Skip to content

Commit f41a287

Browse files
LS-1952: Address Plugin Check security and WPCS issues for TO Reviews (#231)
* fix: add ABSPATH check to prevent direct access in multiple files * fix: rename metabox variable for consistency and clarity in config-review.php * fix: ignore PHPCS warning for non-prefixed hook name in class-to-review-schema.php fix: remove unnecessary load_plugin_textdomain action in class-to-reviews-admin.php * fix: update tested version to 7.0 in README.txt * fix: update post-title block to make title linkable in review-card.php --------- Co-authored-by: krugazul <krugazul@gmail.com>
1 parent 2534118 commit f41a287

9 files changed

Lines changed: 62 additions & 45 deletions

File tree

README.txt

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Contributors: feedmymedia, lightspeedwp, eleshar, krugazul
33
Donate link: https://lightspeedwp.agency/donate/
44
Tags: lsx, tour operator, travel, tourism, reviews
55
Requires at least: 6.7
6-
Tested up to: 6.9
6+
Tested up to: 7.0
77
Requires PHP: 8.0
88
Stable tag: 2.2
99
License: GPLv3 or later
@@ -13,29 +13,29 @@ This plugin adds reviews to tours, accommodation and destinations.
1313

1414
== Description ==
1515

16-
If you haven't yet had the chance to [install and configure the Tour Operator Plugin](https://touroperator.solutions/), you should do that before proceeding here!
16+
If you haven't yet had the chance to [install and configure the Tour Operator Plugin](https://touroperator.solutions/), you should do that before proceeding here!
1717

18-
People want to be sure that they’re making the right choice with the the right company. Your offerings aren’t that different from many other competitors, but it’s your “trustability” that will set you apart from the herd.
18+
People want to be sure that they’re making the right choice with the the right company. Your offerings aren’t that different from many other competitors, but it’s your “trustability” that will set you apart from the herd.
1919

2020
The Tour Operators Reviews extension allows you to add reviews written by your previous guests and display them across your site, whether on the homepage, or one of the Tour Operator post type pages (accommodation, destinations and tours).
2121

2222
== Works with the LSX Theme ==
2323

24-
The [Tour Operator Plugin](https://touroperator.solutions/) and [Extensions](https://touroperator.solutions/) are designed to work seamlessly with the LSX theme.
24+
The [Tour Operator Plugin](https://touroperator.solutions/) and [Extensions](https://touroperator.solutions/) are designed to work seamlessly with the LSX theme.
2525

26-
We are always updating our software to add functionality, and maintain latest security protocols.
26+
We are always updating our software to add functionality, and maintain latest security protocols.
2727

2828
== Gutenberg Compatible ==
2929

30-
Have you updated to the new WordPress Gutenberg editor? We've got you covered! The Tour Operator Reviews Plugin has been optimized for the Gutenberg update.
30+
Have you updated to the new WordPress Gutenberg editor? We've got you covered! The Tour Operator Reviews Plugin has been optimized for the Gutenberg update.
3131

3232
Check out our [our Tour Operator dedicated website](https://touroperator.solutions/) to check out all our available extensions and features.
3333

3434
== It's free, and always will be. ==
3535

36-
We’re firm believers in open source - that’s why this extension is free, and that won't change.
36+
We’re firm believers in open source - that’s why this extension is free, and that won't change.
3737

38-
We are constantly maintaining and updating our extension so you have the latest and greatest abilities on your LSX Theme powered site.
38+
We are constantly maintaining and updating our extension so you have the latest and greatest abilities on your LSX Theme powered site.
3939

4040
== Tour Operator Reviews Documentation ==
4141

@@ -49,13 +49,13 @@ If you are experiencing issues with the Tour Operator Reviews Plugin & have expe
4949

5050
== Contributing ==
5151

52-
If you're a developer who's spotted a bug issue and have a fix, or simply have the functionality you think would extend our core theme, we are always happy to accept your contribution!
52+
If you're a developer who's spotted a bug issue and have a fix, or simply have the functionality you think would extend our core theme, we are always happy to accept your contribution!
5353

5454
Visit the [Tour Operator Reviews Plugin on Github](https://github.com/lightspeeddevelopment/to-reviews/) and submit a Pull Request with your updates.
5555

5656
== Frequently Asked Questions ==
5757

58-
Take a look at all our [Frequently Asked Questions](https://lsx.design/), we are sure you'll find what you're looking for.
58+
Take a look at all our [Frequently Asked Questions](https://lsx.design/), we are sure you'll find what you're looking for.
5959

6060
== Screenshots ==
6161

classes/class-to-review-schema.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ public function generate() {
3232
$review_author = get_post_meta( $post->ID, 'reviewer_name', true );
3333
$review_email = get_post_meta( $post->ID, 'reviewer_email', true );
3434
$rating_value = get_post_meta( $post->ID, 'rating', true );
35-
$description = \lsx\schema\Helpers::strip_to_text( apply_filters( 'the_content', $post->post_content ) );
35+
$description = \lsx\schema\Helpers::strip_to_text( apply_filters( 'the_content', $post->post_content ) ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound
3636
$tour_list = get_post_meta( $post->ID, 'tour_to_review', false );
3737
$accom_list = get_post_meta( $post->ID, 'accommodation_to_review', false );
3838
$comment_count = get_comment_count( $this->context->id );

classes/class-to-reviews-admin.php

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@ class LSX_TO_Reviews_Admin {
2929
* Constructor.
3030
*/
3131
public function __construct() {
32-
add_action( 'init', array( $this, 'load_plugin_textdomain' ) );
3332
add_action( 'init', array( $this, 'register_post_type' ) );
3433
add_action( 'cmb2_admin_init', array( $this, 'register_cmb2_fields' ) );
3534

@@ -40,14 +39,7 @@ public function __construct() {
4039

4140
add_filter( 'lsx_to_team_custom_fields', array( $this, 'custom_fields' ) );
4241
add_filter( 'lsx_to_special_custom_fields', array( $this, 'custom_fields' ) );
43-
add_filter( 'lsx_to_activity_custom_fields', array( $this, 'custom_fields' ) );
44-
}
45-
46-
/**
47-
* Load the plugin text domain for translation.
48-
*/
49-
public function load_plugin_textdomain() {
50-
load_plugin_textdomain( 'to-reviews', false, basename( LSX_TO_REVIEWS_PATH ) . '/languages' );
42+
add_filter( 'lsx_to_activity_custom_fields', array( $this, 'custom_fields' ) );
5143
}
5244

5345
/**

classes/class-to-reviews-templates.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@
99
* @copyright 2017 LightSpeedDevelopment
1010
*/
1111

12+
if ( ! defined( 'ABSPATH' ) ) {
13+
exit;
14+
}
15+
1216
/**
1317
* Main plugin class.
1418
*

classes/class-to-reviews.php

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,14 @@
55
* @package LSX_TO_Reviews
66
* @author LightSpeed
77
* @license GPL-3.0+
8-
* @link
8+
* @link
99
* @copyright 2016 LightSpeedDevelopment
1010
*/
11+
12+
if ( ! defined( 'ABSPATH' ) ) {
13+
exit;
14+
}
15+
1116
if ( ! class_exists( 'LSX_TO_Reviews' ) ) {
1217
/**
1318
* Main plugin class.
@@ -16,7 +21,7 @@
1621
* @author LightSpeed
1722
*/
1823
class LSX_TO_Reviews {
19-
24+
2025
/**
2126
* The plugin slug/id.
2227
*
@@ -59,7 +64,7 @@ public function __construct() {
5964
$this->frontend = new LSX_TO_Reviews_Frontend();
6065

6166
require_once LSX_TO_REVIEWS_PATH . '/includes/template-tags.php';
62-
67+
6368
require_once LSX_TO_REVIEWS_PATH . '/classes/class-to-reviews-templates.php';
6469

6570
require_once LSX_TO_REVIEWS_PATH . '/classes/class-to-reviews-blocks.php';

includes/metaboxes/config-review.php

Lines changed: 25 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -9,71 +9,75 @@
99
* @copyright 2017 LightSpeedDevelopment
1010
*/
1111

12-
$metabox = array(
12+
if ( ! defined( 'ABSPATH' ) ) {
13+
exit;
14+
}
15+
16+
$to_reviews_metabox = array(
1317
'title' => esc_html__( 'Tour Operator Plugin', 'to-reviews' ),
1418
'pages' => 'review',
1519
'fields' => array(),
1620
);
1721

1822
if ( ! class_exists( 'LSX_Banners' ) ) {
19-
$metabox['fields'][] = array(
23+
$to_reviews_metabox['fields'][] = array(
2024
'id' => 'tagline',
2125
'name' => esc_html__( 'Tagline', 'to-reviews' ),
2226
'type' => 'text',
2327
);
2428
}
2529

26-
$metabox['fields'][] = array(
30+
$to_reviews_metabox['fields'][] = array(
2731
'id' => 'no_adults',
2832
'name' => esc_html__( 'No of Adults', 'to-reviews' ),
2933
'type' => 'text',
3034
'cols' => 6,
3135
);
3236

33-
$metabox['fields'][] = array(
37+
$to_reviews_metabox['fields'][] = array(
3438
'id' => 'no_children',
3539
'name' => esc_html__( 'No of Children', 'to-reviews' ),
3640
'type' => 'text',
3741
'cols' => 6,
3842
);
3943

40-
$metabox['fields'][] = array(
44+
$to_reviews_metabox['fields'][] = array(
4145
'id' => 'reviewer_name',
4246
'name' => esc_html__( 'Reviewer Name', 'to-reviews' ),
4347
'type' => 'text',
4448
'cols' => 6,
4549
);
4650

47-
$metabox['fields'][] = array(
51+
$to_reviews_metabox['fields'][] = array(
4852
'id' => 'reviewer_email',
4953
'name' => esc_html__( 'Reviewer Email', 'to-reviews' ),
5054
'type' => 'text',
5155
'cols' => 6,
5256
);
5357

54-
$metabox['fields'][] = array(
58+
$to_reviews_metabox['fields'][] = array(
5559
'id' => 'rating',
5660
'name' => esc_html__( 'Rating', 'to-reviews' ),
5761
'type' => 'select',
5862
'options' => array( '0', '1', '2', '3', '4', '5' ),
5963
'allow_none' => true,
6064
);
61-
$metabox['fields'][] = array(
65+
$to_reviews_metabox['fields'][] = array(
6266
'id' => 'date_of_visit_start',
6367
'name' => esc_html__( 'Start date of visit', 'to-reviews' ),
6468
'type' => 'text_date_timestamp',
6569
'cols' => 6,
6670
);
6771

68-
$metabox['fields'][] = array(
72+
$to_reviews_metabox['fields'][] = array(
6973
'id' => 'date_of_visit_end',
7074
'name' => esc_html__( 'End date of visit', 'to-reviews' ),
7175
'type' => 'text_date_timestamp',
7276
'cols' => 6,
7377
);
7478

7579
if ( class_exists( 'LSX_TO_Team' ) ) {
76-
$metabox['fields'][] = array(
80+
$to_reviews_metabox['fields'][] = array(
7781
'id' => 'team_to_review',
7882
'name' => esc_html__( 'Reviewed By', 'to-reviews' ),
7983
'type' => 'pw_multiselect',
@@ -85,13 +89,13 @@
8589
);
8690
}
8791

88-
$metabox['fields'][] = array(
92+
$to_reviews_metabox['fields'][] = array(
8993
'id' => 'gallery_title',
9094
'name' => esc_html__( 'Gallery', 'to-reviews' ),
9195
'type' => 'title',
9296
);
9397

94-
$metabox['fields'][] = array(
98+
$to_reviews_metabox['fields'][] = array(
9599
'name' => esc_html__( 'Gallery', 'to-reviews' ),
96100
'desc' => esc_html__( 'Add images related to the review to be displayed in the Reviews\'s gallery.', 'to-reviews' ),
97101
'id' => 'gallery',
@@ -103,33 +107,33 @@
103107
),
104108
);
105109

106-
$metabox['fields'][] = array(
110+
$to_reviews_metabox['fields'][] = array(
107111
'id' => 'related_title',
108112
'name' => esc_html__( 'Related', 'to-reviews' ),
109113
'type' => 'title',
110114
);
111115

112-
$post_types = array(
116+
$to_reviews_post_types = array(
113117
'post' => esc_html__( 'Posts', 'to-reviews' ),
114118
'accommodation' => esc_html__( 'Accommodation', 'to-reviews' ),
115119
'destination' => esc_html__( 'Destinations', 'to-reviews' ),
116120
'tour' => esc_html__( 'Tours', 'to-reviews' ),
117121
);
118122

119-
foreach ( $post_types as $slug => $label ) {
120-
$metabox['fields'][] = array(
121-
'id' => $slug . '_to_review',
122-
'name' => $label . esc_html__( ' related with this review', 'to-reviews' ),
123+
foreach ( $to_reviews_post_types as $to_reviews_slug => $to_reviews_label ) {
124+
$to_reviews_metabox['fields'][] = array(
125+
'id' => $to_reviews_slug . '_to_review',
126+
'name' => $to_reviews_label . esc_html__( ' related with this review', 'to-reviews' ),
123127
'type' => 'pw_multiselect',
124128
'use_ajax' => false,
125129
'repeatable' => false,
126130
'allow_none' => true,
127131
'options' => array(
128-
'post_type_args' => $slug,
132+
'post_type_args' => $to_reviews_slug,
129133
),
130134
);
131135
}
132136

133-
$metabox['fields'] = apply_filters( 'lsx_to_review_custom_fields', $metabox['fields'] );
137+
$to_reviews_metabox['fields'] = apply_filters( 'lsx_to_review_custom_fields', $to_reviews_metabox['fields'] );
134138

135-
return $metabox;
139+
return $to_reviews_metabox;

includes/post-types/config-review.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,10 @@
99
* @copyright 2017 LightSpeedDevelopment
1010
*/
1111

12+
if ( ! defined( 'ABSPATH' ) ) {
13+
exit;
14+
}
15+
1216
$post_type = array(
1317
'class' => 'LSX_TO_Reviews',
1418
'menu_icon' => 'dashicons-editor-ul',

includes/template-tags.php

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,10 @@
66
* @license GPL-2.0+
77
*/
88

9+
if ( ! defined( 'ABSPATH' ) ) {
10+
exit;
11+
}
12+
913
/**
1014
* Gets the current reviews rating
1115
*

patterns/review-card.php

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@
1414
* @version 2.1.0
1515
*/
1616

17+
if ( ! defined( 'ABSPATH' ) ) {
18+
exit;
19+
}
20+
1721
// phpcs:ignoreFile PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage
1822

1923
return array(
@@ -41,7 +45,7 @@
4145
4246
<!-- wp:group {"metadata":{"name":"' . esc_attr__( 'Author', 'tour-operator' ) . '"},"style":"layout":{"type":"flex","flexWrap":"nowrap","justifyContent":"center","verticalAlignment":"center"}} -->
4347
<div class="wp-block-group"><!-- wp:group {"metadata":{"name":"' . esc_attr__( 'Author Details', 'tour-operator' ) . '"},"style":{"spacing":{"blockGap":"0"}},"layout":{"type":"flex","flexWrap":"nowrap","orientation":"vertical","justifyContent":"center","verticalAlignment":"center"}} -->
44-
<div class="wp-block-group"><!-- wp:post-title {"textAlign":"center","level":3,"isLink":false,"fontSize":"large","fontFamily":"heading"} /-->
48+
<div class="wp-block-group"><!-- wp:post-title {"textAlign":"center","level":3,"isLink":true,"fontSize":"large","fontFamily":"heading"} /-->
4549
4650
<!-- wp:paragraph {"align":"center","metadata":{"bindings":{"content":{"source":"lsx/post-meta","args":{"key":"reviewer_name"}}}},"fontSize":"medium","fontFamily":"heading"} -->
4751
<p class="has-text-align-center has-heading-font-family has-medium-font-size"></p>

0 commit comments

Comments
 (0)