Fix security, bugs, and UX issues from PR #49 review#50
Merged
Conversation
- Add capability checks (manage_categories) to all AJAX handlers - Fix XSS: escape slug/taxonomy in HTML attributes and JS href contexts - Fix XSS: escape term names and URLs in AJAX response messages - Fix bug: Redirection group option key mismatch (redirect_group vs redirection_group) causing new group creation on every merge - Fix bug: inverted condition always recreating Redirection group - Fix bug: get_term_link called after term deletion; capture permalink in pre_delete_term hook instead - Add merge action to categories and custom taxonomies, not just tags - Scope redirect tool admin notice to edit-tags screens only - Scope MutationObserver to #the-list instead of document.body - Use rest_base from taxonomy object for REST API endpoints - Set allowHTML: false on Choices.js instances - Fix typo: cannnot -> cannot Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Test on Playground |
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Consolidate the two separate wp_options entries (fewer_tags scalar and fewer_tags_pro array) into a single fewer_tags array option. The Option singleton is now the single source of truth. - Change Option class to use 'fewer_tags' instead of 'fewer_tags_pro' - Remove Plugin::$option_name, read min_posts_count from Option singleton - Expand migrate_option() to handle all upgrade scenarios idempotently - Add sanitize_callback to preserve other array keys when saving settings - Update settings field name/id for nested array structure - Remove fewer_tags_pro cleanup from uninstall.php Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Filip Ilic <ilic.filip@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes issues identified during code review of #49:
Security
manage_categoriescapability checks to all 4 AJAX handlers (merge, redirect, dismiss, get_just_deleted_term) — previously any authenticated user could call these$slugand$taxonomywithesc_attr()in HTML attributes andesc_js()injavascript:href contexts (class-helper.php)esc_html()and URLs withesc_url()in AJAX response messages (class-admin-ajax.php)allowHTML: falseon all Choices.js instances to prevent HTML injection via term namesBugs
redirect_groupbut writingredirection_group, causing a new group to be created on every merge!empty || !is_int→empty || !is_int) that also caused unnecessary group recreationget_term_link()called insidedelete_termhook (term already deleted at that point, returnsWP_Error); now captures permalink inpre_delete_termhookcategory_row_actions) and custom taxonomies ({taxonomy}_row_actions), not just tags — matching the PR description's cross-taxonomy claimUX / Performance
edit-tagsscreens only (was showing on every admin page)MutationObserverfor element removal to#the-listinstead ofdocument.bodyrest_basefrom taxonomy REST response for API endpoints (supports custom REST bases)Test plan
composer check-cspassescomposer phpstanpasses🤖 Generated with Claude Code