search

TGMPA / TGM-Plugin-Activation

TGM Plugin Activation is a PHP library that allows you to easily require or recommend plugins for your WordPress themes (and plugins). It allows your users to install, update and even automatically activate plugins in singular or bulk fashion using native WordPress classes, functions and interfaces. You can reference bundled plugins, plugins from the WordPress Plugin Repository or even plugins hosted elsewhere on the internet.
http://tgmpluginactivation.com/
GNU General Public License v2.0
1.76k stars 430 forks source link

ThemeForest version #590

Closed evgeniyshay closed 7 years ago

evgeniyshay commented 8 years ago

ThemeForest requirements now include esc_html__(), esc_attr() instead of () & esc_html_e(), esc_attr_e() instead of _e().

GaryJones commented 8 years ago

@evgeniyshay Could you please link to the TF requirements documentation?

evgeniyshay commented 8 years ago

This is part of out theme review message on ThemeForest

  1. Data Validation issues have been found in your theme. All dynamic data must be correctly escaped for the context where it is rendered. - http://codex.wordpress.org/Data_Validation - http://developer.wordpress.com/themes/escaping/ - https://vip.wordpress.com/2014/06/20/the-importance-of-escaping-all-the-things/ We are taking extra precautions with security issues now. Please perform a global search for "echo quot; and escape ALL outputs. This will help ensure there are no security issues.
  2. Validate, sanitize and escape all data: https://codex.wordpress.org/Validating_Sanitizing_and_Escaping_User_Data also go over https://make.wordpress.org/themes/tags/writing-secure-themes/ And by the way ThemeForest forbit more than one text domain in the theme, that's why theme text domain must use in plugin activator class too, like in your wordpress.org package.

2016-05-18 18:23 GMT+03:00 Gary Jones notifications@github.com:

@evgeniyshay https://github.com/evgeniyshay Could you please link to the TF requirements documentation?

— You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub https://github.com/TGMPA/TGM-Plugin-Activation/issues/590#issuecomment-220061788

jrfnl commented 8 years ago

@evgeniyshay Regarding the escaping: TGMPA escapes all strings, but - as one should - strings are escaped late, i.e. at the point where they are echo-ed out as only then you know the context in which the string is used. In some cases, this means that escaping and translation is not done in the same call. Escaping all strings at the point of translation does not make sense and will lead to double escaped strings.

@Stephen-Cronin Could you enlighten us about the above ?

And by the way ThemeForest forbit more than one text domain in the theme, that's why theme text domain must use in plugin activator class too, like in your wordpress.org package.

Looking at the message, I get the impression that the tgmpa text-domain is no longer allowed in contrast to what was discussed earlier in #519. Is that true ? In that case, there is no difference in requirements anymore between wp.org and Themeforest and we could merge these two select options into one for the Custom Generator.

Please let me know and I'll adjust the CG if necessary.

evgeniyshay commented 8 years ago

I know that this is not make sense, but themeforest reviewers looking for code patters in themes and maybe have no time to take code to a pieces but they return theme themes with soft reject. Author can try to explain, but I am not sure that theme doesn't return with same reject. That's why this not make sense, but it save the time on review. Yes you are right and now it is no difference between wordpress.org & themeforest requirements.

2016-05-19 3:51 GMT+03:00 Juliette notifications@github.com:

@evgeniyshay https://github.com/evgeniyshay Regarding the escaping: TGMPA escapes all strings, but - as one should - strings are escaped late, i.e. at the point where they are echo-ed out as only then you know the context in which the string is used. In some cases, this means that escaping and translation is not done in the same call. Escaping all strings at the point of translation does not make sense and will lead to double escaped strings.

@Stephen-Cronin https://github.com/Stephen-Cronin Could you enlighten us about the above ?

And by the way ThemeForest forbit more than one text domain in the theme, that's why theme text domain must use in plugin activator class too, like in your wordpress.org package.

Looking at the message, I get the impression that the tgmpa text-domain is no longer allowed in contrast to what was discussed earlier in #519 https://github.com/TGMPA/TGM-Plugin-Activation/pull/519. Is that true ? In that case, there is no difference in requirements anymore between wp.org and Themeforest and we could merge these two select options into one for the Custom Generator.

Please let me know and I'll adjust the CG if necessary.

— You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub https://github.com/TGMPA/TGM-Plugin-Activation/issues/590#issuecomment-220199747

GaryJones commented 8 years ago

Author can try to explain, but I am not sure that theme doesn't return with same reject.

Then @Stephen-Cronin needs to jump in to educate their reviewers and allow them time to understand what is technically correct. It's not up to TGMPA (or other project) to apply inconsistent or bad security practices just to pass checks.

Uranbold commented 8 years ago

Anyone has all Text domain has changed and escaped version for themeforest. No matter how i explained to Reviewer they reject at least once and keep telling theme doesn't need 2 different text domain.

Stephen-Cronin commented 8 years ago

Sorry missed this the first time around.

@Uranbold - Having a separate text domain for TGMPA is fine for ThemeForest. If you are soft rejected for that reason, then when you're resubmitting, just add a note for the reviewer to check with me. Sorry for any confusion.

@evgeniyshay - Hmm, I'll look into that. Which account were you using on ThemeForest? I'd like to look at a real eg. Maybe lodge a ticket with some details and say I asked for it to be directed to me. Thanks.

Uranbold commented 8 years ago

@Stephen-Cronin Thanks for clarification.

But Downloading this plugin for WP.org is fine solution. I think TGM Generator for Themeforest is working little bit wrong.

Stephen-Cronin commented 8 years ago

@Uranbold - yep, if you use the wp.org version then it will be accepted on TF without any problem. But the TF version should also be accepted!

With the specific issue of text domains, we do allow a separate one for TGMPA. If you use it, then you can use the translations that come with TGMPA. If you use the wp.org version, those translations won't work. So if a reviewer rejects a theme for that reason, please resubmit and ask to check with me. :)

Or you can also lodge a ticket with some details (asking for it to be directed to me) and I can look into that specific case. :)