Theme Sniffer Issues - Githubissues

valendesigns / option-tree

Theme Options UI Builder for WordPress. A simple way to create & save Theme Options and Meta Boxes for free or premium themes.

GNU General Public License v2.0

610 stars 181 forks source link

Theme Sniffer Issues #697

Closed anteksiler closed 5 years ago

anteksiler commented 5 years ago

There are various errors that are raised by the Theme Sniffer plugin: https://wordpress.org/plugins/theme-sniffer/

It is used by the official WordPress review theme, so fixing these issues should be crucial.

For example:

Multiple placeholders should be ordered. Expected '%1$s, %2$s, %3$s, %4$s', but got %s, %s, %s, %s.
Silencing errors is forbidden; found: @explode

valendesigns commented 5 years ago

You cannot include OT in WP.org themes anymore. That’s not been allowed for a few years now. I’ll fix some of these but having it pass the theme review is not a priority.

anteksiler commented 5 years ago

True, but keeping with these standards should improve compatibility and security.

valendesigns commented 5 years ago

Neither of those have to do with security and compatibility is only in the context of theme mode which is not supported by wp.org the first one should definitely be fixed but the second is debatable. Are these the only issues or are there more?

anteksiler commented 5 years ago

There are other issues, most of them related to escaping variables for security.

Use placeholders and $wpdb->prepare(); found interpolated variable $table_name at "SELECT * FROM $table_name ORDER BY item_sort ASC"
INI directive 'safe_mode' is deprecated since PHP 5.3 and removed since PHP 5.4
Detected usage of a non-sanitized input variable: $_GET
Detected usage of a non-sanitized input variable: $_POST
Function create_function() is deprecated since PHP 7.2; Use an anonymous function instead

There are easier ones like replacing "htmlspecialchars_decode" with "wp_specialchars_decode"

valendesigns commented 5 years ago

The plugin is rigorously following WordPress standards and all variables are properly sanitized and escaped, but I’ll double check. The reason that review is failing is because it doesn’t respect the phpcs:ignore directive. I added several because the code is safely escaped and sanitized and code sniffers are not always right.

I’m not trying to discount your concerns here but you have to understand the amount of effort to get it to where it is and what your asking for is another level of complexity that may create more issues than it solves. I’ll run the plugin over the code to see what it thinks is broke and fix actual issues. However, I’m not going to make it theme review compatible. It’s not something that can be done 100% and this is a plugin not a theme.

anteksiler commented 5 years ago

Fair enough :) Thanks for all the work you put into this plugin.