peptide-repo/pr-vision
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PR Vision v0.2.3: fix PHPCS escape-output violations in key manager renderer

Browse Source 
WordPress.Security.EscapeOutput.OutputNotEscaped (x3):
- Lines 110+148: inline esc_url( admin_url() ) directly in echo; drop pre-assigned $form_url
- Line 128: replace $disabled variable with literal-conditional
  ( $is_const ? ' disabled aria-disabled="true"' : '' ) — no dynamic value

PEAR.Functions.FunctionCallSignature.ContentAfterOpenBracket (x1):
- Line 116: move esc_html( opening to its own line so arg starts on next line

Full file audit: no other unescaped echo found; $nonce data-attr uses esc_attr(),
$ajax_url uses esc_url(), inline <script> has existing phpcs:ignore.
No behavior change; password input still renders empty.

CHANGELOG [0.2.3]: one-line note — output-escaping hardening in key manager renderer.

Agent-Session: geomonitor / 2026-06-15
This commit is contained in:
peptiderepo
2026-06-15 03:41:09 +00:00
parent 54e3687acc
commit 85956da7c8
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@@ -10,6 +10,7 @@ Versioning: [Semantic Versioning](https://semver.org/)
## [0.2.3] — 2026-06-15
UI-editable provider API key: encrypted at rest, write-only, wp-config precedence.
Output-escaping hardening in key manager renderer (`esc_url`/`esc_attr`/literal-conditional on all echoed values).
### Added

11
includes/core/class-prv-key-manager-renderer.php
View File

@@ -106,26 +106,25 @@ class PRV_Key_Manager_Renderer {
* @return void
*/
private function render_key_form( bool $is_const, bool $is_set_opt ): void {
$form_url = esc_url( admin_url( 'admin-post.php' ) );
echo '<form method="post" action="' . $form_url . '" id="prv-key-set-form" autocomplete="off">';
echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" id="prv-key-set-form" autocomplete="off">';
echo '<input type="hidden" name="action" value="prv_key_set">';
wp_nonce_field( PRV_Settings_Page::NONCE_KEY, 'prv_nonce' );
echo '<div class="prv-field" style="margin-top:12px">';
echo '<label class="prv-label" for="prv_api_key">';
echo esc_html( $is_set_opt
echo esc_html(
$is_set_opt
? __( 'Replace key (leave empty to keep current)', 'pr-vision' )
: __( 'Set key', 'pr-vision' )
);
echo '</label>';
$disabled = $is_const ? ' disabled aria-disabled="true"' : '';
// Input always renders empty — never outputs stored key.
echo '<input type="password" id="prv_api_key" name="prv_api_key" '
. 'class="prv-input" style="max-width:420px" '
. 'value="" autocomplete="new-password" '
. 'placeholder="' . esc_attr( $is_const ? __( 'Managed via wp-config — cannot override', 'pr-vision' ) : __( 'sk-or-…', 'pr-vision' ) ) . '"'
. $disabled . '>';
. ( $is_const ? ' disabled aria-disabled="true"' : '' ) . '>';
if ( $is_const ) {
echo '<p style="color:var(--prv-text-muted);font-size:12px;margin:4px 0 0">'
@@ -145,7 +144,7 @@ class PRV_Key_Manager_Renderer {
// Remove key form (only when admin option is set, not constant).
if ( $is_set_opt && ! $is_const ) {
echo '<form method="post" action="' . $form_url . '" id="prv-key-remove-form" style="margin-top:8px">';
echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" id="prv-key-remove-form" style="margin-top:8px">';
echo '<input type="hidden" name="action" value="prv_key_remove">';
wp_nonce_field( PRV_Settings_Page::NONCE_KEY, 'prv_nonce' );
echo '<button type="submit" class="prv-btn prv-btn-danger" '