LS-1952: Address Plugin Check security and WPCS issues for TO Reviews

[josearmandoabreu]

Summary

Resolves all actionable Plugin Check errors and WPCS warnings flagged on the to-reviews plugin ahead of WordPress.org submission. Focuses on direct file access protection, global variable prefixing, and removing deprecated function calls. Dev-tooling hidden files are excluded from scope — these are stripped at packaging time via .distignore. LS-1952.

Changes

Added

• ABSPATH direct file access guard added to 6 PHP files: classes/class-to-reviews.php, classes/class-to-reviews-templates.php, includes/post-types/config-review.php, includes/metaboxes/config-review.php, includes/template-tags.php, patterns/review-card.php — resolves missing_direct_file_access_protection (ERROR).

Updated

• includes/metaboxes/config-review.php — renamed all non-prefixed variables to comply with WordPress.NamingConventions.PrefixAllGlobals: $metabox → $to_reviews_metabox, $post_types → $to_reviews_post_types, $slug / $label → $to_reviews_slug / $to_reviews_label. No behavioural change — file returns the config array as before.
• classes/class-to-review-schema.php — added phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound on apply_filters( 'the_content', ... ). This is a call to a core WP filter, not a custom hook registration; the suppression is intentional.
• README.txt — Tested up to bumped from 6.9 → 7.0 to satisfy the outdated_tested_upto_header check (ERROR).

Removed

• load_plugin_textdomain() method and its add_action( 'init', ... ) hook removed from classes/class-to-reviews-admin.php — deprecated since WordPress 4.6; translations are loaded automatically for plugins hosted on WordPress.org.

Testing

• Plugin activates without PHP errors or warnings.
• Review post type registers correctly and CMB2 metabox fields appear on the edit screen.
• Metabox fields save and retrieve correctly (verify $to_reviews_metabox rename has no runtime impact).
• Plugin strings are translated correctly without the manual load_plugin_textdomain() call.
• Schema markup generates correctly on single review pages.
• Run Plugin Check — no remaining missing_direct_file_access_protection or outdated_tested_upto_header errors.

Checklist

• All missing_direct_file_access_protection ERRORs resolved
• outdated_tested_upto_header ERROR resolved
• NonPrefixedVariableFound WARNINGs resolved in metabox config
• load_plugin_textdomain WARNING resolved
• NonPrefixedHooknameFound WARNING suppressed with documented justification
• No logic changes — purely standards compliance fixes

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: af5c3fb6-058f-4018-a421-9262241e680d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Warning

.coderabbit.yaml has a parsing error

The CodeRabbit configuration file in this repository has a parsing error and default settings were used instead. Please fix the error(s) in the configuration file. You can initialize chat with CodeRabbit to get help with the configuration file.

💥 Parsing errors (1)

duplicated mapping key in ".coderabbit.yaml" (22:3)

 19 |       - '.*'
 20 |   path_filters:
 21 |     - "!build/**"
 22 |   path_filters:
--------^
 23 |     - "!build/**"
 24 |     - "!node_modules/**"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[linear-code]

LS-1952