refactor: `WordPress.Security.EscapeOutput.OutputNotEscaped`, `WordPress.Security.EscapeOutput.ExceptionNotEscaped` escaping

All Submissions:

[x] My code follows the WordPress' coding standards
[x] My code satisfies feature requirements
[x] My code is tested
[x] My code passes the PHPCS tests
[x] My code has proper inline documentation
[ ] I've included related pull request(s) (optional)
[ ] I've included developer documentation (optional)
[x] I've added proper labels to this pull request

Changes proposed in this Pull Request:

This PR addresses security issues identified in the Dokan plugin for WordPress. It implements necessary fixes and improvements to enhance the plugin's security and protect against potential vulnerabilities.

Related Pull Request(s)

Closes

Closes #

How to test the changes in this Pull Request:

Review the changes made to the codebase to address the security issues.
Perform thorough testing, including manual testing and automated testing, to ensure the plugin's functionality is not affected by the security fixes.
Perform security testing or engage with security experts to validate the effectiveness of the implemented security measures.

Changelog entry

improved: WordPress security issues fix: The parameter "$drop_down_tags" at position #2 of get_terms() has been deprecated since WordPress version 4.5.0. Instead do not pass the parameter.

This update addresses several security issues identified in the Dokan plugin for WordPress. It implements necessary fixes and improvements to enhance the plugin's security and protect against potential vulnerabilities. The changes include sanitizing user inputs, validating data, escaping outputs, and implementing proper access controls and authentication mechanisms.

Before Changes

The Dokan plugin had security vulnerabilities that could potentially lead to security breaches, such as cross-site scripting (XSS), SQL injection, or unauthorized access to sensitive data or functionality.

After Changes

After the changes, the Dokan plugin has enhanced security measures in place, with user inputs sanitized, data validated, outputs escaped, and proper access controls and authentication mechanisms implemented. This significantly reduces the risk of security vulnerabilities and ensures a more secure environment for plugin users.

Feature Video (optional)

N/A

PR Self Review Checklist:

[x] Code is following code style guidelines
[x] Code has appropriate naming conventions
[x] Code follows the KISS principle
[x] Code follows the DRY principle
[x] Code is readable and self-explanatory
[x] Code has no performance issues
[x] Code has no grammar errors

FOR PR REVIEWER ONLY:

As a reviewer, your feedback should be focused on the idea, not the person. Seek to understand, be respectful, and focus on constructive dialog.

As a contributor, your responsibility is to learn from suggestions and iterate your pull request should it be needed based on feedback. Seek to collaborate and produce the best possible contribution to the greater whole.

Correct — Does the change do what it's supposed to? ie: code 100% fulfilling the requirements?
Secure — Would a nefarious party find some way to exploit this change? ie: everything is sanitized/escaped appropriately for any SQL or XSS injection possibilities?
Readable — Will your future self be able to understand this change months down the road?
Elegant — Does the change fit aesthetically within the overall style and architecture?

Summary by CodeRabbit

Bug Fixes
- Enhanced security by sanitizing and escaping user inputs in various admin and setup wizard scripts.
- Corrected variable assignments and added output escaping for widget titles and attributes in multiple widgets.
Chores
- Updated PHPCS configuration to include wc_esc_json for custom sanitizing functions.

[!WARNING]

Review failed

The head commit changed during the review from b0480e7aa77bf0c7b26e6acd79e50ae579f52249 to b8e5cc330615c67754160ea7c02d1f3602008a66.

Walkthrough

The recent changes primarily focus on enhancing security across various components by sanitizing and escaping user inputs, ensuring safe output handling, and improving code readability. These updates span multiple files, including adjustments to function calls, refactoring variable assignments, and updating error messages for better security practices.

Changes

Files	Summary of Changes
`includes/Admin/Hooks.php`	Modified `wc_help_tip` function call with sanitization using `wp_kses` and `esc_html__`.
`includes/Admin/SetupWizard.php`	Updated `printf` function call to use `esc_html` and reordered assignment operations for withdraw settings.
`includes/Admin/SetupWizardNoWC.php`	Replaced `wc_clean` with `sanitize_text_field` for form field sanitization.
`includes/Admin/SetupWizardWCAdmin.php`	Escaped output in data attributes for checkboxes and input fields.
`includes/Ajax.php`	Adjusted increment operator positions, added sanitization for `wpautop`, and revised product tag search logic.
`includes/Customizer/HeadingControl.php`	Used `wp_kses` for sanitizing descriptions before echoing.
`includes/Order/Admin/Hooks.php`	Added `wp_kses_post` to sanitize output in custom columns.
`includes/REST/ProductController.php`	Used `esc_html` to escape error messages for better security.
`includes/ReverseWithdrawal/ReverseWithdrawal.php`	Added comments for escaping output in `_doing_it_wrong` calls.
`includes/Traits/ChainableContainer.php`	Improved error messages in `__clone` and `__wakeup` methods.
`includes/Widgets/BestSellingProducts.php`	Escaped output for widget titles and content using `wp_kses_post`.
`includes/Widgets/FilterByAttributes.php`	Corrected variable assignments and added output escaping.
`includes/Widgets/ProductCategoryMenu.php`	Updated parameter names and modified `get_terms` function call.
`...Widgets/StoreCategoryMenu.php`	Updated parameter names for consistency in `widget` and `update` functions.
`phpcs.xml.dist`	Added `wc_esc_json` to `customSanitizingFunctions` and included `vendor_staff` for better rule handling.

Poem

Amidst the lines of PHP code,
Security’s tale begins to unfold.
With wp_kses and esc_html by side,
Safeguarding data with pride.
Inputs cleaned and outputs pure,
Our code’s resilience they ensure.
Hoppily sanitized, the changes we sing,
In a safe realm, the code will spring.

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)

Tips

### Chat There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai): - Review comments: Directly reply to a review comment made by CodeRabbit. Example: - `I pushed a fix in commit .` - `Generate unit testing code for this file.` - `Open a follow-up GitHub issue for this discussion.` - Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples: - `@coderabbitai generate unit testing code for this file.` - `@coderabbitai modularize this function.` - PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples: - `@coderabbitai generate interesting stats about this repository and render them as a table.` - `@coderabbitai show all the console.log statements in this repository.` - `@coderabbitai read src/utils.ts and generate unit testing code.` - `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.` - `@coderabbitai help me debug CodeRabbit configuration file.` Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. ### CodeRabbit Commands (invoked as PR comments) - `@coderabbitai pause` to pause the reviews on a PR. - `@coderabbitai resume` to resume the paused reviews. - `@coderabbitai review` to trigger an incremental review. This is useful when automatic reviews are disabled for the repository. - `@coderabbitai full review` to do a full review from scratch and review all the files again. - `@coderabbitai summary` to regenerate the summary of the PR. - `@coderabbitai resolve` resolve all the CodeRabbit review comments. - `@coderabbitai configuration` to show the current CodeRabbit configuration for the repository. - `@coderabbitai help` to get help. Additionally, you can add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed. ### CodeRabbit Configration File (`.coderabbit.yaml`) - You can programmatically configure CodeRabbit by adding a `.coderabbit.yaml` file to the root of your repository. - Please see the [configuration documentation](https://docs.coderabbit.ai/guides/configure-coderabbit) for more information. - If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: `# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json` ### Documentation and Community - Visit our [Documentation](https://coderabbit.ai/docs) for detailed information on how to use CodeRabbit. - Join our [Discord Community](https://discord.com/invite/GsXnASn26c) to get help, request features, and share feedback. - Follow us on [X/Twitter](https://twitter.com/coderabbitai) for updates and announcements.

getdokan / dokan