diff --git a/includes/admin/class-pr-core-admin-columns.php b/includes/admin/class-pr-core-admin-columns.php
index dd8bee7..bcab3d5 100644
--- a/includes/admin/class-pr-core-admin-columns.php
+++ b/includes/admin/class-pr-core-admin-columns.php
@@ -1,6 +1,12 @@
find_by_id( $c->peptide_id );
$name = $peptide ? $peptide->title : '#' . $c->peptide_id;
- $dose = $c->dose_min !== null ? number_format( $c->dose_min, 2 ) : '?';
- if ( $c->dose_max !== null && $c->dose_max !== $c->dose_min ) {
+ $dose = null !== $c->dose_min ? number_format( $c->dose_min, 2 ) : '?';
+ if ( null !== $c->dose_max && $c->dose_max !== $c->dose_min ) {
$dose .= ' – ' . number_format( $c->dose_max, 2 );
}
$dose .= ' ' . esc_html( $c->dose_unit );
@@ -95,7 +100,7 @@ class PR_Core_Candidate_Queue_Page {
printf( '
%s | ', esc_html( $c->route ) );
printf( '%s | ', esc_html( $dose ) );
printf( '%s | ', esc_html( $c->population ) );
- printf( '%s | ', $study ); // Contains escaped HTML + link.
+ printf( '%s | ', $study ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- $study is pre-escaped HTML.
printf( '%s | ', esc_html( $confidence_pct ) );
printf(
'%s %s | ',
@@ -118,7 +123,7 @@ class PR_Core_Candidate_Queue_Page {
* @return void
*/
private function handle_actions(): void {
- $action = sanitize_text_field( $_GET['action'] ?? '' );
+ $action = sanitize_text_field( wp_unslash( $_GET['action'] ?? '' ) ); // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated
if ( ! in_array( $action, array( 'pr_core_approve', 'pr_core_reject' ), true ) ) {
return;
@@ -128,7 +133,7 @@ class PR_Core_Candidate_Queue_Page {
return;
}
- $candidate_id = absint( $_GET['candidate_id'] ?? 0 );
+ $candidate_id = absint( wp_unslash( $_GET['candidate_id'] ?? 0 ) );
if ( 0 === $candidate_id ) {
return;
}
diff --git a/includes/admin/class-pr-core-peptide-metaboxes.php b/includes/admin/class-pr-core-peptide-metaboxes.php
index 8f92264..d5b2935 100644
--- a/includes/admin/class-pr-core-peptide-metaboxes.php
+++ b/includes/admin/class-pr-core-peptide-metaboxes.php
@@ -1,6 +1,12 @@