diff --git a/includes/admin/class-pr-core-admin-columns.php b/includes/admin/class-pr-core-admin-columns.php index dd8bee7..bcab3d5 100644 --- a/includes/admin/class-pr-core-admin-columns.php +++ b/includes/admin/class-pr-core-admin-columns.php @@ -1,6 +1,12 @@ find_by_id( $c->peptide_id ); $name = $peptide ? $peptide->title : '#' . $c->peptide_id; - $dose = $c->dose_min !== null ? number_format( $c->dose_min, 2 ) : '?'; - if ( $c->dose_max !== null && $c->dose_max !== $c->dose_min ) { + $dose = null !== $c->dose_min ? number_format( $c->dose_min, 2 ) : '?'; + if ( null !== $c->dose_max && $c->dose_max !== $c->dose_min ) { $dose .= ' – ' . number_format( $c->dose_max, 2 ); } $dose .= ' ' . esc_html( $c->dose_unit ); @@ -95,7 +100,7 @@ class PR_Core_Candidate_Queue_Page { printf( '%s', esc_html( $c->route ) ); printf( '%s', esc_html( $dose ) ); printf( '%s', esc_html( $c->population ) ); - printf( '%s', $study ); // Contains escaped HTML + link. + printf( '%s', $study ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $study is pre-escaped HTML. printf( '%s', esc_html( $confidence_pct ) ); printf( '%s %s', @@ -118,7 +123,7 @@ class PR_Core_Candidate_Queue_Page { * @return void */ private function handle_actions(): void { - $action = sanitize_text_field( $_GET['action'] ?? '' ); + $action = sanitize_text_field( wp_unslash( $_GET['action'] ?? '' ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated if ( ! in_array( $action, array( 'pr_core_approve', 'pr_core_reject' ), true ) ) { return; @@ -128,7 +133,7 @@ class PR_Core_Candidate_Queue_Page { return; } - $candidate_id = absint( $_GET['candidate_id'] ?? 0 ); + $candidate_id = absint( wp_unslash( $_GET['candidate_id'] ?? 0 ) ); if ( 0 === $candidate_id ) { return; } diff --git a/includes/admin/class-pr-core-peptide-metaboxes.php b/includes/admin/class-pr-core-peptide-metaboxes.php index 8f92264..d5b2935 100644 --- a/includes/admin/class-pr-core-peptide-metaboxes.php +++ b/includes/admin/class-pr-core-peptide-metaboxes.php @@ -1,6 +1,12 @@