}
$args['paginate'] = true;
diff --git a/plugins/woocommerce/includes/admin/importers/class-wc-tax-rate-importer.php b/plugins/woocommerce/includes/admin/importers/class-wc-tax-rate-importer.php
index a32b9e9d5d7..b4d76541d16 100644
--- a/plugins/woocommerce/includes/admin/importers/class-wc-tax-rate-importer.php
+++ b/plugins/woocommerce/includes/admin/importers/class-wc-tax-rate-importer.php
@@ -62,7 +62,7 @@ class WC_Tax_Rate_Importer extends WP_Importer {
*/
public function __construct() {
$this->import_page = 'woocommerce_tax_rate_csv';
- $this->delimiter = empty( $_POST['delimiter'] ) ? ',' : (string) wc_clean( wp_unslash( $_POST['delimiter'] ) ); // WPCS: CSRF ok.
+ $this->delimiter = empty( $_POST['delimiter'] ) ? ',' : (string) wc_clean( wp_unslash( $_POST['delimiter'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Constructor only sets the delimiter; import dispatch handles authorization.
}
/**
diff --git a/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-coupons.php b/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-coupons.php
index 061cbc6c679..53d047ae8a2 100644
--- a/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-coupons.php
+++ b/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-coupons.php
@@ -204,8 +204,8 @@ class WC_Admin_List_Table_Coupons extends WC_Admin_List_Table {
foreach ( $types as $name => $type ) {
echo '<option value="' . esc_attr( $name ) . '"';
- if ( isset( $_GET['coupon_type'] ) ) { // WPCS: input var ok.
- selected( $name, wc_clean( wp_unslash( $_GET['coupon_type'] ) ) ); // WPCS: input var ok, sanitization ok.
+ if ( isset( $_GET['coupon_type'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filter; values are unslashed and sanitized.
+ selected( $name, wc_clean( wp_unslash( $_GET['coupon_type'] ) ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filter; values are unslashed and sanitized.
}
echo '>' . esc_html( $type ) . '</option>';
@@ -222,7 +222,7 @@ class WC_Admin_List_Table_Coupons extends WC_Admin_List_Table {
* @return array
*/
protected function query_filters( $query_vars ) {
- if ( ! empty( $_GET['coupon_type'] ) ) { // WPCS: input var ok, sanitization ok.
+ if ( ! empty( $_GET['coupon_type'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filter; values are unslashed and sanitized.
$query_vars['meta_key'] = 'discount_type'; // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key
$query_vars['meta_value'] = wc_clean( wp_unslash( $_GET['coupon_type'] ) ); // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value, WordPress.VIP.SuperGlobalInputUsage.AccessDetected
}
diff --git a/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-orders.php b/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-orders.php
index 5695d8125ee..20c24b39ccd 100644
--- a/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-orders.php
+++ b/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-orders.php
@@ -533,17 +533,17 @@ class WC_Admin_List_Table_Orders extends WC_Admin_List_Table {
global $post_type, $pagenow;
// Bail out if not on shop order list page.
- if ( 'edit.php' !== $pagenow || 'shop_order' !== $post_type || ! isset( $_REQUEST['bulk_action'] ) ) { // WPCS: input var ok, CSRF ok.
+ if ( 'edit.php' !== $pagenow || 'shop_order' !== $post_type || ! isset( $_REQUEST['bulk_action'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only notice/filter; mutations use list-table nonce/capability checks.
return;
}
$order_statuses = wc_get_order_statuses();
- $number = isset( $_REQUEST['changed'] ) ? absint( $_REQUEST['changed'] ) : 0; // WPCS: input var ok, CSRF ok.
- $bulk_action = wc_clean( wp_unslash( $_REQUEST['bulk_action'] ) ); // WPCS: input var ok, CSRF ok.
+ $number = isset( $_REQUEST['changed'] ) ? absint( $_REQUEST['changed'] ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only notice/filter; mutations use list-table nonce/capability checks.
+ $bulk_action = wc_clean( wp_unslash( $_REQUEST['bulk_action'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only notice/filter; mutations use list-table nonce/capability checks.
// Check if any status changes happened.
foreach ( $order_statuses as $slug => $name ) {
- if ( 'marked_' . str_replace( 'wc-', '', $slug ) === $bulk_action ) { // WPCS: input var ok, CSRF ok.
+ if ( 'marked_' . str_replace( 'wc-', '', $slug ) === $bulk_action ) {
/* translators: %d: orders count */
$message = sprintf( _n( '%s order status changed.', '%s order statuses changed.', $number, 'woocommerce' ), number_format_i18n( $number ) );
echo '<div class="updated"><p>' . esc_html( $message ) . '</p></div>';
@@ -551,7 +551,7 @@ class WC_Admin_List_Table_Orders extends WC_Admin_List_Table {
}
}
- if ( 'removed_personal_data' === $bulk_action ) { // WPCS: input var ok, CSRF ok.
+ if ( 'removed_personal_data' === $bulk_action ) {
/* translators: %d: orders count */
$message = sprintf( _n( 'Removed personal data from %s order.', 'Removed personal data from %s orders.', $number, 'woocommerce' ), number_format_i18n( $number ) );
echo '<div class="updated"><p>' . esc_html( $message ) . '</p></div>';
@@ -603,12 +603,12 @@ class WC_Admin_List_Table_Orders extends WC_Admin_List_Table {
global $wp_post_statuses;
// Filter the orders by the posted customer.
- if ( ! empty( $_GET['_customer_user'] ) ) { // WPCS: input var ok.
+ if ( ! empty( $_GET['_customer_user'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only notice/filter; mutations use list-table nonce/capability checks.
// @codingStandardsIgnoreStart.
$query_vars['meta_query'] = array(
array(
'key' => '_customer_user',
- 'value' => (int) $_GET['_customer_user'], // WPCS: input var ok, sanitization ok.
+ 'value' => (int) $_GET['_customer_user'],
'compare' => '=',
),
);
@@ -671,7 +671,7 @@ class WC_Admin_List_Table_Orders extends WC_Admin_List_Table {
return $query;
}
- return wc_clean( wp_unslash( $_GET['s'] ) ); // WPCS: input var ok, sanitization ok.
+ return wc_clean( wp_unslash( $_GET['s'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only notice/filter; mutations use list-table nonce/capability checks.
}
/**
diff --git a/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-products.php b/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-products.php
index d3c98a7df7d..3eda6f2a074 100644
--- a/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-products.php
+++ b/plugins/woocommerce/includes/admin/list-tables/class-wc-admin-list-table-products.php
@@ -463,7 +463,7 @@ class WC_Admin_List_Table_Products extends WC_Admin_List_Table {
)
);
} else {
- $current_category_slug = isset( $_GET['product_cat'] ) ? wc_clean( wp_unslash( $_GET['product_cat'] ) ) : false; // WPCS: input var ok, CSRF ok.
+ $current_category_slug = isset( $_GET['product_cat'] ) ? wc_clean( wp_unslash( $_GET['product_cat'] ) ) : false; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filters; inputs are unslashed and sanitized.
$current_category = $current_category_slug ? get_term_by( 'slug', $current_category_slug, 'product_cat' ) : false;
?>
<select class="wc-category-search" name="product_cat" data-placeholder="<?php esc_attr_e( 'Filter by category', 'woocommerce' ); ?>" data-allow_clear="true">
@@ -481,7 +481,7 @@ class WC_Admin_List_Table_Products extends WC_Admin_List_Table {
* @since 3.5.0
*/
protected function render_products_type_filter() {
- $current_product_type = isset( $_REQUEST['product_type'] ) ? wc_clean( wp_unslash( $_REQUEST['product_type'] ) ) : false; // WPCS: input var ok, sanitization ok.
+ $current_product_type = isset( $_REQUEST['product_type'] ) ? wc_clean( wp_unslash( $_REQUEST['product_type'] ) ) : false; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filters; inputs are unslashed and sanitized.
$output = '<select name="product_type" id="dropdown_product_type"><option value="">' . esc_html__( 'Filter by product type', 'woocommerce' ) . '</option>';
foreach ( wc_get_product_types() as $value => $label ) {
@@ -502,7 +502,7 @@ class WC_Admin_List_Table_Products extends WC_Admin_List_Table {
}
$output .= '</select>';
- echo $output; // WPCS: XSS ok.
+ echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $output contains only fixed markup and escaped option values.
}
/**
@@ -511,7 +511,7 @@ class WC_Admin_List_Table_Products extends WC_Admin_List_Table {
* @since 3.5.0
*/
public function render_products_stock_status_filter() {
- $current_stock_status = isset( $_REQUEST['stock_status'] ) ? wc_clean( wp_unslash( $_REQUEST['stock_status'] ) ) : false; // WPCS: input var ok, sanitization ok.
+ $current_stock_status = isset( $_REQUEST['stock_status'] ) ? wc_clean( wp_unslash( $_REQUEST['stock_status'] ) ) : false; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filters; inputs are unslashed and sanitized.
$stock_statuses = wc_get_product_stock_status_options();
$output = '<select name="stock_status"><option value="">' . esc_html__( 'Filter by stock status', 'woocommerce' ) . '</option>';
@@ -520,7 +520,7 @@ class WC_Admin_List_Table_Products extends WC_Admin_List_Table {
}
$output .= '</select>';
- echo $output; // WPCS: XSS ok.
+ echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $output contains only fixed markup and escaped option values.
}
/**
@@ -568,11 +568,11 @@ class WC_Admin_List_Table_Products extends WC_Admin_List_Table {
public function search_label( $query ) {
global $pagenow, $typenow;
- if ( 'edit.php' !== $pagenow || 'product' !== $typenow || ! get_query_var( 'product_search' ) || ! isset( $_GET['s'] ) ) { // WPCS: input var ok.
+ if ( 'edit.php' !== $pagenow || 'product' !== $typenow || ! get_query_var( 'product_search' ) || ! isset( $_GET['s'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filters; inputs are unslashed and sanitized.
return $query;
}
- return wc_clean( wp_unslash( $_GET['s'] ) ); // WPCS: input var ok, sanitization ok.
+ return wc_clean( wp_unslash( $_GET['s'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filters; inputs are unslashed and sanitized.
}
/**
@@ -1112,7 +1112,7 @@ class WC_Admin_List_Table_Products extends WC_Admin_List_Table {
*/
public function add_variation_parents_for_shipping_class( $pieces, $wp_query ) {
global $wpdb;
- if ( isset( $_GET['product_shipping_class'] ) && '0' !== $_GET['product_shipping_class'] ) { // WPCS: input var ok.
+ if ( isset( $_GET['product_shipping_class'] ) && '0' !== $_GET['product_shipping_class'] ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only filters; inputs are unslashed and sanitized.
$replaced_where = str_replace( ".post_type = 'product'", ".post_type = 'product_variation'", $pieces['where'] );
$pieces['where'] .= " OR {$wpdb->posts}.ID in (
SELECT {$wpdb->posts}.post_parent FROM
diff --git a/plugins/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-data.php b/plugins/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-data.php
index 0119051d840..b59e4c71c9f 100644
--- a/plugins/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-data.php
+++ b/plugins/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-data.php
@@ -314,7 +314,6 @@ class WC_Meta_Box_Product_Data {
$value = sanitize_title( $value );
} else {
$value = html_entity_decode( wc_clean( $value ), ENT_QUOTES, get_bloginfo( 'charset' ) );
- // WPCS: sanitization ok.
}
$attributes[ $attribute_key ] = $value;
diff --git a/plugins/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-reviews.php b/plugins/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-reviews.php
index 28e6a11435b..0b4e6e08a8f 100644
--- a/plugins/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-reviews.php
+++ b/plugins/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-reviews.php
@@ -27,7 +27,7 @@ class WC_Meta_Box_Product_Reviews {
<select name="rating" id="rating">
<?php
for ( $rating = 1; $rating <= 5; $rating ++ ) {
- printf( '<option value="%1$s"%2$s>%1$s</option>', $rating, selected( $current, $rating, false ) ); // WPCS: XSS ok.
+ printf( '<option value="%1$s"%2$s>%1$s</option>', $rating, selected( $current, $rating, false ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $rating is a bounded integer and selected() returns safe attribute markup.
}
?>
</select>
@@ -42,17 +42,17 @@ class WC_Meta_Box_Product_Reviews {
*/
public static function save( $data ) {
// Not allowed, return regular value without updating meta.
- if ( ! isset( $_POST['woocommerce_meta_nonce'], $_POST['rating'] ) || ! wp_verify_nonce( wp_unslash( $_POST['woocommerce_meta_nonce'] ), 'woocommerce_save_data' ) ) { // WPCS: input var ok, sanitization ok.
+ if ( ! isset( $_POST['woocommerce_meta_nonce'], $_POST['rating'] ) || ! wp_verify_nonce( wp_unslash( $_POST['woocommerce_meta_nonce'] ), 'woocommerce_save_data' ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Save verifies nonce; rating is bounded and cast before storage.
return $data;
}
- if ( $_POST['rating'] > 5 || $_POST['rating'] < 0 ) { // WPCS: input var ok.
+ if ( $_POST['rating'] > 5 || $_POST['rating'] < 0 ) {
return $data;
}
$comment_id = $data['comment_ID'];
- update_comment_meta( $comment_id, 'rating', intval( wp_unslash( $_POST['rating'] ) ) ); // WPCS: input var ok.
+ update_comment_meta( $comment_id, 'rating', intval( wp_unslash( $_POST['rating'] ) ) );
// Return regular value after updating.
return $data;
diff --git a/plugins/woocommerce/includes/admin/meta-boxes/views/html-product-data-linked-products.php b/plugins/woocommerce/includes/admin/meta-boxes/views/html-product-data-linked-products.php
index 412c9ee4c64..9b75d512422 100644
--- a/plugins/woocommerce/includes/admin/meta-boxes/views/html-product-data-linked-products.php
+++ b/plugins/woocommerce/includes/admin/meta-boxes/views/html-product-data-linked-products.php
@@ -41,7 +41,7 @@ $width = $version && version_compare( $version, '7.0', '>=' ) ? 'width: 55%;' :
}
}
?>
- </select> <?php echo wc_help_tip( __( 'This lets you choose which products are part of this group.', 'woocommerce' ) ); // WPCS: XSS ok. ?>
+ </select> <?php echo wc_help_tip( __( 'This lets you choose which products are part of this group.', 'woocommerce' ) ); ?>
</p>
</div>
@@ -64,7 +64,7 @@ $width = $version && version_compare( $version, '7.0', '>=' ) ? 'width: 55%;' :
}
}
?>
- </select> <?php echo wc_help_tip( __( 'Upsells are products which you recommend instead of the currently viewed product, for example, products that are more profitable or better quality or more expensive.', 'woocommerce' ) ); // WPCS: XSS ok. ?>
+ </select> <?php echo wc_help_tip( __( 'Upsells are products which you recommend instead of the currently viewed product, for example, products that are more profitable or better quality or more expensive.', 'woocommerce' ) ); ?>
</p>
<p class="form-field hide_if_grouped hide_if_external">
@@ -85,7 +85,7 @@ $width = $version && version_compare( $version, '7.0', '>=' ) ? 'width: 55%;' :
}
}
?>
- </select> <?php echo wc_help_tip( __( 'Cross-sells are products which you promote in the cart, based on the current product.', 'woocommerce' ) ); // WPCS: XSS ok. ?>
+ </select> <?php echo wc_help_tip( __( 'Cross-sells are products which you promote in the cart, based on the current product.', 'woocommerce' ) ); ?>
</p>
</div>
diff --git a/plugins/woocommerce/includes/admin/meta-boxes/views/html-product-data-variations.php b/plugins/woocommerce/includes/admin/meta-boxes/views/html-product-data-variations.php
index 1131b5b51a3..381b8a9a6dd 100644
--- a/plugins/woocommerce/includes/admin/meta-boxes/views/html-product-data-variations.php
+++ b/plugins/woocommerce/includes/admin/meta-boxes/views/html-product-data-variations.php
@@ -149,7 +149,7 @@ $arrow_img_url = WC_ADMIN_IMAGES_FOLDER_URL . '/product_data/no-variati
<select class="page-selector" id="current-page-selector-1" title="<?php esc_attr_e( 'Current page', 'woocommerce' ); ?>">
<?php for ( $i = 1; $i <= $variations_total_pages; $i++ ) : ?>
<?php /* phpcs:disable WooCommerce.Commenting.CommentHooks.MissingHookComment */ ?>
- <option value="<?php echo $i; // WPCS: XSS ok. ?>"><?php echo $i; // WPCS: XSS ok. ?></option>
+ <option value="<?php echo $i; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $i is a bounded integer pagination index. ?>"><?php echo $i; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $i is a bounded integer pagination index. ?></option>
<?php /* phpcs:enable */ ?>
<?php endfor; ?>
</select>
@@ -178,7 +178,7 @@ $arrow_img_url = WC_ADMIN_IMAGES_FOLDER_URL . '/product_data/no-variati
</div>
<?php /* phpcs:disable WooCommerce.Commenting.CommentHooks.MissingHookComment */ ?>
- <div class="woocommerce_variations wc-metaboxes" data-attributes="<?php echo wc_esc_json( wp_json_encode( wc_list_pluck( $variation_attributes, 'get_data' ) ) ); // WPCS: XSS ok. ?>" data-total="<?php echo esc_attr( $variations_count ); ?>" data-total_pages="<?php echo esc_attr( $variations_total_pages ); ?>" data-page="1" data-edited="false"></div>
+ <div class="woocommerce_variations wc-metaboxes" data-attributes="<?php echo wc_esc_json( wp_json_encode( wc_list_pluck( $variation_attributes, 'get_data' ) ) ); ?>" data-total="<?php echo esc_attr( $variations_count ); ?>" data-total_pages="<?php echo esc_attr( $variations_total_pages ); ?>" data-page="1" data-edited="false"></div>
<?php /* phpcs:enable */ ?>
<div class="toolbar">
@@ -199,7 +199,7 @@ $arrow_img_url = WC_ADMIN_IMAGES_FOLDER_URL . '/product_data/no-variati
<select class="page-selector" id="current-page-selector-1" title="<?php esc_attr_e( 'Current page', 'woocommerce' ); ?>">
<?php for ( $i = 1; $i <= $variations_total_pages; $i++ ) : ?>
<?php /* phpcs:disable WooCommerce.Commenting.CommentHooks.MissingHookComment */ ?>
- <option value="<?php echo $i; // WPCS: XSS ok. ?>"><?php echo $i; // WPCS: XSS ok. ?></option>
+ <option value="<?php echo $i; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $i is a bounded integer pagination index. ?>"><?php echo $i; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $i is a bounded integer pagination index. ?></option>
<?php /* phpcs:enable */ ?>
<?php endfor; ?>
</select>
diff --git a/plugins/woocommerce/includes/admin/plugin-updates/class-wc-updates-screen-updates.php b/plugins/woocommerce/includes/admin/plugin-updates/class-wc-updates-screen-updates.php
index 233a7bfa897..558e2ac1d79 100644
--- a/plugins/woocommerce/includes/admin/plugin-updates/class-wc-updates-screen-updates.php
+++ b/plugins/woocommerce/includes/admin/plugin-updates/class-wc-updates-screen-updates.php
@@ -48,7 +48,7 @@ class WC_Updates_Screen_Updates extends WC_Plugin_Updates {
$this->major_untested_plugins = $this->get_untested_plugins( $this->new_version, $version_type );
if ( ! empty( $this->major_untested_plugins ) ) {
- echo $this->get_extensions_modal_warning(); // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped
+ echo $this->get_extensions_modal_warning(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- The method returns markup assembled from escaped dynamic values.
$this->update_screen_modal_js();
}
}
diff --git a/plugins/woocommerce/includes/admin/reports/class-wc-report-downloads.php b/plugins/woocommerce/includes/admin/reports/class-wc-report-downloads.php
index fcedb69eecf..e59e7dd1193 100644
--- a/plugins/woocommerce/includes/admin/reports/class-wc-report-downloads.php
+++ b/plugins/woocommerce/includes/admin/reports/class-wc-report-downloads.php
@@ -61,8 +61,8 @@ class WC_Report_Downloads extends WP_List_Table {
$this->prepare_items();
// Subtitle for permission if set.
- if ( ! empty( $_GET['permission_id'] ) ) { // WPCS: input var ok.
- $permission_id = absint( $_GET['permission_id'] ); // WPCS: input var ok.
+ if ( ! empty( $_GET['permission_id'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only report filter; values are cast or sanitized.
+ $permission_id = absint( $_GET['permission_id'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only report filter; values are cast or sanitized.
// Load the permission, order, etc. so we can render more information.
$permission = null;
@@ -263,12 +263,12 @@ class WC_Report_Downloads extends WP_List_Table {
* @return object
*/
protected function get_filter_vars() {
- $product_id = ! empty( $_GET['product_id'] ) ? absint( wp_unslash( $_GET['product_id'] ) ) : null; // WPCS: input var ok.
- $download_id = ! empty( $_GET['download_id'] ) ? wc_clean( wp_unslash( $_GET['download_id'] ) ) : null; // WPCS: input var ok.
- $permission_id = ! empty( $_GET['permission_id'] ) ? absint( wp_unslash( $_GET['permission_id'] ) ) : null; // WPCS: input var ok.
- $order_id = ! empty( $_GET['order_id'] ) ? absint( wp_unslash( $_GET['order_id'] ) ) : null; // WPCS: input var ok.
- $user_id = ! empty( $_GET['user_id'] ) ? absint( wp_unslash( $_GET['user_id'] ) ) : null; // WPCS: input var ok.
- $user_ip_address = ! empty( $_GET['user_ip_address'] ) ? wc_clean( wp_unslash( $_GET['user_ip_address'] ) ) : null; // WPCS: input var ok.
+ $product_id = ! empty( $_GET['product_id'] ) ? absint( wp_unslash( $_GET['product_id'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only report filter; values are cast or sanitized.
+ $download_id = ! empty( $_GET['download_id'] ) ? wc_clean( wp_unslash( $_GET['download_id'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only report filter; values are cast or sanitized.
+ $permission_id = ! empty( $_GET['permission_id'] ) ? absint( wp_unslash( $_GET['permission_id'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only report filter; values are cast or sanitized.
+ $order_id = ! empty( $_GET['order_id'] ) ? absint( wp_unslash( $_GET['order_id'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only report filter; values are cast or sanitized.
+ $user_id = ! empty( $_GET['user_id'] ) ? absint( wp_unslash( $_GET['user_id'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only report filter; values are cast or sanitized.
+ $user_ip_address = ! empty( $_GET['user_ip_address'] ) ? wc_clean( wp_unslash( $_GET['user_ip_address'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only report filter; values are cast or sanitized.
return (object) array(
'product_id' => $product_id,
diff --git a/plugins/woocommerce/includes/admin/settings/class-wc-settings-emails.php b/plugins/woocommerce/includes/admin/settings/class-wc-settings-emails.php
index 3a4780f96e2..84c62aff538 100644
--- a/plugins/woocommerce/includes/admin/settings/class-wc-settings-emails.php
+++ b/plugins/woocommerce/includes/admin/settings/class-wc-settings-emails.php
@@ -763,7 +763,7 @@ class WC_Settings_Emails extends WC_Settings_Page {
?>
<tr class="<?php echo esc_attr( $value['row_class'] ); ?>">
<th scope="row" class="titledesc">
- <label for="<?php echo esc_attr( $value['id'] ); ?>"><?php echo esc_html( $value['title'] ); ?> <?php echo wc_help_tip( $value['desc'] ); // WPCS: XSS ok. ?></label>
+ <label for="<?php echo esc_attr( $value['id'] ); ?>"><?php echo esc_html( $value['title'] ); ?> <?php echo wc_help_tip( $value['desc'] ); ?></label>
</th>
<td class="forminp forminp-<?php echo esc_attr( sanitize_title( $value['type'] ) ); ?>">
<input
diff --git a/plugins/woocommerce/includes/admin/views/html-admin-page-status-report.php b/plugins/woocommerce/includes/admin/views/html-admin-page-status-report.php
index 95807e1fe13..4a3723755ad 100644
--- a/plugins/woocommerce/includes/admin/views/html-admin-page-status-report.php
+++ b/plugins/woocommerce/includes/admin/views/html-admin-page-status-report.php
@@ -83,17 +83,17 @@ if ( file_exists( $plugin_path ) ) {
<tbody>
<tr>
<td data-export-label="WordPress address (URL)"><?php esc_html_e( 'WordPress address (URL)', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The root URL of your site.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The root URL of your site.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $environment['site_url'] ); ?></td>
</tr>
<tr>
<td data-export-label="Site address (URL)"><?php esc_html_e( 'Site address (URL)', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The homepage URL of your site.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The homepage URL of your site.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $environment['home_url'] ); ?></td>
</tr>
<tr>
<td data-export-label="WC Version"><?php esc_html_e( 'WooCommerce version', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The version of WooCommerce installed on your site.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The version of WooCommerce installed on your site.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( ! empty( $wc_version ) ? $wc_version : $environment['version'] ); ?></td>
</tr>
@@ -119,7 +119,7 @@ if ( file_exists( $plugin_path ) ) {
</tr>
<tr>
<td data-export-label="Log Directory Writable"><?php esc_html_e( 'Log directory writable', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Several WooCommerce extensions can write logs which makes debugging problems easier. The directory must be writable for this to happen.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Several WooCommerce extensions can write logs which makes debugging problems easier. The directory must be writable for this to happen.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( $environment['log_directory_writable'] ) {
@@ -139,7 +139,7 @@ if ( file_exists( $plugin_path ) ) {
</tr>
<tr>
<td data-export-label="WP Version"><?php esc_html_e( 'WordPress version', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The version of WordPress installed on your site.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The version of WordPress installed on your site.', 'woocommerce' ) ); ?></td>
<td>
<?php
$latest_version = get_transient( 'woocommerce_system_status_wp_version_check' );
@@ -167,12 +167,12 @@ if ( file_exists( $plugin_path ) ) {
</tr>
<tr>
<td data-export-label="WP Multisite"><?php esc_html_e( 'WordPress multisite', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Whether or not you have WordPress Multisite enabled.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Whether or not you have WordPress Multisite enabled.', 'woocommerce' ) ); ?></td>
<td><?php echo ( $environment['wp_multisite'] ) ? '<span class="dashicons dashicons-yes"></span>' : '–'; ?></td>
</tr>
<tr>
<td data-export-label="WP Memory Limit"><?php esc_html_e( 'WordPress memory limit', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The maximum amount of memory (RAM) that your site can use at one time.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The maximum amount of memory (RAM) that your site can use at one time.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( $environment['wp_memory_limit'] < 67108864 ) {
@@ -186,7 +186,7 @@ if ( file_exists( $plugin_path ) ) {
</tr>
<tr>
<td data-export-label="WP Debug Mode"><?php esc_html_e( 'WordPress debug mode', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Displays whether or not WordPress is in Debug Mode.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Displays whether or not WordPress is in Debug Mode.', 'woocommerce' ) ); ?></td>
<td>
<?php if ( $environment['wp_debug_mode'] ) : ?>
<mark class="yes"><span class="dashicons dashicons-yes"></span></mark>
@@ -197,7 +197,7 @@ if ( file_exists( $plugin_path ) ) {
</tr>
<tr>
<td data-export-label="WP Cron"><?php esc_html_e( 'WordPress cron', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Displays whether or not WP Cron Jobs are enabled.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Displays whether or not WP Cron Jobs are enabled.', 'woocommerce' ) ); ?></td>
<td>
<?php if ( $environment['wp_cron'] ) : ?>
<mark class="yes"><span class="dashicons dashicons-yes"></span></mark>
@@ -208,12 +208,12 @@ if ( file_exists( $plugin_path ) ) {
</tr>
<tr>
<td data-export-label="WP Environment Type"><?php esc_html_e( 'Environment type', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The current environment type set for this site.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The current environment type set for this site.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $environment['wp_environment_type'] ); ?></td>
</tr>
<tr>
<td data-export-label="Language"><?php esc_html_e( 'Language', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The current language used by WordPress. Default = English', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The current language used by WordPress. Default = English', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $environment['language'] ); ?></td>
</tr>
<tr>
@@ -238,17 +238,17 @@ if ( file_exists( $plugin_path ) ) {
<tbody>
<tr>
<td data-export-label="Server Info"><?php esc_html_e( 'Server info', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Information about the web server that is currently hosting your site.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Information about the web server that is currently hosting your site.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $environment['server_info'] ); ?></td>
</tr>
<tr>
<td data-export-label="Server Architecture"><?php esc_html_e( 'Server architecture', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Information about the operating system your server is running.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Information about the operating system your server is running.', 'woocommerce' ) ); ?></td>
<td><?php echo ! empty( $environment['server_architecture'] ) ? esc_html( $environment['server_architecture'] ) : esc_html__( 'Unable to determine server architecture. Please ask your hosting provider for this information.', 'woocommerce' ); ?></td>
</tr>
<tr>
<td data-export-label="PHP Version"><?php esc_html_e( 'PHP version', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The version of PHP installed on your hosting server.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The version of PHP installed on your hosting server.', 'woocommerce' ) ); ?></td>
<td>
<?php echo '<mark class="yes">' . esc_html( $environment['php_version'] ) . '</mark>'; ?>
</td>
@@ -256,27 +256,27 @@ if ( file_exists( $plugin_path ) ) {
<?php if ( function_exists( 'ini_get' ) ) : ?>
<tr>
<td data-export-label="PHP Post Max Size"><?php esc_html_e( 'PHP post max size', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The largest filesize that can be contained in one post.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The largest filesize that can be contained in one post.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( size_format( $environment['php_post_max_size'] ) ); ?></td>
</tr>
<tr>
<td data-export-label="PHP Time Limit"><?php esc_html_e( 'PHP time limit', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The amount of time (in seconds) that your site will spend on a single operation before timing out (to avoid server lockups)', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The amount of time (in seconds) that your site will spend on a single operation before timing out (to avoid server lockups)', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $environment['php_max_execution_time'] ); ?></td>
</tr>
<tr>
<td data-export-label="PHP Max Input Vars"><?php esc_html_e( 'PHP max input vars', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The maximum number of variables your server can use for a single function to avoid overloads.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The maximum number of variables your server can use for a single function to avoid overloads.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $environment['php_max_input_vars'] ); ?></td>
</tr>
<tr>
<td data-export-label="cURL Version"><?php esc_html_e( 'cURL version', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The version of cURL installed on your server.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The version of cURL installed on your server.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $environment['curl_version'] ); ?></td>
</tr>
<tr>
<td data-export-label="SUHOSIN Installed"><?php esc_html_e( 'SUHOSIN installed', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Suhosin is an advanced protection system for PHP installations. It was designed to protect your servers on the one hand against a number of well known problems in PHP applications and on the other hand against potential unknown vulnerabilities within these applications or the PHP core itself. If enabled on your server, Suhosin may need to be configured to increase its data submission limits.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Suhosin is an advanced protection system for PHP installations. It was designed to protect your servers on the one hand against a number of well known problems in PHP applications and on the other hand against potential unknown vulnerabilities within these applications or the PHP core itself. If enabled on your server, Suhosin may need to be configured to increase its data submission limits.', 'woocommerce' ) ); ?></td>
<td><?php echo $environment['suhosin_installed'] ? '<span class="dashicons dashicons-yes"></span>' : '–'; ?></td>
</tr>
<?php endif; ?>
@@ -287,7 +287,7 @@ if ( file_exists( $plugin_path ) ) {
?>
<tr>
<td data-export-label="MySQL Version"><?php esc_html_e( 'MySQL version', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The version of MySQL installed on your hosting server.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The version of MySQL installed on your hosting server.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( version_compare( $environment['mysql_version'], '5.6', '<' ) && ! strstr( $environment['mysql_version_string'], 'MariaDB' ) ) {
@@ -302,12 +302,12 @@ if ( file_exists( $plugin_path ) ) {
<?php endif; ?>
<tr>
<td data-export-label="Max Upload Size"><?php esc_html_e( 'Max upload size', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The largest filesize that can be uploaded to your WordPress installation.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The largest filesize that can be uploaded to your WordPress installation.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( size_format( $environment['max_upload_size'] ) ); ?></td>
</tr>
<tr>
<td data-export-label="Default Timezone is UTC"><?php esc_html_e( 'Default timezone is UTC', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The default timezone for your server.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The default timezone for your server.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( 'UTC' !== $environment['default_timezone'] ) {
@@ -321,7 +321,7 @@ if ( file_exists( $plugin_path ) ) {
</tr>
<tr>
<td data-export-label="fsockopen/cURL"><?php esc_html_e( 'fsockopen/cURL', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Payment gateways can use cURL to communicate with remote servers to authorize payments, other plugins may also use it when communicating with remote services.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Payment gateways can use cURL to communicate with remote servers to authorize payments, other plugins may also use it when communicating with remote services.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( $environment['fsockopen_or_curl_enabled'] ) {
@@ -334,7 +334,7 @@ if ( file_exists( $plugin_path ) ) {
</tr>
<tr>
<td data-export-label="SoapClient"><?php esc_html_e( 'SoapClient', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Some webservices like shipping use SOAP to get information from remote servers, for example, live shipping quotes from FedEx require SOAP to be installed.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Some webservices like shipping use SOAP to get information from remote servers, for example, live shipping quotes from FedEx require SOAP to be installed.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( $environment['soapclient_enabled'] ) {
@@ -348,7 +348,7 @@ if ( file_exists( $plugin_path ) ) {
</tr>
<tr>
<td data-export-label="DOMDocument"><?php esc_html_e( 'DOMDocument', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'HTML/Multipart emails use DOMDocument to generate inline CSS in templates.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'HTML/Multipart emails use DOMDocument to generate inline CSS in templates.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( $environment['domdocument_enabled'] ) {
@@ -362,7 +362,7 @@ if ( file_exists( $plugin_path ) ) {
</tr>
<tr>
<td data-export-label="GZip"><?php esc_html_e( 'GZip', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'GZip (gzopen) is used to open the GEOIP database from MaxMind.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'GZip (gzopen) is used to open the GEOIP database from MaxMind.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( $environment['gzip_enabled'] ) {
@@ -376,7 +376,7 @@ if ( file_exists( $plugin_path ) ) {
</tr>
<tr>
<td data-export-label="Multibyte String"><?php esc_html_e( 'Multibyte string', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Multibyte String (mbstring) is used to convert character encoding, like for emails or converting characters to lowercase.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Multibyte String (mbstring) is used to convert character encoding, like for emails or converting characters to lowercase.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( $environment['mbstring_enabled'] ) {
@@ -390,7 +390,7 @@ if ( file_exists( $plugin_path ) ) {
</tr>
<tr>
<td data-export-label="Remote Post"><?php esc_html_e( 'Remote post', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'PayPal uses this method of communicating when sending back transaction information.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'PayPal uses this method of communicating when sending back transaction information.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( $environment['remote_post_successful'] ) {
@@ -404,7 +404,7 @@ if ( file_exists( $plugin_path ) ) {
</tr>
<tr>
<td data-export-label="Remote Get"><?php esc_html_e( 'Remote get', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'WooCommerce plugins may use this method of communication when checking for plugin updates.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'WooCommerce plugins may use this method of communication when checking for plugin updates.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( $environment['remote_get_successful'] ) {
@@ -462,7 +462,7 @@ if ( file_exists( $plugin_path ) ) {
<tbody>
<tr>
<td data-export-label="WC Database Version"><?php esc_html_e( 'WooCommerce database version', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The database version for WooCommerce. This should be the same as your WooCommerce version.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The database version for WooCommerce. This should be the same as your WooCommerce version.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $database['wc_database_version'] ); ?></td>
</tr>
<tr>
@@ -575,7 +575,7 @@ if ( file_exists( $plugin_path ) ) {
<tbody>
<tr>
<td data-export-label="Secure connection (HTTPS)"><?php esc_html_e( 'Secure connection (HTTPS)', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Is the connection to your store secure?', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Is the connection to your store secure?', 'woocommerce' ) ); ?></td>
<td>
<?php if ( $security['secure_connection'] ) : ?>
<mark class="yes"><span class="dashicons dashicons-yes"></span></mark>
@@ -591,7 +591,7 @@ if ( file_exists( $plugin_path ) ) {
</tr>
<tr>
<td data-export-label="Hide errors from visitors"><?php esc_html_e( 'Hide errors from visitors', 'woocommerce' ); ?></td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Error messages can contain sensitive information about your store environment. These should be hidden from untrusted visitors.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Error messages can contain sensitive information about your store environment. These should be hidden from untrusted visitors.', 'woocommerce' ) ); ?></td>
<td>
<?php if ( $security['hide_errors'] ) : ?>
<mark class="yes"><span class="dashicons dashicons-yes"></span></mark>
@@ -691,37 +691,37 @@ if ( 0 < $mu_plugins_count ) :
<tbody>
<tr>
<td data-export-label="Force SSL"><?php esc_html_e( 'Force SSL', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Does your site force a SSL Certificate for transactions?', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Does your site force a SSL Certificate for transactions?', 'woocommerce' ) ); ?></td>
<td><?php echo $settings['force_ssl'] ? '<mark class="yes"><span class="dashicons dashicons-yes"></span></mark>' : '<mark class="no">–</mark>'; ?></td>
</tr>
<tr>
<td data-export-label="Currency"><?php esc_html_e( 'Currency', 'woocommerce' ); ?></td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'What currency prices are listed at in the catalog and which currency gateways will take payments in.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'What currency prices are listed at in the catalog and which currency gateways will take payments in.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $settings['currency'] ); ?> (<?php echo esc_html( $settings['currency_symbol'] ); ?>)</td>
</tr>
<tr>
<td data-export-label="Currency Position"><?php esc_html_e( 'Currency position', 'woocommerce' ); ?></td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The position of the currency symbol.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The position of the currency symbol.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $settings['currency_position'] ); ?></td>
</tr>
<tr>
<td data-export-label="Thousand Separator"><?php esc_html_e( 'Thousand separator', 'woocommerce' ); ?></td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The thousand separator of displayed prices.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The thousand separator of displayed prices.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $settings['thousand_separator'] ); ?></td>
</tr>
<tr>
<td data-export-label="Decimal Separator"><?php esc_html_e( 'Decimal separator', 'woocommerce' ); ?></td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The decimal separator of displayed prices.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The decimal separator of displayed prices.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $settings['decimal_separator'] ); ?></td>
</tr>
<tr>
<td data-export-label="Number of Decimals"><?php esc_html_e( 'Number of decimals', 'woocommerce' ); ?></td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The number of decimal points shown in displayed prices.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The number of decimal points shown in displayed prices.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $settings['number_of_decimals'] ); ?></td>
</tr>
<tr>
<td data-export-label="Taxonomies: Product Types"><?php esc_html_e( 'Taxonomies: Product types', 'woocommerce' ); ?></td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'A list of taxonomy terms that can be used in regard to order/product statuses.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'A list of taxonomy terms that can be used in regard to order/product statuses.', 'woocommerce' ) ); ?></td>
<td>
<?php
$display_terms = array();
@@ -734,7 +734,7 @@ if ( 0 < $mu_plugins_count ) :
</tr>
<tr>
<td data-export-label="Taxonomies: Product Visibility"><?php esc_html_e( 'Taxonomies: Product visibility', 'woocommerce' ); ?></td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'A list of taxonomy terms used for product visibility.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'A list of taxonomy terms used for product visibility.', 'woocommerce' ) ); ?></td>
<td>
<?php
$display_terms = array();
@@ -747,12 +747,12 @@ if ( 0 < $mu_plugins_count ) :
</tr>
<tr>
<td data-export-label="Connected to WooCommerce.com"><?php esc_html_e( 'Connected to WooCommerce.com', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Is your site connected to WooCommerce.com?', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Is your site connected to WooCommerce.com?', 'woocommerce' ) ); ?></td>
<td><?php echo 'yes' === $settings['woocommerce_com_connected'] ? '<mark class="yes"><span class="dashicons dashicons-yes"></span></mark>' : '<mark class="no">–</mark>'; ?></td>
</tr>
<tr>
<td data-export-label="Enforce Approved Product Download Directories"><?php esc_html_e( 'Enforce Approved Product Download Directories', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Is your site enforcing the use of Approved Product Download Directories?', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Is your site enforcing the use of Approved Product Download Directories?', 'woocommerce' ) ); ?></td>
<td><?php echo $settings['enforce_approved_download_dirs'] ? '<mark class="yes"><span class="dashicons dashicons-yes"></span></mark>' : '<mark class="no">–</mark>'; ?></td>
</tr>
@@ -867,14 +867,14 @@ if ( 0 < $mu_plugins_count ) :
// Shortcode and block check.
if ( ! $_page['shortcode_present'] && ! $_page['block_present'] ) {
/* Translators: %1$s: shortcode text, %2$s: block slug. */
- echo '<mark class="error"><span class="dashicons dashicons-warning"></span> ' . ( $_page['block_required'] ? sprintf( esc_html__( 'Page does not contain the %1$s shortcode or the %2$s block.', 'woocommerce' ), esc_html( $_page['shortcode'] ), esc_html( $_page['block'] ) ) : sprintf( esc_html__( 'Page does not contain the %s shortcode.', 'woocommerce' ), esc_html( $_page['shortcode'] ) ) ) . '</mark>'; /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */
+ echo '<mark class="error"><span class="dashicons dashicons-warning"></span> ' . ( $_page['block_required'] ? sprintf( esc_html__( 'Page does not contain the %1$s shortcode or the %2$s block.', 'woocommerce' ), esc_html( $_page['shortcode'] ), esc_html( $_page['block'] ) ) : sprintf( esc_html__( 'Page does not contain the %s shortcode.', 'woocommerce' ), esc_html( $_page['shortcode'] ) ) ) . '</mark>';
$found_error = true;
}
// Warn merchants if both the shortcode and block are present, which will be a confusing shopper experience.
if ( $_page['shortcode_present'] && $_page['block_present'] ) {
/* Translators: %1$s: shortcode text, %2$s: block slug. */
- echo '<mark class="error"><span class="dashicons dashicons-warning"></span> ' . sprintf( esc_html__( 'Page contains both the %1$s shortcode and the %2$s block.', 'woocommerce' ), esc_html( $_page['shortcode'] ), esc_html( $_page['block'] ) ) . '</mark>'; /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */
+ echo '<mark class="error"><span class="dashicons dashicons-warning"></span> ' . sprintf( esc_html__( 'Page contains both the %1$s shortcode and the %2$s block.', 'woocommerce' ), esc_html( $_page['shortcode'] ), esc_html( $_page['block'] ) ) . '</mark>';
$found_error = true;
}
}
@@ -922,12 +922,12 @@ if ( 0 < $mu_plugins_count ) :
<tbody>
<tr>
<td data-export-label="Name"><?php esc_html_e( 'Name', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The name of the current active theme.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The name of the current active theme.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $theme['name'] ); ?></td>
</tr>
<tr>
<td data-export-label="Version"><?php esc_html_e( 'Version', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The installed version of the current active theme.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The installed version of the current active theme.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( version_compare( $theme['version'], $theme['version_latest'], '<' ) ) {
@@ -941,12 +941,12 @@ if ( 0 < $mu_plugins_count ) :
</tr>
<tr>
<td data-export-label="Author URL"><?php esc_html_e( 'Author URL', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The theme developers URL.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The theme developers URL.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $theme['author_url'] ); ?></td>
</tr>
<tr>
<td data-export-label="Child Theme"><?php esc_html_e( 'Child theme', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Displays whether or not the current theme is a child theme.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Displays whether or not the current theme is a child theme.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( $theme['is_child_theme'] ) {
@@ -961,12 +961,12 @@ if ( 0 < $mu_plugins_count ) :
<?php if ( $theme['is_child_theme'] ) : ?>
<tr>
<td data-export-label="Parent Theme Name"><?php esc_html_e( 'Parent theme name', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The name of the parent theme.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The name of the parent theme.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $theme['parent_name'] ); ?></td>
</tr>
<tr>
<td data-export-label="Parent Theme Version"><?php esc_html_e( 'Parent theme version', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The installed version of the parent theme.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The installed version of the parent theme.', 'woocommerce' ) ); ?></td>
<td>
<?php
echo esc_html( $theme['parent_version'] );
@@ -979,14 +979,14 @@ if ( 0 < $mu_plugins_count ) :
</tr>
<tr>
<td data-export-label="Parent Theme Author URL"><?php esc_html_e( 'Parent theme author URL', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'The parent theme developers URL.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'The parent theme developers URL.', 'woocommerce' ) ); ?></td>
<td><?php echo esc_html( $theme['parent_author_url'] ); ?></td>
</tr>
<?php endif ?>
<?php if ( isset( $theme['is_block_theme'] ) ) : ?>
<tr>
<td data-export-label="Theme type"><?php esc_html_e( 'Theme type', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Displays whether the current active theme is a block theme or a classic theme.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Displays whether the current active theme is a block theme or a classic theme.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( $theme['is_block_theme'] ) {
@@ -1000,7 +1000,7 @@ if ( 0 < $mu_plugins_count ) :
<?php endif ?>
<tr>
<td data-export-label="WooCommerce Support"><?php esc_html_e( 'WooCommerce support', 'woocommerce' ); ?>:</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Displays whether or not the current active theme declares WooCommerce support.', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Displays whether or not the current active theme declares WooCommerce support.', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( ! $theme['has_woocommerce_support'] ) {
diff --git a/plugins/woocommerce/includes/admin/wc-meta-box-functions.php b/plugins/woocommerce/includes/admin/wc-meta-box-functions.php
index 846642f6284..d9b69a63814 100644
--- a/plugins/woocommerce/includes/admin/wc-meta-box-functions.php
+++ b/plugins/woocommerce/includes/admin/wc-meta-box-functions.php
@@ -265,12 +265,12 @@ function woocommerce_wp_select( $field, ?WC_Data $data = null ) {
$tooltip = ! empty( $field['description'] ) && false !== $field['desc_tip'] ? $field['description'] : '';
$description = ! empty( $field['description'] ) && false === $field['desc_tip'] ? $field['description'] : '';
?>
- <p <?php echo wc_implode_html_attributes( $wrapper_attributes ); // WPCS: XSS ok. ?>>
- <label <?php echo wc_implode_html_attributes( $label_attributes ); // WPCS: XSS ok. ?>><?php echo wp_kses_post( $field['label'] ); ?></label>
+ <p <?php echo wc_implode_html_attributes( $wrapper_attributes ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- wc_implode_html_attributes() escapes attribute names and values. ?>>
+ <label <?php echo wc_implode_html_attributes( $label_attributes ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- wc_implode_html_attributes() escapes attribute names and values. ?>><?php echo wp_kses_post( $field['label'] ); ?></label>
<?php if ( $tooltip ) : ?>
- <?php echo wc_help_tip( $tooltip ); // WPCS: XSS ok. ?>
+ <?php echo wc_help_tip( $tooltip ); ?>
<?php endif; ?>
- <select <?php echo wc_implode_html_attributes( $field_attributes ); // WPCS: XSS ok. ?>>
+ <select <?php echo wc_implode_html_attributes( $field_attributes ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- wc_implode_html_attributes() escapes attribute names and values. ?>>
<?php
foreach ( $field['options'] as $key => $value ) {
echo '<option value="' . esc_attr( $key ) . '"' . wc_selected( $key, $field['value'] ) . '>' . esc_html( $value ) . '</option>';
diff --git a/plugins/woocommerce/includes/class-wc-auth.php b/plugins/woocommerce/includes/class-wc-auth.php
index 9614234b53f..2f33efebb63 100644
--- a/plugins/woocommerce/includes/class-wc-auth.php
+++ b/plugins/woocommerce/includes/class-wc-auth.php
@@ -290,12 +290,12 @@ class WC_Auth {
public function handle_auth_requests() {
global $wp;
- if ( ! empty( $_GET['wc-auth-version'] ) ) { // WPCS: input var ok, CSRF ok.
- $wp->query_vars['wc-auth-version'] = wc_clean( wp_unslash( $_GET['wc-auth-version'] ) ); // WPCS: input var ok, CSRF ok.
+ if ( ! empty( $_GET['wc-auth-version'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Values are required for handshake validation; key creation verifies capability and nonce.
+ $wp->query_vars['wc-auth-version'] = wc_clean( wp_unslash( $_GET['wc-auth-version'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Values are required for handshake validation; key creation verifies capability and nonce.
}
- if ( ! empty( $_GET['wc-auth-route'] ) ) { // WPCS: input var ok, CSRF ok.
- $wp->query_vars['wc-auth-route'] = wc_clean( wp_unslash( $_GET['wc-auth-route'] ) ); // WPCS: input var ok, CSRF ok.
+ if ( ! empty( $_GET['wc-auth-route'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Values are required for handshake validation; key creation verifies capability and nonce.
+ $wp->query_vars['wc-auth-route'] = wc_clean( wp_unslash( $_GET['wc-auth-route'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Values are required for handshake validation; key creation verifies capability and nonce.
}
// wc-auth endpoint requests.
@@ -405,7 +405,7 @@ class WC_Auth {
} elseif ( 'access_granted' === $route && current_user_can( 'manage_woocommerce' ) ) {
// Granted access endpoint.
- if ( ! isset( $_GET['wc_auth_nonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_GET['wc_auth_nonce'] ) ), 'wc_auth_grant_access' ) ) { // WPCS: input var ok.
+ if ( ! isset( $_GET['wc_auth_nonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_GET['wc_auth_nonce'] ) ), 'wc_auth_grant_access' ) ) {
throw new Exception( __( 'Invalid nonce verification', 'woocommerce' ) );
}
diff --git a/plugins/woocommerce/includes/class-wc-breadcrumb.php b/plugins/woocommerce/includes/class-wc-breadcrumb.php
index 31578fd4843..8d3e495da56 100644
--- a/plugins/woocommerce/includes/class-wc-breadcrumb.php
+++ b/plugins/woocommerce/includes/class-wc-breadcrumb.php
@@ -149,7 +149,7 @@ class WC_Breadcrumb {
if ( ! $post_id ) {
global $post;
} else {
- $post = get_post( $post_id ); // WPCS: override ok.
+ $post = get_post( $post_id ); // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited -- $post is a local value when a post ID is provided.
}
if ( ! $permalink ) {
diff --git a/plugins/woocommerce/includes/class-wc-cache-helper.php b/plugins/woocommerce/includes/class-wc-cache-helper.php
index a6c8292406b..51bff4db3e3 100644
--- a/plugins/woocommerce/includes/class-wc-cache-helper.php
+++ b/plugins/woocommerce/includes/class-wc-cache-helper.php
@@ -194,14 +194,14 @@ class WC_Cache_Helper {
public static function geolocation_ajax_redirect() {
if ( DefaultCustomerAddress::GEOLOCATION_AJAX === get_option( 'woocommerce_default_customer_address' ) && ! is_checkout() && ! is_cart() && ! is_account_page() && ! is_robots() && ! wp_doing_ajax() && empty( $_POST ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing
$location_hash = self::geolocation_ajax_get_location_hash();
- $current_hash = isset( $_GET['v'] ) ? wc_clean( wp_unslash( $_GET['v'] ) ) : ''; // WPCS: sanitization ok, input var ok, CSRF ok.
+ $current_hash = isset( $_GET['v'] ) ? wc_clean( wp_unslash( $_GET['v'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Hash is cleaned; same-site redirect uses esc_url_raw() and wp_safe_redirect().
if ( empty( $current_hash ) || $current_hash !== $location_hash ) {
global $wp;
$redirect_url = trailingslashit( home_url( $wp->request ) );
- if ( ! empty( $_SERVER['QUERY_STRING'] ) ) { // WPCS: Input var ok.
- $redirect_url = add_query_arg( wp_unslash( $_SERVER['QUERY_STRING'] ), '', $redirect_url ); // WPCS: sanitization ok, Input var ok.
+ if ( ! empty( $_SERVER['QUERY_STRING'] ) ) {
+ $redirect_url = add_query_arg( wp_unslash( $_SERVER['QUERY_STRING'] ), '', $redirect_url ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Hash is cleaned; same-site redirect uses esc_url_raw() and wp_safe_redirect().
}
if ( ! get_option( 'permalink_structure' ) ) {
@@ -350,7 +350,7 @@ class WC_Cache_Helper {
return;
}
- $affected = $wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->options} WHERE option_name LIKE %s LIMIT %d;", '\_transient\_%' . $version, $limit ) ); // WPCS: cache ok, db call ok.
+ $affected = $wpdb->query( $wpdb->prepare( "DELETE FROM {$wpdb->options} WHERE option_name LIKE %s LIMIT %d;", '\_transient\_%' . $version, $limit ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Direct deletion is required for bounded transient cleanup; caching a DELETE is not applicable.
// If affected rows is equal to limit, there are more rows to delete. Delete in 30 secs.
if ( $affected === $limit ) {
diff --git a/plugins/woocommerce/includes/class-wc-cart-session.php b/plugins/woocommerce/includes/class-wc-cart-session.php
index 676503adeb9..0e7ff423508 100644
--- a/plugins/woocommerce/includes/class-wc-cart-session.php
+++ b/plugins/woocommerce/includes/class-wc-cart-session.php
@@ -340,7 +340,7 @@ final class WC_Cart_Session {
}
if ( ! $this->cart->is_empty() ) {
$this->set_cart_cookies( true );
- } elseif ( isset( $_COOKIE['woocommerce_items_in_cart'] ) ) { // WPCS: input var ok.
+ } elseif ( isset( $_COOKIE['woocommerce_items_in_cart'] ) ) {
$this->set_cart_cookies( false );
}
$this->dedupe_cookies();
diff --git a/plugins/woocommerce/includes/class-wc-comments.php b/plugins/woocommerce/includes/class-wc-comments.php
index 31d74485278..bf9806af665 100644
--- a/plugins/woocommerce/includes/class-wc-comments.php
+++ b/plugins/woocommerce/includes/class-wc-comments.php
@@ -628,7 +628,7 @@ class WC_Comments {
);
foreach ( $raw_counts as $count ) {
- $counts[ $count->meta_value ] = absint( $count->meta_value_count ); // WPCS: slow query ok.
+ $counts[ $count->meta_value ] = absint( $count->meta_value_count ); // phpcs:ignore WordPress.DB.SlowDBQuery.meta_value -- meta_value is a result-object property, not a query argument.
}
return $counts;
diff --git a/plugins/woocommerce/includes/class-wc-download-handler.php b/plugins/woocommerce/includes/class-wc-download-handler.php
index 0f813861d4b..74ec30eefdf 100644
--- a/plugins/woocommerce/includes/class-wc-download-handler.php
+++ b/plugins/woocommerce/includes/class-wc-download-handler.php
@@ -438,7 +438,7 @@ class WC_Download_Handler {
$download_range['length'] = $file_size;
if ( isset( $_SERVER['HTTP_RANGE'] ) ) { // @codingStandardsIgnoreLine.
- $http_range = sanitize_text_field( wp_unslash( $_SERVER['HTTP_RANGE'] ) ); // WPCS: input var ok.
+ $http_range = sanitize_text_field( wp_unslash( $_SERVER['HTTP_RANGE'] ) );
$download_range['is_range_request'] = true;
$c_start = $start;
@@ -924,7 +924,7 @@ class WC_Download_Handler {
if ( ! strstr( $message, '<a ' ) ) {
$message .= ' <a href="' . esc_url( wc_get_page_permalink( 'shop' ) ) . '" class="wc-forward">' . esc_html__( 'Go to shop', 'woocommerce' ) . '</a>';
}
- wp_die( $message, $title, array( 'response' => $status ) ); // WPCS: XSS ok.
+ wp_die( $message, $title, array( 'response' => $status ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- wp_die() accepts HTML; callers pass fixed messages with explicitly escaped links.
}
/**
diff --git a/plugins/woocommerce/includes/class-wc-emails.php b/plugins/woocommerce/includes/class-wc-emails.php
index bea9a7b3073..67b8f263c01 100644
--- a/plugins/woocommerce/includes/class-wc-emails.php
+++ b/plugins/woocommerce/includes/class-wc-emails.php
@@ -670,14 +670,14 @@ class WC_Emails {
foreach ( $fields as $field ) {
if ( isset( $field['label'], $field['value'] ) && $field['value'] ) {
- echo wp_kses_post( $field['label'] . ': ' . $field['value'] ) . "\n"; // WPCS: XSS ok.
+ echo wp_kses_post( $field['label'] . ': ' . $field['value'] ) . "\n";
}
}
} else {
foreach ( $fields as $field ) {
if ( isset( $field['label'], $field['value'] ) && $field['value'] ) {
- echo '<p><strong>' . wp_kses_post( $field['label'] ) . ':</strong> ' . wp_kses_post( $field['value'] ) . '</p>'; // WPCS: XSS ok.
+ echo '<p><strong>' . wp_kses_post( $field['label'] ) . ':</strong> ' . wp_kses_post( $field['value'] ) . '</p>';
}
}
}
diff --git a/plugins/woocommerce/includes/class-wc-install.php b/plugins/woocommerce/includes/class-wc-install.php
index d44ffd1be5a..61f76e0445f 100644
--- a/plugins/woocommerce/includes/class-wc-install.php
+++ b/plugins/woocommerce/includes/class-wc-install.php
@@ -599,7 +599,6 @@ class WC_Install {
*/
public static function install_actions() {
if ( ! empty( $_GET['do_update_woocommerce'] ) ) {
- // WPCS: input var ok.
check_admin_referer( 'wc_db_update', 'wc_db_update_nonce' );
wc_get_logger()->info( 'Manual database update triggered.', array( 'source' => 'wc-updater' ) );
self::update();
@@ -623,7 +622,6 @@ class WC_Install {
$return_url = esc_url_raw( wp_unslash( $return_url ) );
wp_safe_redirect( $return_url );
- // WPCS: input var ok.
exit;
}
}
diff --git a/plugins/woocommerce/includes/class-wc-order.php b/plugins/woocommerce/includes/class-wc-order.php
index 3b5bca75caf..4cbda00cd61 100644
--- a/plugins/woocommerce/includes/class-wc-order.php
+++ b/plugins/woocommerce/includes/class-wc-order.php
@@ -2089,7 +2089,7 @@ class WC_Order extends WC_Abstract_Order {
} else {
$comment_author = __( 'WooCommerce', 'woocommerce' );
$comment_author_email = strtolower( __( 'WooCommerce', 'woocommerce' ) ) . '@';
- $comment_author_email .= isset( $_SERVER['HTTP_HOST'] ) ? str_replace( 'www.', '', sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) ) ) : 'noreply.com'; // WPCS: input var ok.
+ $comment_author_email .= isset( $_SERVER['HTTP_HOST'] ) ? str_replace( 'www.', '', sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) ) ) : 'noreply.com';
$comment_author_email = sanitize_email( $comment_author_email );
}
$commentdata = apply_filters(
diff --git a/plugins/woocommerce/includes/class-wc-payment-gateways.php b/plugins/woocommerce/includes/class-wc-payment-gateways.php
index 0630bd1a1ab..0a16f9d1771 100644
--- a/plugins/woocommerce/includes/class-wc-payment-gateways.php
+++ b/plugins/woocommerce/includes/class-wc-payment-gateways.php
@@ -434,7 +434,7 @@ class WC_Payment_Gateways {
* Save options in admin.
*/
public function process_admin_options() {
- $gateway_order = isset( $_POST['gateway_order'] ) ? wc_clean( wp_unslash( $_POST['gateway_order'] ) ) : ''; // WPCS: input var ok, CSRF ok.
+ $gateway_order = isset( $_POST['gateway_order'] ) ? wc_clean( wp_unslash( $_POST['gateway_order'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Gateway order is recursively cleaned; settings save verifies capability and nonce.
$order = array();
if ( is_array( $gateway_order ) && count( $gateway_order ) > 0 ) {
diff --git a/plugins/woocommerce/includes/class-wc-post-data.php b/plugins/woocommerce/includes/class-wc-post-data.php
index 5359505289b..ac5806c8414 100644
--- a/plugins/woocommerce/includes/class-wc-post-data.php
+++ b/plugins/woocommerce/includes/class-wc-post-data.php
@@ -361,8 +361,8 @@ class WC_Post_Data {
$order_title .= ' – ' . date_i18n( 'F j, Y @ h:i A', strtotime( $data['post_date'] ) );
}
$data['post_title'] = $order_title;
- } elseif ( 'product' === $data['post_type'] && isset( $_POST['product-type'] ) ) { // WPCS: input var ok, CSRF ok.
- $product_type = wc_clean( wp_unslash( $_POST['product-type'] ) ); // WPCS: input var ok, CSRF ok.
+ } elseif ( 'product' === $data['post_type'] && isset( $_POST['product-type'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Cleaned input selects known product types only.
+ $product_type = wc_clean( wp_unslash( $_POST['product-type'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Cleaned input selects known product types only.
switch ( $product_type ) {
case ProductType::GROUPED:
case ProductType::VARIABLE:
diff --git a/plugins/woocommerce/includes/class-wc-rest-authentication.php b/plugins/woocommerce/includes/class-wc-rest-authentication.php
index 78c93f92909..209a7b48798 100644
--- a/plugins/woocommerce/includes/class-wc-rest-authentication.php
+++ b/plugins/woocommerce/includes/class-wc-rest-authentication.php
@@ -185,15 +185,15 @@ class WC_REST_Authentication {
$consumer_secret = '';
// If the $_GET parameters are present, use those first.
- if ( ! empty( $_GET['consumer_key'] ) && ! empty( $_GET['consumer_secret'] ) ) { // WPCS: CSRF ok.
- $consumer_key = $_GET['consumer_key']; // WPCS: CSRF ok, sanitization ok.
- $consumer_secret = $_GET['consumer_secret']; // WPCS: CSRF ok, sanitization ok.
+ if ( ! empty( $_GET['consumer_key'] ) && ! empty( $_GET['consumer_secret'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Raw credentials and request data are required for OAuth signature verification.
+ $consumer_key = $_GET['consumer_key']; // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Raw credentials and request data are required for OAuth signature verification.
+ $consumer_secret = $_GET['consumer_secret']; // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Raw credentials and request data are required for OAuth signature verification.
}
// If the above is not present, we will do full basic auth.
if ( ! $consumer_key && ! empty( $_SERVER['PHP_AUTH_USER'] ) && ! empty( $_SERVER['PHP_AUTH_PW'] ) ) {
- $consumer_key = $_SERVER['PHP_AUTH_USER']; // WPCS: CSRF ok, sanitization ok.
- $consumer_secret = $_SERVER['PHP_AUTH_PW']; // WPCS: CSRF ok, sanitization ok.
+ $consumer_key = $_SERVER['PHP_AUTH_USER']; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Raw credentials and request data are required for OAuth signature verification.
+ $consumer_secret = $_SERVER['PHP_AUTH_PW']; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Raw credentials and request data are required for OAuth signature verification.
}
// Stop if don't have any key.
@@ -259,7 +259,7 @@ class WC_REST_Authentication {
*/
public function get_authorization_header() {
if ( ! empty( $_SERVER['HTTP_AUTHORIZATION'] ) ) {
- return wp_unslash( $_SERVER['HTTP_AUTHORIZATION'] ); // WPCS: sanitization ok.
+ return wp_unslash( $_SERVER['HTTP_AUTHORIZATION'] ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Raw credentials and request data are required for OAuth signature verification.
}
if ( function_exists( 'getallheaders' ) ) {
@@ -397,8 +397,8 @@ class WC_REST_Authentication {
* @return true|WP_Error
*/
private function check_oauth_signature( $user, $params ) {
- $http_method = isset( $_SERVER['REQUEST_METHOD'] ) ? strtoupper( $_SERVER['REQUEST_METHOD'] ) : ''; // WPCS: sanitization ok.
- $request_path = isset( $_SERVER['REQUEST_URI'] ) ? wp_parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH ) : ''; // WPCS: sanitization ok.
+ $http_method = isset( $_SERVER['REQUEST_METHOD'] ) ? strtoupper( $_SERVER['REQUEST_METHOD'] ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Raw credentials and request data are required for OAuth signature verification.
+ $request_path = isset( $_SERVER['REQUEST_URI'] ) ? wp_parse_url( $_SERVER['REQUEST_URI'], PHP_URL_PATH ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Raw credentials and request data are required for OAuth signature verification.
$wp_base = get_home_url( null, '/', 'relative' );
if ( substr( $request_path, 0, strlen( $wp_base ) ) === $wp_base ) {
$request_path = substr( $request_path, strlen( $wp_base ) );
diff --git a/plugins/woocommerce/includes/data-stores/class-wc-coupon-data-store-cpt.php b/plugins/woocommerce/includes/data-stores/class-wc-coupon-data-store-cpt.php
index 9eced768f96..f891c2771b5 100644
--- a/plugins/woocommerce/includes/data-stores/class-wc-coupon-data-store-cpt.php
+++ b/plugins/woocommerce/includes/data-stores/class-wc-coupon-data-store-cpt.php
@@ -547,7 +547,7 @@ class WC_Coupon_Data_Store_CPT extends WC_Data_Store_WP implements WC_Coupon_Dat
global $wpdb;
return $wpdb->get_var(
$this->get_tentative_usage_query_for_user( $coupon_id, $user_aliases )
- ); // WPCS: unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- The interpolated subquery is returned by a helper that prepares all values.
}
/**
@@ -630,14 +630,14 @@ class WC_Coupon_Data_Store_CPT extends WC_Data_Store_WP implements WC_Coupon_Dat
$coupon_usage_key,
'',
$usage_limit
- ); // WPCS: unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- The embedded subqueries and outer values are prepared before interpolation.
/**
* In some cases, specifically when there is a combined index on post_id,meta_key, the insert statement above could end up in a deadlock.
* We will try to insert 3 times before giving up to recover from deadlock.
*/
for ( $count = 0; $count < 3; $count++ ) {
- $result = $wpdb->query( $insert_statement ); // WPCS: unprepared SQL ok.
+ $result = $wpdb->query( $insert_statement ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- The statement is prepared before entering the deadlock-retry loop.
if ( false !== $result ) {
// Clear meta cache.
$this->refresh_coupon_data( $coupon );
@@ -670,7 +670,7 @@ class WC_Coupon_Data_Store_CPT extends WC_Data_Store_WP implements WC_Coupon_Dat
'_coupon_held_' . time(),
$coupon_id,
)
- ); // WPCS: unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- The coupon ID and aliases are prepared; only the trusted postmeta table name is interpolated.
}
/**
@@ -712,7 +712,7 @@ class WC_Coupon_Data_Store_CPT extends WC_Data_Store_WP implements WC_Coupon_Dat
$user_aliases,
array( $coupon->get_id() )
)
- ); // WPCS: unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- The placeholder list is generated locally and all values are prepared.
$query_for_tentative_usages = $this->get_tentative_usage_query_for_user( $coupon->get_id(), $user_aliases );
$db_timestamp = $wpdb->get_var( 'SELECT UNIX_TIMESTAMP() FROM ' . $wpdb->posts . ' LIMIT 1' );
@@ -728,13 +728,13 @@ class WC_Coupon_Data_Store_CPT extends WC_Data_Store_WP implements WC_Coupon_Dat
$coupon_used_by_meta_key,
$user_alias,
$limit_per_user
- ); // WPCS: unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- The embedded subqueries and outer values are prepared before interpolation.
// This query can potentially be deadlocked if a combined index on post_id and meta_key is present and there is
// high concurrency, in which case DB will abort the query which has done less work to resolve deadlock.
// We will try up to 3 times before giving up.
for ( $count = 0; $count < 3; $count++ ) {
- $result = $wpdb->query( $insert_statement ); // WPCS: unprepared SQL ok.
+ $result = $wpdb->query( $insert_statement ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- The statement is prepared before entering the deadlock-retry loop.
if ( false !== $result ) {
// Clear meta cache.
$this->refresh_coupon_data( $coupon );
@@ -776,7 +776,7 @@ class WC_Coupon_Data_Store_CPT extends WC_Data_Store_WP implements WC_Coupon_Dat
),
$user_aliases
)
- ); // WPCS: unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- The placeholder list is generated locally and all values are prepared.
}
/**
diff --git a/plugins/woocommerce/includes/data-stores/class-wc-customer-download-log-data-store.php b/plugins/woocommerce/includes/data-stores/class-wc-customer-download-log-data-store.php
index 2f56df7666e..871470a98d9 100644
--- a/plugins/woocommerce/includes/data-stores/class-wc-customer-download-log-data-store.php
+++ b/plugins/woocommerce/includes/data-stores/class-wc-customer-download-log-data-store.php
@@ -87,7 +87,7 @@ class WC_Customer_Download_Log_Data_Store implements WC_Customer_Download_Log_Da
$table = $wpdb->prefix . self::get_table_name();
// Query the DB for the download log.
- $raw_download_log = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$table} WHERE download_log_id = %d", $download_log->get_id() ) ); // WPCS: unprepared SQL ok.
+ $raw_download_log = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$table} WHERE download_log_id = %d", $download_log->get_id() ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- The table name is an internal constant and the ID uses a %d placeholder.
if ( ! $raw_download_log ) {
throw new Exception( __( 'Invalid download log: not found.', 'woocommerce' ) );
diff --git a/plugins/woocommerce/includes/data-stores/class-wc-webhook-data-store.php b/plugins/woocommerce/includes/data-stores/class-wc-webhook-data-store.php
index ced557bae65..27c5d9320b4 100644
--- a/plugins/woocommerce/includes/data-stores/class-wc-webhook-data-store.php
+++ b/plugins/woocommerce/includes/data-stores/class-wc-webhook-data-store.php
@@ -53,7 +53,7 @@ class WC_Webhook_Data_Store implements WC_Webhook_Data_Store_Interface {
'pending_delivery' => $webhook->get_pending_delivery( 'edit' ),
);
- $wpdb->insert( $wpdb->prefix . 'wc_webhooks', $data ); // WPCS: DB call ok.
+ $wpdb->insert( $wpdb->prefix . 'wc_webhooks', $data ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- This data store owns the formatted write and invalidates webhook caches afterward.
$webhook_id = $wpdb->insert_id;
$webhook->set_id( $webhook_id );
@@ -77,7 +77,7 @@ class WC_Webhook_Data_Store implements WC_Webhook_Data_Store_Interface {
$data = wp_cache_get( $webhook->get_id(), 'webhooks' );
if ( false === $data ) {
- $data = $wpdb->get_row( $wpdb->prepare( "SELECT webhook_id, status, name, user_id, delivery_url, secret, topic, date_created, date_modified, api_version, failure_count, pending_delivery FROM {$wpdb->prefix}wc_webhooks WHERE webhook_id = %d LIMIT 1;", $webhook->get_id() ), ARRAY_A ); // WPCS: cache ok, DB call ok.
+ $data = $wpdb->get_row( $wpdb->prepare( "SELECT webhook_id, status, name, user_id, delivery_url, secret, topic, date_created, date_modified, api_version, failure_count, pending_delivery FROM {$wpdb->prefix}wc_webhooks WHERE webhook_id = %d LIMIT 1;", $webhook->get_id() ), ARRAY_A ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- This data store checks and populates the webhook object cache around the prepared query.
wp_cache_add( $webhook->get_id(), $data, 'webhooks' );
}
@@ -148,7 +148,7 @@ class WC_Webhook_Data_Store implements WC_Webhook_Data_Store_Interface {
array(
'webhook_id' => $webhook->get_id(),
)
- ); // WPCS: DB call ok.
+ ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery -- This data store owns the formatted update and invalidates webhook caches afterward.
$webhook->apply_changes();
@@ -181,7 +181,7 @@ class WC_Webhook_Data_Store implements WC_Webhook_Data_Store_Interface {
'webhook_id' => $webhook->get_id(),
),
array( '%d' )
- ); // WPCS: cache ok, DB call ok.
+ ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- This data store owns the formatted delete; caching a DELETE is not applicable.
$this->delete_transients( 'all' );
wp_cache_delete( $webhook->get_id(), 'webhooks' );
diff --git a/plugins/woocommerce/includes/emails/class-wc-email.php b/plugins/woocommerce/includes/emails/class-wc-email.php
index c90bfbe3a05..7c027ab5e15 100644
--- a/plugins/woocommerce/includes/emails/class-wc-email.php
+++ b/plugins/woocommerce/includes/emails/class-wc-email.php
@@ -1586,7 +1586,7 @@ class WC_Email extends WC_Settings_API {
?>
<?php wc_back_header( $this->get_title(), __( 'Return to emails', 'woocommerce' ), admin_url( 'admin.php?page=wc-settings&tab=email' ) ); ?>
- <?php echo wpautop( wp_kses_post( $this->get_description() ) ); // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped ?>
+ <?php echo wpautop( wp_kses_post( $this->get_description() ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- wp_kses_post() sanitizes the description before wpautop() formats it. ?>
<?php
/**
diff --git a/plugins/woocommerce/includes/gateways/class-wc-payment-gateway-cc.php b/plugins/woocommerce/includes/gateways/class-wc-payment-gateway-cc.php
index 3b04b1bef04..358f8ef7e35 100644
--- a/plugins/woocommerce/includes/gateways/class-wc-payment-gateway-cc.php
+++ b/plugins/woocommerce/includes/gateways/class-wc-payment-gateway-cc.php
@@ -95,7 +95,7 @@ class WC_Payment_Gateway_CC extends WC_Payment_Gateway {
<?php
if ( $this->supports( PaymentGatewayFeature::CREDIT_CARD_FORM_CVC_ON_SAVED_METHOD ) ) {
- echo '<fieldset>' . $cvc_field . '</fieldset>'; // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped
+ echo '<fieldset>' . $cvc_field . '</fieldset>'; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $cvc_field is assembled from fixed markup and escaped dynamic values.
}
}
}
diff --git a/plugins/woocommerce/includes/import/class-wc-product-csv-importer.php b/plugins/woocommerce/includes/import/class-wc-product-csv-importer.php
index e9e8f66439d..517113a8305 100644
--- a/plugins/woocommerce/includes/import/class-wc-product-csv-importer.php
+++ b/plugins/woocommerce/includes/import/class-wc-product-csv-importer.php
@@ -229,7 +229,7 @@ class WC_Product_CSV_Importer extends WC_Product_Importer {
}
// See if the given ID maps to a valid product already.
- $existing_id = $wpdb->get_var( $wpdb->prepare( "SELECT ID FROM {$wpdb->posts} WHERE post_type IN ( 'product', 'product_variation' ) AND ID = %d;", $id ) ); // WPCS: db call ok, cache ok.
+ $existing_id = $wpdb->get_var( $wpdb->prepare( "SELECT ID FROM {$wpdb->posts} WHERE post_type IN ( 'product', 'product_variation' ) AND ID = %d;", $id ) ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- The importer requires a fresh indexed ID lookup that may include newly created placeholders.
if ( $existing_id ) {
return absint( $existing_id );
diff --git a/plugins/woocommerce/includes/rest-api/Controllers/Version2/class-wc-rest-products-v2-controller.php b/plugins/woocommerce/includes/rest-api/Controllers/Version2/class-wc-rest-products-v2-controller.php
index 17b9f0ed43c..ec68f8fb8fc 100644
--- a/plugins/woocommerce/includes/rest-api/Controllers/Version2/class-wc-rest-products-v2-controller.php
+++ b/plugins/woocommerce/includes/rest-api/Controllers/Version2/class-wc-rest-products-v2-controller.php
@@ -396,7 +396,7 @@ class WC_REST_Products_V2_Controller extends WC_REST_CRUD_Controller {
}
if ( ! empty( $tax_query ) ) {
- $args['tax_query'] = $tax_query; // WPCS: slow query ok.
+ $args['tax_query'] = $tax_query; // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_tax_query -- Product taxonomy filters use WordPress's canonical indexed taxonomy tables.
}
// Filter featured.
diff --git a/plugins/woocommerce/includes/rest-api/Controllers/Version2/class-wc-rest-system-status-tools-v2-controller.php b/plugins/woocommerce/includes/rest-api/Controllers/Version2/class-wc-rest-system-status-tools-v2-controller.php
index 18b568eaefb..f7652640ee8 100644
--- a/plugins/woocommerce/includes/rest-api/Controllers/Version2/class-wc-rest-system-status-tools-v2-controller.php
+++ b/plugins/woocommerce/includes/rest-api/Controllers/Version2/class-wc-rest-system-status-tools-v2-controller.php
@@ -628,7 +628,7 @@ class WC_REST_System_Status_Tools_V2_Controller extends WC_REST_Controller {
case 'clear_sessions':
$wpdb->query( "TRUNCATE {$wpdb->prefix}woocommerce_sessions" );
// phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
- $result = absint( $wpdb->query( "DELETE FROM {$wpdb->usermeta} WHERE meta_key='_woocommerce_persistent_cart_" . get_current_blog_id() . "';" ) ); // WPCS: unprepared SQL ok.
+ $result = absint( $wpdb->query( "DELETE FROM {$wpdb->usermeta} WHERE meta_key='_woocommerce_persistent_cart_" . get_current_blog_id() . "';" ) );
wp_cache_flush();
/* translators: %d: number of saved carts */
$message = sprintf( __( 'Deleted all active sessions, and %d saved carts.', 'woocommerce' ), absint( $result ) );
diff --git a/plugins/woocommerce/includes/rest-api/Controllers/Version3/class-wc-rest-product-reviews-controller.php b/plugins/woocommerce/includes/rest-api/Controllers/Version3/class-wc-rest-product-reviews-controller.php
index 0e25996d107..cccab8f099d 100644
--- a/plugins/woocommerce/includes/rest-api/Controllers/Version3/class-wc-rest-product-reviews-controller.php
+++ b/plugins/woocommerce/includes/rest-api/Controllers/Version3/class-wc-rest-product-reviews-controller.php
@@ -405,8 +405,8 @@ class WC_REST_Product_Reviews_Controller extends WC_REST_Controller {
$prepared_review['comment_date_gmt'] = current_time( 'mysql', true );
}
- if ( ! empty( $_SERVER['REMOTE_ADDR'] ) && rest_is_ip_address( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) ) { // WPCS: input var ok, sanitization ok.
- $prepared_review['comment_author_IP'] = wc_clean( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ); // WPCS: input var ok.
+ if ( ! empty( $_SERVER['REMOTE_ADDR'] ) && rest_is_ip_address( wp_unslash( $_SERVER['REMOTE_ADDR'] ) ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Address is validated as an IP before it is unslashed and cleaned.
+ $prepared_review['comment_author_IP'] = wc_clean( wp_unslash( $_SERVER['REMOTE_ADDR'] ) );
} else {
$prepared_review['comment_author_IP'] = '127.0.0.1';
}
diff --git a/plugins/woocommerce/includes/rest-api/Controllers/Version3/class-wc-rest-products-controller.php b/plugins/woocommerce/includes/rest-api/Controllers/Version3/class-wc-rest-products-controller.php
index fc3034341c2..a133d36cbd0 100644
--- a/plugins/woocommerce/includes/rest-api/Controllers/Version3/class-wc-rest-products-controller.php
+++ b/plugins/woocommerce/includes/rest-api/Controllers/Version3/class-wc-rest-products-controller.php
@@ -324,9 +324,9 @@ class WC_REST_Products_Controller extends WC_REST_Products_V2_Controller {
// Build tax_query if taxonomies are set.
if ( ! empty( $tax_query ) ) {
if ( ! empty( $args['tax_query'] ) ) {
- $args['tax_query'] = array_merge( $tax_query, $args['tax_query'] ); // WPCS: slow query ok.
+ $args['tax_query'] = array_merge( $tax_query, $args['tax_query'] ); // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_tax_query -- Product taxonomy filters use WordPress's canonical indexed taxonomy tables.
} else {
- $args['tax_query'] = $tax_query; // WPCS: slow query ok.
+ $args['tax_query'] = $tax_query; // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_tax_query -- Product taxonomy filters use WordPress's canonical indexed taxonomy tables.
}
}
@@ -465,7 +465,7 @@ class WC_REST_Products_Controller extends WC_REST_Products_V2_Controller {
$args['orderby'] = $ordering_args['orderby'];
$args['order'] = $ordering_args['order'];
if ( $ordering_args['meta_key'] ) {
- $args['meta_key'] = $ordering_args['meta_key']; // WPCS: slow query ok.
+ $args['meta_key'] = $ordering_args['meta_key']; // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Core orderings bypass postmeta; this fallback supports extension-defined meta keys.
}
/*
diff --git a/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-cart.php b/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-cart.php
index f273e52669e..04190734cea 100644
--- a/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-cart.php
+++ b/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-cart.php
@@ -26,10 +26,10 @@ class WC_Shortcode_Cart {
$address = array();
- $address['country'] = isset( $_POST['calc_shipping_country'] ) ? wc_clean( wp_unslash( $_POST['calc_shipping_country'] ) ) : ''; // WPCS: input var ok, CSRF ok, sanitization ok.
- $address['state'] = isset( $_POST['calc_shipping_state'] ) ? wc_clean( wp_unslash( $_POST['calc_shipping_state'] ) ) : ''; // WPCS: input var ok, CSRF ok, sanitization ok.
- $address['postcode'] = isset( $_POST['calc_shipping_postcode'] ) ? wc_clean( wp_unslash( $_POST['calc_shipping_postcode'] ) ) : ''; // WPCS: input var ok, CSRF ok, sanitization ok.
- $address['city'] = isset( $_POST['calc_shipping_city'] ) ? wc_clean( wp_unslash( $_POST['calc_shipping_city'] ) ) : ''; // WPCS: input var ok, CSRF ok, sanitization ok.
+ $address['country'] = isset( $_POST['calc_shipping_country'] ) ? wc_clean( wp_unslash( $_POST['calc_shipping_country'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Shipping/cart nonce is verified; address fields are sanitized and validated.
+ $address['state'] = isset( $_POST['calc_shipping_state'] ) ? wc_clean( wp_unslash( $_POST['calc_shipping_state'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Shipping/cart nonce is verified; address fields are sanitized and validated.
+ $address['postcode'] = isset( $_POST['calc_shipping_postcode'] ) ? wc_clean( wp_unslash( $_POST['calc_shipping_postcode'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Shipping/cart nonce is verified; address fields are sanitized and validated.
+ $address['city'] = isset( $_POST['calc_shipping_city'] ) ? wc_clean( wp_unslash( $_POST['calc_shipping_city'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Shipping/cart nonce is verified; address fields are sanitized and validated.
if ( $address['postcode'] ) {
$address['postcode'] = wc_format_postcode( $address['postcode'], $address['country'] );
@@ -82,7 +82,7 @@ class WC_Shortcode_Cart {
$nonce_value = wc_get_var( $_REQUEST['woocommerce-shipping-calculator-nonce'], wc_get_var( $_REQUEST['_wpnonce'], '' ) ); // @codingStandardsIgnoreLine.
// Update Shipping. Nonce check uses new value and old value (woocommerce-cart). @todo remove in 4.0.
- if ( ! empty( $_POST['calc_shipping'] ) && ( wp_verify_nonce( $nonce_value, 'woocommerce-shipping-calculator' ) || wp_verify_nonce( $nonce_value, 'woocommerce-cart' ) ) ) { // WPCS: input var ok.
+ if ( ! empty( $_POST['calc_shipping'] ) && ( wp_verify_nonce( $nonce_value, 'woocommerce-shipping-calculator' ) || wp_verify_nonce( $nonce_value, 'woocommerce-cart' ) ) ) {
self::calculate_shipping();
// Also calc totals before we check items so subtotals etc are up to date.
diff --git a/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-checkout.php b/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-checkout.php
index 46faae2384d..f56d1460e61 100644
--- a/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-checkout.php
+++ b/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-checkout.php
@@ -42,17 +42,17 @@ class WC_Shortcode_Checkout {
}
// Backwards compatibility with old pay and thanks link arguments.
- if ( isset( $_GET['order'] ) && isset( $_GET['key'] ) ) { // WPCS: input var ok, CSRF ok.
+ if ( isset( $_GET['order'] ) && isset( $_GET['key'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only flow selectors are cleaned; order access verifies key/ownership.
wc_deprecated_argument( __CLASS__ . '->' . __FUNCTION__, '2.1', '"order" is no longer used to pass an order ID. Use the order-pay or order-received endpoint instead.' );
// Get the order to work out what we are showing.
- $order_id = absint( $_GET['order'] ); // WPCS: input var ok.
+ $order_id = absint( $_GET['order'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only flow selectors are cleaned; order access verifies key/ownership.
$order = wc_get_order( $order_id );
if ( $order && $order->has_status( OrderStatus::PENDING ) ) {
- $wp->query_vars['order-pay'] = absint( $_GET['order'] ); // WPCS: input var ok.
+ $wp->query_vars['order-pay'] = absint( $_GET['order'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only flow selectors are cleaned; order access verifies key/ownership.
} else {
- $wp->query_vars['order-received'] = absint( $_GET['order'] ); // WPCS: input var ok.
+ $wp->query_vars['order-received'] = absint( $_GET['order'] ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only flow selectors are cleaned; order access verifies key/ownership.
}
}
@@ -85,9 +85,9 @@ class WC_Shortcode_Checkout {
$order_id = absint( $order_id );
// Pay for existing order.
- if ( isset( $_GET['pay_for_order'], $_GET['key'] ) && $order_id ) { // WPCS: input var ok, CSRF ok.
+ if ( isset( $_GET['pay_for_order'], $_GET['key'] ) && $order_id ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only flow selectors are cleaned; order access verifies key/ownership.
try {
- $order_key = isset( $_GET['key'] ) ? wc_clean( wp_unslash( $_GET['key'] ) ) : ''; // WPCS: input var ok, CSRF ok.
+ $order_key = isset( $_GET['key'] ) ? wc_clean( wp_unslash( $_GET['key'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only flow selectors are cleaned; order access verifies key/ownership.
$order = wc_get_order( $order_id );
// Order or payment link is invalid.
@@ -233,7 +233,7 @@ class WC_Shortcode_Checkout {
} elseif ( $order_id ) {
// Pay for order after checkout step.
- $order_key = isset( $_GET['key'] ) ? wc_clean( wp_unslash( $_GET['key'] ) ) : ''; // WPCS: input var ok, CSRF ok.
+ $order_key = isset( $_GET['key'] ) ? wc_clean( wp_unslash( $_GET['key'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only flow selectors are cleaned; order access verifies key/ownership.
$order = wc_get_order( $order_id );
if ( $order && $order->get_id() === $order_id && hash_equals( $order->get_order_key(), $order_key ) ) {
@@ -354,14 +354,14 @@ class WC_Shortcode_Checkout {
// Get checkout object.
$checkout = WC()->checkout();
- if ( empty( $_POST ) && wc_notice_count( 'error' ) > 0 ) { // WPCS: input var ok, CSRF ok.
+ if ( empty( $_POST ) && wc_notice_count( 'error' ) > 0 ) { // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only flow selectors are cleaned; order access verifies key/ownership.
wc_get_template( 'checkout/cart-errors.php', array( 'checkout' => $checkout ) );
wc_clear_notices();
} else {
- $non_js_checkout = ! empty( $_POST['woocommerce_checkout_update_totals'] ); // WPCS: input var ok, CSRF ok.
+ $non_js_checkout = ! empty( $_POST['woocommerce_checkout_update_totals'] ); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only flow selectors are cleaned; order access verifies key/ownership.
if ( wc_notice_count( 'error' ) === 0 && $non_js_checkout ) {
wc_add_notice( __( 'The order totals have been updated. Please confirm your order by pressing the "Place order" button at the bottom of the page.', 'woocommerce' ) );
diff --git a/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-my-account.php b/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-my-account.php
index 5c9cfa4923a..0b5fe9198eb 100644
--- a/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-my-account.php
+++ b/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-my-account.php
@@ -247,14 +247,14 @@ class WC_Shortcode_My_Account {
/**
* After sending the reset link, don't show the form again.
*/
- if ( ! empty( $_GET['reset-link-sent'] ) ) { // WPCS: input var ok, CSRF ok.
+ if ( ! empty( $_GET['reset-link-sent'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only UI selector; login and path are normalized downstream.
wc_get_template( 'myaccount/lost-password-confirmation.php' );
return;
/**
* Process reset key / login from email confirmation link
*/
- } elseif ( ! empty( $_GET['show-reset-form'] ) ) { // WPCS: input var ok, CSRF ok.
+ } elseif ( ! empty( $_GET['show-reset-form'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only UI selector; login and path are normalized downstream.
if ( isset( $_COOKIE[ 'wp-resetpass-' . COOKIEHASH ] ) && 0 < strpos( $_COOKIE[ 'wp-resetpass-' . COOKIEHASH ], ':' ) ) { // @codingStandardsIgnoreLine
list( $rp_id, $rp_key ) = array_map( 'wc_clean', explode( ':', wp_unslash( $_COOKIE[ 'wp-resetpass-' . COOKIEHASH ] ), 2 ) ); // @codingStandardsIgnoreLine
$userdata = get_userdata( absint( $rp_id ) );
@@ -293,7 +293,7 @@ class WC_Shortcode_My_Account {
* @return bool True: when finish. False: on error
*/
public static function retrieve_password() {
- $login = isset( $_POST['user_login'] ) ? sanitize_user( wp_unslash( $_POST['user_login'] ) ) : ''; // WPCS: input var ok, CSRF ok.
+ $login = isset( $_POST['user_login'] ) ? sanitize_user( wp_unslash( $_POST['user_login'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Read-only UI selector; login and path are normalized downstream.
if ( empty( $login ) ) {
@@ -436,7 +436,7 @@ class WC_Shortcode_My_Account {
*/
public static function set_reset_password_cookie( $value = '' ) {
$rp_cookie = 'wp-resetpass-' . COOKIEHASH;
- $rp_path = isset( $_SERVER['REQUEST_URI'] ) ? current( explode( '?', wp_unslash( $_SERVER['REQUEST_URI'] ) ) ) : ''; // WPCS: input var ok, sanitization ok.
+ $rp_path = isset( $_SERVER['REQUEST_URI'] ) ? current( explode( '?', wp_unslash( $_SERVER['REQUEST_URI'] ) ) ) : ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Read-only UI selector; login and path are normalized downstream.
if ( $value ) {
setcookie( $rp_cookie, $value, 0, $rp_path, COOKIE_DOMAIN, is_ssl(), true );
diff --git a/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-order-tracking.php b/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-order-tracking.php
index 2151c69e9ab..977090d7860 100644
--- a/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-order-tracking.php
+++ b/plugins/woocommerce/includes/shortcodes/class-wc-shortcode-order-tracking.php
@@ -39,10 +39,10 @@ class WC_Shortcode_Order_Tracking {
$atts = shortcode_atts( array(), $atts, 'woocommerce_order_tracking' );
$nonce_value = wc_get_var( $_REQUEST['woocommerce-order-tracking-nonce'], wc_get_var( $_REQUEST['_wpnonce'], '' ) ); // @codingStandardsIgnoreLine.
- if ( isset( $_REQUEST['orderid'] ) && wp_verify_nonce( $nonce_value, 'woocommerce-order_tracking' ) ) { // WPCS: input var ok.
+ if ( isset( $_REQUEST['orderid'] ) && wp_verify_nonce( $nonce_value, 'woocommerce-order_tracking' ) ) {
- $order_id = empty( $_REQUEST['orderid'] ) ? 0 : ltrim( wc_clean( wp_unslash( $_REQUEST['orderid'] ) ), '#' ); // WPCS: input var ok.
- $order_email = empty( $_REQUEST['order_email'] ) ? '' : sanitize_email( wp_unslash( $_REQUEST['order_email'] ) ); // WPCS: input var ok.
+ $order_id = empty( $_REQUEST['orderid'] ) ? 0 : ltrim( wc_clean( wp_unslash( $_REQUEST['orderid'] ) ), '#' );
+ $order_email = empty( $_REQUEST['order_email'] ) ? '' : sanitize_email( wp_unslash( $_REQUEST['order_email'] ) );
if ( ! $order_id ) {
wc_print_notice( __( 'Please enter a valid order ID', 'woocommerce' ), 'error' );
diff --git a/plugins/woocommerce/includes/wc-account-functions.php b/plugins/woocommerce/includes/wc-account-functions.php
index 459f4341c48..a5d0071e76f 100644
--- a/plugins/woocommerce/includes/wc-account-functions.php
+++ b/plugins/woocommerce/includes/wc-account-functions.php
@@ -31,7 +31,7 @@ function wc_lostpassword_url( $default_url = '' ) {
}
// Don't redirect to the woocommerce endpoint on global network admin lost passwords.
- if ( is_multisite() && isset( $_GET['redirect_to'] ) && false !== strpos( wp_unslash( $_GET['redirect_to'] ), network_admin_url() ) ) { // WPCS: input var ok, sanitization ok, CSRF ok.
+ if ( is_multisite() && isset( $_GET['redirect_to'] ) && false !== strpos( wp_unslash( $_GET['redirect_to'] ), network_admin_url() ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Value is compared only with network_admin_url(); it is not used as a redirect.
return $default_url;
}
diff --git a/plugins/woocommerce/includes/wc-attribute-functions.php b/plugins/woocommerce/includes/wc-attribute-functions.php
index cc60db61341..2eacac6fee4 100644
--- a/plugins/woocommerce/includes/wc-attribute-functions.php
+++ b/plugins/woocommerce/includes/wc-attribute-functions.php
@@ -626,7 +626,7 @@ function wc_create_attribute( $args ) {
$wpdb->update(
$wpdb->termmeta,
array( 'meta_key' => 'order' ), // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key
- array( 'meta_key' => 'order_pa_' . sanitize_title( $old_slug ) ) // WPCS: slow query ok.
+ array( 'meta_key' => 'order_pa_' . sanitize_title( $old_slug ) ) // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- This one-time attribute migration updates an indexed termmeta key.
);
// Update product attributes which use this taxonomy.
@@ -658,8 +658,8 @@ function wc_create_attribute( $args ) {
// Update variations which use this taxonomy.
$wpdb->update(
$wpdb->postmeta,
- array( 'meta_key' => 'attribute_pa_' . sanitize_title( $data['attribute_name'] ) ), // WPCS: slow query ok.
- array( 'meta_key' => 'attribute_pa_' . sanitize_title( $old_slug ) ) // WPCS: slow query ok.
+ array( 'meta_key' => 'attribute_pa_' . sanitize_title( $data['attribute_name'] ) ), // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- This array key is update data, not a query meta_key argument.
+ array( 'meta_key' => 'attribute_pa_' . sanitize_title( $old_slug ) ) // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- This one-time attribute migration matches an indexed postmeta key.
);
// Update global vars to reflect migration. This ensures any functions dealing with terms later in this request
diff --git a/plugins/woocommerce/includes/wc-cart-functions.php b/plugins/woocommerce/includes/wc-cart-functions.php
index 41e5ee9968a..1701aa083ee 100644
--- a/plugins/woocommerce/includes/wc-cart-functions.php
+++ b/plugins/woocommerce/includes/wc-cart-functions.php
@@ -183,7 +183,7 @@ function wc_clear_cart_after_payment() {
if ( ! empty( $wp->query_vars['order-received'] ) ) {
$order_id = absint( $wp->query_vars['order-received'] );
- $order_key = isset( $_GET['key'] ) ? wc_clean( wp_unslash( $_GET['key'] ) ) : ''; // WPCS: input var ok, CSRF ok.
+ $order_key = isset( $_GET['key'] ) ? wc_clean( wp_unslash( $_GET['key'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Raw referer is sanitized and validated by its consumers.
if ( $order_id > 0 ) {
$order = wc_get_order( $order_id );
diff --git a/plugins/woocommerce/includes/widgets/class-wc-widget-layered-nav-filters.php b/plugins/woocommerce/includes/widgets/class-wc-widget-layered-nav-filters.php
index 3c352fe6a5d..960161b7dbd 100644
--- a/plugins/woocommerce/includes/widgets/class-wc-widget-layered-nav-filters.php
+++ b/plugins/woocommerce/includes/widgets/class-wc-widget-layered-nav-filters.php
@@ -45,9 +45,9 @@ class WC_Widget_Layered_Nav_Filters extends WC_Widget {
}
$_chosen_attributes = WC_Query::get_layered_nav_chosen_attributes();
- $min_price = isset( $_GET['min_price'] ) ? wc_clean( wp_unslash( $_GET['min_price'] ) ) : 0; // WPCS: input var ok, CSRF ok.
- $max_price = isset( $_GET['max_price'] ) ? wc_clean( wp_unslash( $_GET['max_price'] ) ) : 0; // WPCS: input var ok, CSRF ok.
- $rating_filter = isset( $_GET['rating_filter'] ) ? array_filter( array_map( 'absint', explode( ',', wp_unslash( $_GET['rating_filter'] ) ) ) ) : array(); // WPCS: sanitization ok, input var ok, CSRF ok.
+ $min_price = isset( $_GET['min_price'] ) ? wc_clean( wp_unslash( $_GET['min_price'] ) ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only filter; values are cleaned or cast.
+ $max_price = isset( $_GET['max_price'] ) ? wc_clean( wp_unslash( $_GET['max_price'] ) ) : 0; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only filter; values are cleaned or cast.
+ $rating_filter = isset( $_GET['rating_filter'] ) ? array_filter( array_map( 'absint', explode( ',', wp_unslash( $_GET['rating_filter'] ) ) ) ) : array(); // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Public read-only filter; values are cleaned or cast.
$base_link = $this->get_current_page_url();
if ( 0 < count( $_chosen_attributes ) || 0 < $min_price || 0 < $max_price || ! empty( $rating_filter ) ) {
@@ -76,7 +76,7 @@ class WC_Widget_Layered_Nav_Filters extends WC_Widget {
}
$filter_name = 'filter_' . wc_attribute_taxonomy_slug( $taxonomy );
- $current_filter = isset( $_GET[ $filter_name ] ) ? explode( ',', wc_clean( wp_unslash( $_GET[ $filter_name ] ) ) ) : array(); // WPCS: input var ok, CSRF ok.
+ $current_filter = isset( $_GET[ $filter_name ] ) ? explode( ',', wc_clean( wp_unslash( $_GET[ $filter_name ] ) ) ) : array(); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only filter; values are cleaned or cast.
$current_filter = array_map( 'sanitize_title', $current_filter );
$new_filter = array_diff( $current_filter, array( $term_slug ) );
diff --git a/plugins/woocommerce/includes/widgets/class-wc-widget-price-filter.php b/plugins/woocommerce/includes/widgets/class-wc-widget-price-filter.php
index b9d4599c9d5..cba01a08109 100644
--- a/plugins/woocommerce/includes/widgets/class-wc-widget-price-filter.php
+++ b/plugins/woocommerce/includes/widgets/class-wc-widget-price-filter.php
@@ -81,7 +81,7 @@ class WC_Widget_Price_Filter extends WC_Widget {
}
// If there are not posts and we're not filtering, hide the widget.
- if ( ! WC()->query->get_main_query()->post_count && ! isset( $_GET['min_price'] ) && ! isset( $_GET['max_price'] ) ) { // WPCS: input var ok, CSRF ok.
+ if ( ! WC()->query->get_main_query()->post_count && ! isset( $_GET['min_price'] ) && ! isset( $_GET['max_price'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only filter; values are unslashed and converted to numbers.
return;
}
@@ -116,8 +116,8 @@ class WC_Widget_Price_Filter extends WC_Widget {
return;
}
- $current_min_price = isset( $_GET['min_price'] ) ? floor( floatval( wp_unslash( $_GET['min_price'] ) ) / $step ) * $step : $min_price; // WPCS: input var ok, CSRF ok.
- $current_max_price = isset( $_GET['max_price'] ) ? ceil( floatval( wp_unslash( $_GET['max_price'] ) ) / $step ) * $step : $max_price; // WPCS: input var ok, CSRF ok.
+ $current_min_price = isset( $_GET['min_price'] ) ? floor( floatval( wp_unslash( $_GET['min_price'] ) ) / $step ) * $step : $min_price; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only filter; values are unslashed and converted to numbers.
+ $current_max_price = isset( $_GET['max_price'] ) ? ceil( floatval( wp_unslash( $_GET['max_price'] ) ) / $step ) * $step : $max_price; // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Public read-only filter; values are unslashed and converted to numbers.
$this->widget_start( $args, $instance );
diff --git a/plugins/woocommerce/includes/widgets/class-wc-widget-products.php b/plugins/woocommerce/includes/widgets/class-wc-widget-products.php
index cfed14759d8..3e412c86373 100644
--- a/plugins/woocommerce/includes/widgets/class-wc-widget-products.php
+++ b/plugins/woocommerce/includes/widgets/class-wc-widget-products.php
@@ -108,7 +108,7 @@ class WC_Widget_Products extends WC_Widget {
'tax_query' => array(
'relation' => 'AND',
),
- ); // WPCS: slow query ok.
+ ); // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query -- The empty query containers do not add database joins.
if ( empty( $instance['show_hidden'] ) ) {
$query_args['tax_query'][] = array(
diff --git a/plugins/woocommerce/includes/widgets/class-wc-widget-rating-filter.php b/plugins/woocommerce/includes/widgets/class-wc-widget-rating-filter.php
index 669038860b1..bbc2b1644b5 100644
--- a/plugins/woocommerce/includes/widgets/class-wc-widget-rating-filter.php
+++ b/plugins/woocommerce/includes/widgets/class-wc-widget-rating-filter.php
@@ -76,7 +76,7 @@ class WC_Widget_Rating_Filter extends WC_Widget {
$sql .= ' AND ' . $search;
}
- return absint( $wpdb->get_var( $sql ) ); // WPCS: unprepared SQL ok.
+ return absint( $wpdb->get_var( $sql ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared -- All dynamic fragments are produced and prepared by WP_Meta_Query, WP_Tax_Query, and WC_Query.
}
/**
@@ -98,7 +98,7 @@ class WC_Widget_Rating_Filter extends WC_Widget {
ob_start();
$found = false;
- $rating_filter = isset( $_GET['rating_filter'] ) ? array_filter( array_map( 'absint', explode( ',', wp_unslash( $_GET['rating_filter'] ) ) ) ) : array(); // WPCS: input var ok, CSRF ok, sanitization ok.
+ $rating_filter = isset( $_GET['rating_filter'] ) ? array_filter( array_map( 'absint', explode( ',', wp_unslash( $_GET['rating_filter'] ) ) ) ) : array(); // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- Read-only filter; every rating component is cast.
$base_link = remove_query_arg( 'paged', $this->get_current_page_url() );
$this->widget_start( $args, $instance );
diff --git a/plugins/woocommerce/includes/widgets/class-wc-widget-recently-viewed.php b/plugins/woocommerce/includes/widgets/class-wc-widget-recently-viewed.php
index d3ac44a256d..b957fe6b3e7 100644
--- a/plugins/woocommerce/includes/widgets/class-wc-widget-recently-viewed.php
+++ b/plugins/woocommerce/includes/widgets/class-wc-widget-recently-viewed.php
@@ -78,7 +78,7 @@ class WC_Widget_Recently_Viewed extends WC_Widget {
'terms' => ProductStockStatus::OUT_OF_STOCK,
'operator' => 'NOT IN',
),
- ); // WPCS: slow query ok.
+ ); // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query -- The taxonomy filter is bounded to the non-empty recently viewed product ID list.
}
$r = new WP_Query( apply_filters( 'woocommerce_recently_viewed_products_widget_query_args', $query_args ) );
diff --git a/plugins/woocommerce/src/Admin/API/Reports/Coupons/Stats/Segmenter.php b/plugins/woocommerce/src/Admin/API/Reports/Coupons/Stats/Segmenter.php
index 57b55e8d0f4..d14fd96cf09 100644
--- a/plugins/woocommerce/src/Admin/API/Reports/Coupons/Stats/Segmenter.php
+++ b/plugins/woocommerce/src/Admin/API/Reports/Coupons/Stats/Segmenter.php
@@ -106,7 +106,7 @@ class Segmenter extends ReportsSegmenter {
GROUP BY
$segmenting_groupby",
ARRAY_A
- ); // WPCS: cache ok, DB call ok, unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Report results are cached by the containing data store; direct aggregate SQL is intentional.
$totals_segments = $this->merge_segment_totals_results( $segmenting_dimension_name, $segments_products, array() );
return $totals_segments;
@@ -154,7 +154,7 @@ class Segmenter extends ReportsSegmenter {
time_interval, $segmenting_groupby
$segmenting_limit",
ARRAY_A
- ); // WPCS: cache ok, DB call ok, unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Report results are cached by the containing data store; direct aggregate SQL is intentional.
$intervals_segments = $this->merge_segment_intervals_results( $segmenting_dimension_name, $segments_products, array() );
return $intervals_segments;
@@ -191,7 +191,7 @@ class Segmenter extends ReportsSegmenter {
GROUP BY
$segmenting_groupby",
ARRAY_A
- ); // WPCS: cache ok, DB call ok, unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Report results are cached by the containing data store; direct aggregate SQL is intentional.
// Reformat result.
$totals_segments = $this->reformat_totals_segments( $totals_segments, $segmenting_groupby );
@@ -235,7 +235,7 @@ class Segmenter extends ReportsSegmenter {
time_interval, $segmenting_groupby
$segmenting_limit",
ARRAY_A
- ); // WPCS: cache ok, DB call ok, unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Report results are cached by the containing data store; direct aggregate SQL is intentional.
// Reformat result.
$intervals_segments = $this->reformat_intervals_segments( $intervals_segments, $segmenting_groupby );
diff --git a/plugins/woocommerce/src/Admin/API/Reports/Products/DataStore.php b/plugins/woocommerce/src/Admin/API/Reports/Products/DataStore.php
index 05e7304a589..6cac9773371 100644
--- a/plugins/woocommerce/src/Admin/API/Reports/Products/DataStore.php
+++ b/plugins/woocommerce/src/Admin/API/Reports/Products/DataStore.php
@@ -635,7 +635,7 @@ class DataStore extends ReportsDataStore implements DataStoreInterface {
'%f', // shipping_tax_amount.
'%f', // product_gross_revenue.
)
- ); // WPCS: cache ok, DB call ok, unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- This data store owns the formatted analytics write; caching a write is not applicable.
/**
* Fires when product's reports are updated.
diff --git a/plugins/woocommerce/src/Admin/API/Reports/Products/Stats/Segmenter.php b/plugins/woocommerce/src/Admin/API/Reports/Products/Stats/Segmenter.php
index 16524cd9724..2bea506c5c4 100644
--- a/plugins/woocommerce/src/Admin/API/Reports/Products/Stats/Segmenter.php
+++ b/plugins/woocommerce/src/Admin/API/Reports/Products/Stats/Segmenter.php
@@ -72,7 +72,7 @@ class Segmenter extends ReportsSegmenter {
GROUP BY
$segmenting_groupby",
ARRAY_A
- ); // WPCS: cache ok, DB call ok, unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Report results are cached by the containing data store; direct aggregate SQL is intentional.
$totals_segments = $this->merge_segment_totals_results( $segmenting_dimension_name, $segments_products, array() );
return $totals_segments;
@@ -124,7 +124,7 @@ class Segmenter extends ReportsSegmenter {
time_interval, $segmenting_groupby
$segmenting_limit",
ARRAY_A
- ); // WPCS: cache ok, DB call ok, unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Report results are cached by the containing data store; direct aggregate SQL is intentional.
$intervals_segments = $this->merge_segment_intervals_results( $segmenting_dimension_name, $segments_products, array() );
return $intervals_segments;
diff --git a/plugins/woocommerce/src/Admin/API/Reports/Taxes/Stats/DataStore.php b/plugins/woocommerce/src/Admin/API/Reports/Taxes/Stats/DataStore.php
index f1c15045b6a..73a872753a3 100644
--- a/plugins/woocommerce/src/Admin/API/Reports/Taxes/Stats/DataStore.php
+++ b/plugins/woocommerce/src/Admin/API/Reports/Taxes/Stats/DataStore.php
@@ -156,7 +156,7 @@ class DataStore extends ReportsDataStore implements DataStoreInterface {
$query .= $wpdb->prepare( " WHERE tax_rate_id IN ({$tax_placeholders})", $args['include'] );
/* phpcs:enable */
}
- return $wpdb->get_results( $query, ARRAY_A ); // WPCS: cache ok, DB call ok, unprepared SQL ok.
+ return $wpdb->get_results( $query, ARRAY_A ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.NotPrepared -- This data store intentionally reads current tax-rate settings; identifiers are trusted and optional IDs are prepared.
}
/**
diff --git a/plugins/woocommerce/src/Admin/API/Reports/Taxes/Stats/Segmenter.php b/plugins/woocommerce/src/Admin/API/Reports/Taxes/Stats/Segmenter.php
index 944dca14037..f4017fe81c9 100644
--- a/plugins/woocommerce/src/Admin/API/Reports/Taxes/Stats/Segmenter.php
+++ b/plugins/woocommerce/src/Admin/API/Reports/Taxes/Stats/Segmenter.php
@@ -64,7 +64,7 @@ class Segmenter extends ReportsSegmenter {
GROUP BY
$segmenting_groupby",
ARRAY_A
- ); // WPCS: cache ok, DB call ok, unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Report results are cached by the containing data store; direct aggregate SQL is intentional.
// Reformat result.
$totals_segments = $this->reformat_totals_segments( $totals_segments, $segmenting_groupby );
@@ -115,7 +115,7 @@ class Segmenter extends ReportsSegmenter {
time_interval, $segmenting_groupby
$segmenting_limit",
ARRAY_A
- ); // WPCS: cache ok, DB call ok, unprepared SQL ok.
+ ); // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching -- Report results are cached by the containing data store; direct aggregate SQL is intentional.
// Reformat result.
$intervals_segments = $this->reformat_intervals_segments( $intervals_segments, $segmenting_groupby );
diff --git a/plugins/woocommerce/src/Admin/Features/OnboardingTasks/Tasks/Tax.php b/plugins/woocommerce/src/Admin/Features/OnboardingTasks/Tasks/Tax.php
index 22f6a95be6e..29c009476ec 100644
--- a/plugins/woocommerce/src/Admin/Features/OnboardingTasks/Tasks/Tax.php
+++ b/plugins/woocommerce/src/Admin/Features/OnboardingTasks/Tasks/Tax.php
@@ -38,8 +38,8 @@ class Tax extends Task {
* Adds a return to task list notice when completing the task.
*/
public function possibly_add_return_notice_script() {
- $page = isset( $_GET['page'] ) ? $_GET['page'] : ''; // phpcs:ignore csrf ok, sanitization ok.
- $tab = isset( $_GET['tab'] ) ? $_GET['tab'] : ''; // phpcs:ignore csrf ok, sanitization ok.
+ $page = isset( $_GET['page'] ) ? $_GET['page'] : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Values are used only in strict comparisons and never reach a sink.
+ $tab = isset( $_GET['tab'] ) ? $_GET['tab'] : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized, WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Values are used only in strict comparisons and never reach a sink.
if ( $page !== 'wc-settings' || $tab !== 'tax' ) {
return;
diff --git a/plugins/woocommerce/src/Internal/Admin/Orders/ListTable.php b/plugins/woocommerce/src/Internal/Admin/Orders/ListTable.php
index 9b5b3943686..4dba6d82c86 100644
--- a/plugins/woocommerce/src/Internal/Admin/Orders/ListTable.php
+++ b/plugins/woocommerce/src/Internal/Admin/Orders/ListTable.php
@@ -1649,7 +1649,7 @@ class ListTable extends WP_List_Table {
// Check if any status changes happened.
foreach ( $order_statuses as $slug => $name ) {
- if ( 'marked_' . str_replace( 'wc-', '', $slug ) === $bulk_action ) { // WPCS: input var ok, CSRF ok.
+ if ( 'marked_' . str_replace( 'wc-', '', $slug ) === $bulk_action ) {
/* translators: %s: orders count */
$message = sprintf( _n( '%s order status changed.', '%s order statuses changed.', $number, 'woocommerce' ), number_format_i18n( $number ) );
break;
diff --git a/plugins/woocommerce/src/Internal/Admin/SystemStatusReport.php b/plugins/woocommerce/src/Internal/Admin/SystemStatusReport.php
index a59a9f0d9bf..7af7628a7c7 100644
--- a/plugins/woocommerce/src/Internal/Admin/SystemStatusReport.php
+++ b/plugins/woocommerce/src/Internal/Admin/SystemStatusReport.php
@@ -87,7 +87,7 @@ class SystemStatusReport {
<td data-export-label="Enabled Features">
<?php esc_html_e( 'Enabled Features', 'woocommerce' ); ?>:
</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Which features are enabled?', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Which features are enabled?', 'woocommerce' ) ); ?></td>
<td>
<?php
echo esc_html( implode( ', ', array_keys( $enabled_features ) ) )
@@ -99,7 +99,7 @@ class SystemStatusReport {
<td data-export-label="Disabled Features">
<?php esc_html_e( 'Disabled Features', 'woocommerce' ); ?>:
</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Which features are disabled?', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Which features are disabled?', 'woocommerce' ) ); ?></td>
<td>
<?php
echo esc_html( implode( ', ', array_keys( $disabled_features ) ) )
@@ -122,7 +122,7 @@ class SystemStatusReport {
<td data-export-label="Daily Cron">
<?php esc_html_e( 'Daily Cron', 'woocommerce' ); ?>:
</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Is the daily cron job active, when does it next run?', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Is the daily cron job active, when does it next run?', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( $next_action_time ) {
@@ -155,7 +155,7 @@ class SystemStatusReport {
<td data-export-label="Options">
<?php esc_html_e( 'Options', 'woocommerce' ); ?>:
</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Do the important options return expected values?', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Do the important options return expected values?', 'woocommerce' ) ); ?></td>
<td>
<?php
if ( $all_options_expected ) {
@@ -180,7 +180,7 @@ class SystemStatusReport {
<td data-export-label="Notes">
<?php esc_html_e( 'Notes', 'woocommerce' ); ?>:
</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'How many notes in the database?', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'How many notes in the database?', 'woocommerce' ) ); ?></td>
<td>
<?php
echo esc_html( $notes_count )
@@ -210,7 +210,7 @@ class SystemStatusReport {
<td data-export-label="Onboarding">
<?php esc_html_e( 'Onboarding', 'woocommerce' ); ?>:
</td>
- <td class="help"><?php echo wc_help_tip( esc_html__( 'Was onboarding completed or skipped?', 'woocommerce' ) ); /* phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped */ ?></td>
+ <td class="help"><?php echo wc_help_tip( esc_html__( 'Was onboarding completed or skipped?', 'woocommerce' ) ); ?></td>
<td>
<?php
echo esc_html( $onboarding_state )
diff --git a/plugins/woocommerce/templates/cart/cart-shipping.php b/plugins/woocommerce/templates/cart/cart-shipping.php
index 67dcc09c3d3..08caa6576a2 100644
--- a/plugins/woocommerce/templates/cart/cart-shipping.php
+++ b/plugins/woocommerce/templates/cart/cart-shipping.php
@@ -33,9 +33,9 @@ $calculator_text = '';
<li>
<?php
if ( 1 < count( $available_methods ) ) {
- printf( '<input type="radio" name="shipping_method[%1$d]" data-index="%1$d" id="shipping_method_%1$d_%2$s" value="%3$s" class="shipping_method" %4$s />', $index, esc_attr( sanitize_title( $method->id ) ), esc_attr( $method->id ), checked( $method->id, $chosen_method, false ) ); // WPCS: XSS ok.
+ printf( '<input type="radio" name="shipping_method[%1$d]" data-index="%1$d" id="shipping_method_%1$d_%2$s" value="%3$s" class="shipping_method" %4$s />', $index, esc_attr( sanitize_title( $method->id ) ), esc_attr( $method->id ), checked( $method->id, $chosen_method, false ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $index is an integer; the remaining values are escaped or safe attribute markup.
} else {
- printf( '<input type="hidden" name="shipping_method[%1$d]" data-index="%1$d" id="shipping_method_%1$d_%2$s" value="%3$s" class="shipping_method" />', $index, esc_attr( sanitize_title( $method->id ) ), esc_attr( $method->id ) ); // WPCS: XSS ok.
+ printf( '<input type="hidden" name="shipping_method[%1$d]" data-index="%1$d" id="shipping_method_%1$d_%2$s" value="%3$s" class="shipping_method" />', $index, esc_attr( sanitize_title( $method->id ) ), esc_attr( $method->id ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $index is an integer and the remaining attribute values are escaped.
}
printf( '<label for="shipping_method_%1$s_%2$s">%3$s</label>', $index, esc_attr( sanitize_title( $method->id ) ), wc_cart_totals_shipping_method_label( $method ) ); // WPCS: XSS ok.
do_action( 'woocommerce_after_shipping_rate', $method, $index );
diff --git a/plugins/woocommerce/templates/content-single-product.php b/plugins/woocommerce/templates/content-single-product.php
index f881a50a7f9..6595e24e20b 100644
--- a/plugins/woocommerce/templates/content-single-product.php
+++ b/plugins/woocommerce/templates/content-single-product.php
@@ -27,7 +27,7 @@ global $product;
do_action( 'woocommerce_before_single_product' );
if ( post_password_required() ) {
- echo get_the_password_form(); // WPCS: XSS ok.
+ echo get_the_password_form(); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- get_the_password_form() returns WordPress-generated form markup.
return;
}
?>
diff --git a/plugins/woocommerce/templates/single-product/add-to-cart/simple.php b/plugins/woocommerce/templates/single-product/add-to-cart/simple.php
index c33409fcc71..1ae8fbb0405 100644
--- a/plugins/woocommerce/templates/single-product/add-to-cart/simple.php
+++ b/plugins/woocommerce/templates/single-product/add-to-cart/simple.php
@@ -39,7 +39,7 @@ if ( $product->is_in_stock() ) : ?>
array(
'min_value' => $product->get_min_purchase_quantity(),
'max_value' => $product->get_max_purchase_quantity(),
- 'input_value' => isset( $_POST['quantity'] ) ? wc_stock_amount( wp_unslash( $_POST['quantity'] ) ) : $product->get_min_purchase_quantity(), // WPCS: CSRF ok, input var ok.
+ 'input_value' => isset( $_POST['quantity'] ) ? wc_stock_amount( wp_unslash( $_POST['quantity'] ) ) : $product->get_min_purchase_quantity(), // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Template repopulates quantity; wc_stock_amount() normalizes it.
)
);
diff --git a/plugins/woocommerce/templates/single-product/add-to-cart/variation-add-to-cart-button.php b/plugins/woocommerce/templates/single-product/add-to-cart/variation-add-to-cart-button.php
index 81960d75c5e..0999f2df8a5 100644
--- a/plugins/woocommerce/templates/single-product/add-to-cart/variation-add-to-cart-button.php
+++ b/plugins/woocommerce/templates/single-product/add-to-cart/variation-add-to-cart-button.php
@@ -21,7 +21,7 @@ global $product;
array(
'min_value' => $product->get_min_purchase_quantity(),
'max_value' => $product->get_max_purchase_quantity(),
- 'input_value' => isset( $_POST['quantity'] ) ? wc_stock_amount( wp_unslash( $_POST['quantity'] ) ) : $product->get_min_purchase_quantity(), // WPCS: CSRF ok, input var ok.
+ 'input_value' => isset( $_POST['quantity'] ) ? wc_stock_amount( wp_unslash( $_POST['quantity'] ) ) : $product->get_min_purchase_quantity(), // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Template repopulates quantity; wc_stock_amount() normalizes it.
)
);
diff --git a/plugins/woocommerce/tests/legacy/unit-tests/rest-api/Tests/Version3/reports-customers-totals.php b/plugins/woocommerce/tests/legacy/unit-tests/rest-api/Tests/Version3/reports-customers-totals.php
index 4c2f49f815a..32c1d12da23 100644
--- a/plugins/woocommerce/tests/legacy/unit-tests/rest-api/Tests/Version3/reports-customers-totals.php
+++ b/plugins/woocommerce/tests/legacy/unit-tests/rest-api/Tests/Version3/reports-customers-totals.php
@@ -57,7 +57,7 @@ class WC_Tests_API_Reports_Customers_Totals extends WC_REST_Unit_Test_Case {
'number' => 0,
'fields' => 'ID',
'count_total' => true,
- 'meta_query' => array( // WPCS: slow query ok.
+ 'meta_query' => array( // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_query -- Test setup intentionally mirrors the legacy production query shape.
array(
'key' => 'paying_customer',
'value' => 1,
diff --git a/plugins/woocommerce/tests/legacy/unit-tests/rest-api/Tests/Version3/reports-reviews-totals.php b/plugins/woocommerce/tests/legacy/unit-tests/rest-api/Tests/Version3/reports-reviews-totals.php
index 2c2a915f5e1..157f1997414 100644
--- a/plugins/woocommerce/tests/legacy/unit-tests/rest-api/Tests/Version3/reports-reviews-totals.php
+++ b/plugins/woocommerce/tests/legacy/unit-tests/rest-api/Tests/Version3/reports-reviews-totals.php
@@ -46,8 +46,8 @@ class WC_Tests_API_Reports_Reviews_Totals extends WC_REST_Unit_Test_Case {
$query_data = array(
'count' => true,
'post_type' => 'product',
- 'meta_key' => 'rating', // WPCS: slow query ok.
- 'meta_value' => '', // WPCS: slow query ok.
+ 'meta_key' => 'rating', // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_key -- Test setup intentionally mirrors the legacy production query shape.
+ 'meta_value' => '', // phpcs:ignore WordPress.DB.SlowDBQuery.slow_db_query_meta_value -- Test setup intentionally mirrors the legacy production query shape.
);
for ( $i = 1; $i <= 5; $i++ ) {