Closed grappler closed 6 years ago
ERROR | Verify that
the_post_thumbnail()
is found at least once if the theme has aadd_theme_support( 'post-thumbnails' )
call. This should become an error if the theme is tagged withfeatured-image
.
We'd also want to check against either of these two functions:
get_the_post_thumbnail()
get_post_thumbnail_id()
FYI:
I SOLVE YOUR PROBLEM I HAVE DONE SAME WORK IN PAST
@manishsaini1126 that reads a bit spammy, could you please clarify if you genuinely want to get involved with this. :)
can you please briefly describe your problem
The topic is described in great detail in the opening post.
Hi all,
I've had a discussion with @dingo-d today about the future of this ticket and the WPTRT-CS repo.
Progress has been very slow over the past year (and a half), but should speed up significantly over the next few weeks as @dingo-d intends to have a working prototype of the new ThemeCheck plugin which would use the WPTRT-CS ruleset ready for WCEU.
Looking back over how development has flowed so far, generally speaking, any sniffs which were created for WPTRT-CS which would benefit the wider WP community - not just the TRT - have been pulled here in WPCS and included in WPTRT-CS via the ruleset. Only the few sniffs which are really theme specific have been pulled to the WPTRT-CS fork, these currently are:
FileInclude
- discourage use of include(_once)
and require(_once)
as in themes, more often than not get_template_part()
should be used instead.NoAddAdminPages
- forbid adding admin pages anywhere but in the Theme submenu.NoAutogenerate
- forbids auto generated themes.NoFavicon
- checks for hardcoded favicons instead of using the WP core implementation.NoTitleTag
- forbid the use of the <title>
tag as add_theme_support( 'title-tag' )
should be used instead.PluginTerritory
- forbid the use of functions which add functionality and should be in plugins instead, think add_shortcode()
and register_post_type()
.Some more will be added in the near future, but they will be along the same lines.
All these sniffs - with NoFavicon
possibly being the only exception - are very theme specific and would not be applicable to Core, VIP or plugin development.
So....
The original idea was that the WPTRT-CS would be a fork in the development phase, but would merge back into WPCS once the majority of development was done. This is how things are still currently set up.
But merging WPTRT-CS back into WPCS would introduce these theme specific sniffs into the WordPress
ruleset which for most users of WPCS will be undesirable.
As the new theme sniffer would use Composer anyway, the WPTRT-CS repo could be transformed to be a new standard in its own right (like the VIP repo), which would pull PHPCS and WPCS in as dependencies and can use the WPCS (and PHPCS) sniffs by referencing them in the ruleset.
This will also create more clarity for maintenance of the WPTRT-CS repo as it can be unclear now for contributors when something needs to be pulled here in WPCS and when something needs to be pulled to WPTRT-CS. It would also allow the WPTRT-CS more freedom in creating their own categories for sniffs and dropping PHPCS 2.x support already in favour of PHPCS 3.x.
So, @dingo-d and me would like to hear some opinions, please vote for either of these options:
Your input is appreciated!
/cc @grappler @WordPress-Coding-Standards/wpcs-admins
@Rarst can we discs now and sorry me not reply your msg
FYI: I've re-ordered the list of sniffable rules into "Done" and "To do" to get a better overview of where this project is at.
I would be OK with option 1, but number 3 may make the most sense at this point.
I'm 100% behind number 3.
Just as WPCS builds on top of (has a dependency on) PHPCS by using some sniffs from it and including our own, for the benefit of the WP subsection of the PHP community, so should WPTRT-CS build on top of (have a dependency on) WPCS by using some of our sniffs and including their own, for the benefit of the TRT (and theme builders) subsection of the WP community.
Number 3 :)
Also, I would like to see some sniffs for:
wp_remote_*()
functions. I've seen them used to get (sometimes post) lists of themes, changelogs and other stuff.@acosmin Would you mind checking if there are issues open for the two sniffs you mention in the TRT fork repo ? If not, could you open issues for this there ?
wp_remote_*()
functions. I've seen them used to get (sometimes post) lists of themes, changelogs and other stuff.
What sort of sniffs do we need for wp_remote_*()
? We've traditionally allowed wp_remote_get()
in themes for displaying on an admin page. A good example is having a "child themes" admin page for displaying all of the current theme's children. Even I use it in at least one theme.
@justintadlock @acosmin Please have the discussion about wp_remote_get()
in the TRT repo.
FYI: the split off of the Theme Review repo from WPCS has been finalized.
The Theme Review CS repo can now be found here: https://github.com/WPTRT/WPThemeReview
Any work which was originally contained in WPCS and remains in TRTCS (most notably three WPCS deprecated sniffs, but also some dev files) has been cherrypicked to the new WPThemeReview develop
to maintain credits and copyright.
A number of the open items mentioned in the original issue + in the comments have not (yet) been turned into issues in the TRTCS repo. If anyone from the TRT fancies doing so, it would be very helpful and very welcome indeed!
I am opening this issue after discussing this with @GaryJones, @westonruter, @fklein-lu, @jrf & @Rarst at the WCEU contributors day and showing this to the theme review admins and @samuelsidler before publishing. This is one part of the project to improve the theme review process.
Action plan:
develop
branch, set up TC to use PHPCS and WPCS for at least part of the checks and start working on a deploy script which pulls in the dependencies via composer.We'd need two new rulesets:
A number of these sniffs are not - like a typical sniff - valid for each file, but need to sniff if something is sone at least once in any of the files. So we might need to add a wrapper for those particular sniff in the Theme Check bootstrap to run those against each file and only report if a positive/negative results was returned for all.
Rules which can probably be turned into a sniff:
get_role()
,current_user_can()
,current_user_can_for_blog()
,user_can()
,add_..._page()
. https://github.com/WPTRT/WordPress-Coding-Standards/issues/27 / PR: https://github.com/WPTRT/WordPress-Coding-Standards/pull/36add_theme_page()
is used. Otheradd_..._page()
functions not allowed. https://github.com/WPTRT/WordPress-Coding-Standards/issues/11 / PR: https://github.com/WPTRT/WordPress-Coding-Standards/pull/13show_admin_bar( false )
is called or ifadd_filter( 'show_admin_bar', '__return_false' )
is somewhere in the code. https://github.com/WPTRT/WordPress-Coding-Standards/issues/1remove_action( 'wp_head', '_admin_bar_bump_cb' );
display: none
CSS identifiers:#wpadmin
and.show-admin-bar
These last two are suggested as warning as they will be less precise and need manual verification.
eval()
,ini_set
,popen()
,proc_open
,exec()
,shell_exec()
,system()
,passthru()
,base64_decode()
,base64_encode
,uudecode()
,str_rot13()
. List need proper review when creating the sniff (also look at the original regexes in the Theme Check plugin) https://github.com/WPTRT/WordPress-Coding-Standards/issues/9 / PR: https://github.com/WPTRT/WordPress-Coding-Standards/pull/10 This can probably be an extended class of one of the related checks likeWordPress.PHP.DiscouragedFunctions
orGeneric.PHP.ForbiddenFunctions
.cx=[0-9]{21}:[a-z0-9]{10}
orpub-[0-9]{16}
https://github.com/WPTRT/WordPress-Coding-Standards/issues/125->add_setting()
for the Customizer include asanitize_callback
or asanitize_js_callback
parameter and that it's non-empty. An exception will need to be made for the (two) calls found inKirki_Settings
as they do correctly comply, but are wrappers for the real call. https://github.com/WPTRT/WordPress-Coding-Standards/issues/68 / PR: https://github.com/WPTRT/WordPress-Coding-Standards/issues/76wp_deregister_script()
isn't called. https://github.com/WPTRT/WordPress-Coding-Standards/issues/21 / PR: https://github.com/WPTRT/WordPress-Coding-Standards/pull/26 This is basically meant to only check that core scripts aren't being deregistered, however maintaining a list of core scripts for that purpose would be a maintenance nightmare, so returning a warning when any such call is encountered is the current solution.<iframe
s (often used for malicious code). https://github.com/WPTRT/WordPress-Coding-Standards/issues/22 / PR: https://github.com/WPTRT/WordPress-Coding-Standards/pull/109include(_once)
orrequire(_once)
(where they should useget_template_part()
). https://github.com/WPTRT/WordPress-Coding-Standards/issues/66 / PR: https://github.com/WPTRT/WordPress-Coding-Standards/pull/67 Current implementation excluded thefunctions.php
file from this check. We may want to continue doing so.Generic.Files.LineEndings
should be sufficient for this. https://github.com/WPTRT/WordPress-Coding-Standards/issues/3 / PR: https://github.com/WPTRT/WordPress-Coding-Standards/pull/7 https://github.com/WPTRT/WordPress-Coding-Standards/pull/90(register|wp)_nav_menu()
function, the theme should only use a variable for the menu name. No hard-coded menu names allowed. https://github.com/WPTRT/WordPress-Coding-Standards/issues/93[\x00-\x08\x0B-\x0C\x0E-\x1F\x80-\xFF]
. Quite possibly there will be an existing sniff somewhere we could re-use for this. https://github.com/WPTRT/WordPress-Coding-Standards/issues/94Generic.PHP.DisallowShortOpenTag
sniff. https://github.com/WPTRT/WordPress-Coding-Standards/issues/2 / PR: https://github.com/WPTRT/WordPress-Coding-Standards/pull/6Generic
or add to extend the above mentioned sniff to cover this.Generic.PHP.DisallowShortOpenTag
sniff to an XML specific one. https://github.com/WPTRT/WordPress-Coding-Standards/issues/95register_post_type()
,register_taxonomy()
,add_shortcode()
. https://github.com/WPTRT/WordPress-Coding-Standards/issues/73 / PR: https://github.com/WPTRT/WordPress-Coding-Standards/pull/81 Review this list with the Theme Review board as there might be some more functions which could be added. The sniff could probably just extend the Forbidden Functions sniff - though it should be kept as a separate sniff for clarity.searchform.php
are found, if they are, recommend usingget_search_form()
instead. https://github.com/WPTRT/WordPress-Coding-Standards/issues/74 / PR: https://github.com/WPTRT/WordPress-Coding-Standards/pull/82style.css
whether the required headers are found. See Theme-Check plugin - /checks/style_needed.php for the list.style.css
whether the two recommended headers are found. See Theme-Check plugin - /checks/style_suggested.php for the list.Tags
in thestyle.css
file header comply with the current guidelines (allowed tags, deprecated tags (=> WARNING) etc). See Theme-Check plugin - /checks/style_tags.php for the list.style.css
file header tag list and add a warning that an accessibility review is needed. https://github.com/WPTRT/WordPress-Coding-Standards/issues/24<title..
isn't used except for in inlineSVG
code. https://github.com/WPTRT/WordPress-Coding-Standards/issues/25 / PR: https://github.com/WPTRT/WordPress-Coding-Standards/pull/41wp_title()
. https://github.com/WPTRT/WordPress-Coding-Standards/issues/97style.css
for theAuthor URI
and ThemeURI
and verify that these are not the same.style.css
that the ThemeURI
does not point towordpress.org
(with predefined list of themes which are exempt and live under thewordpressdotorg
user or have a check based on Author name - see the current check in checks/uri.php).Rules which can probably be turned into a sniff but would need to be run against every file before a positive/negative result can be determined:
add_theme_support()
call is made for any feature the theme has been tagged with from the following list:custom-background
,custom-header
,custom-menu
,featured-images/post-thumbnails
,post-formats
,custom-logo
comment_reply
string or rather any HTML identifiers needed for the JS script to work are present (need more info) (comments should always be supported by themes, enqueuing the script alone is not enough)paginate_comments_links()
,the_comments_navigation()
,the_comments_pagination()
,next_comments_link()
orprevious_comments_link()
$content_width
or within a function usingglobal $content_width; $content_width =...
or$GLOBALS['content_width']
. Note: currently the Theme Check plugin also checks for filters onembed_defaults
andcontent_width
and passes if those are found. Those checks are outdated and should not be ported.add_editor_style()
call is made if the theme has been tagged witheditor-style
.get_avatar()
orwp_list_comments()
is used at least once.(register|wp)_nav_menu()
is used at least once. This should become an error if the theme is tagged withcustom-menu
.(get_post_format()|has_format()
or CSS rules covering.format
are found, at least once if the theme has aadd_theme_support( 'post-format' )
call. This should become an error if the theme is tagged withpost-formats
.posts_nav_link()
,paginate_links()
,the_posts_navigation()
,the_posts_pagination()
,next_posts_link()
orprevious_posts_link()
the_post_thumbnail()
is found at least once if the theme has aadd_theme_support( 'post-thumbnails' )
call. This should become an error if the theme is tagged withfeatured-image
.the_tags()
,get_the_tag_list()
,get_the_term_list()
add_theme_support( 'title-tag' )
is used in at least one file.register_sidebar()
ordynamic_sidebar()
is made.register_sidebar()
is found, make sure there is at least one call todynamic_sidebar()
as well and visa versa.register_sidebar()
function is called with anadd_action( 'widget_init', ... )
call.Rules which would need another solution (like in the bootstrap file which would run PHPCS from the Theme-check plugin within an install):
add_theme_support()
..git
,.svn
,.hg
,.bzr
. These should not exist in the repo. Exact list of exclusions should be re-determined in conjunction with the theme review board. This should include both system as well as development related directories.thumbs.db
,.DS_Store
, travis config, PHPCS config.zip
files etc. For a list, see Theme-Check plugin - /checks/filenames.php. These should not exist in the repo. Zips are often plugin files and are not allowed to be shipped with a theme either. Exact list of exclusions should be re-determined in conjunction with the theme review board. Again, this should include both system as well as development related files.index.php
andstyle.css
.readme.txt
file exists.style.css
file header and again be consistent.