w3guy / persist-admin-notices-dismissal

Simple plugin that persists dismissal of admin notices across pages in WordPress dashboard.
http://w3guy.com/wordpress-admin-notices-dismissible/
87 stars 22 forks source link

A few minor code improvements #13

Closed dangoodman closed 5 years ago

dangoodman commented 7 years ago

Hi,

Thank you for the nice tool.

I've applied a few minor changes removing some unnecessary code. That's how I'm going to use it in my projects.

Each commit has a brief motivation. Let me know if I can describe it better,

Would be great if you merge this to the main repo.

afragen commented 7 years ago
  1. Removing a README file, in general, may leave the user with no clear idea of how to implement the code in their project.

  2. A direct file call check is considered a somewhat standard security measure to avoid potential XSS errors.

  3. There is absolutely a reason to check if the class_exists. If someone else has included this framework and there is no class_exists a PHP fatal will occur. Not everyone will use Composer autoloader and it's simple enough to mitigate.

dangoodman commented 7 years ago
  1. Well, if someone found this github project how can they miss the README file? On other hand, end users of a plugin using this lib don't need this file at all.

  2. Do you have an idea how one could exploit this for XSS with this particular file?

afragen commented 7 years ago

Well, if someone found this github project how can they miss the README file? On other hand, end users of a plugin using this lib don't need this file at all.

Do you have an idea how one could exploit this for XSS with this particular file?

I don't know of any particular exploit but what's the harm? Same can be said of leaving the README, what's the harm. It certainly isn't that much overhead to downloading. Maybe your user will want to now why you've included this in your project?

dangoodman commented 7 years ago

What's the harm of leaving .gitignore and composer.json files in the exported archive then? However, they are export-ignore'd.

We can also add a bunch of useless code to the file and it won't harm too.

Basically, the less is more. The less code we can keep the better tool we get.