From 85956da7c86bed2c9e2cf60625fda0cf2e9518bb Mon Sep 17 00:00:00 2001
From: peptiderepo <bot@peptiderepo.com>
Date: Mon, 15 Jun 2026 03:41:09 +0000
Subject: [PATCH] PR Vision v0.2.3: fix PHPCS escape-output violations in key
 manager renderer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

WordPress.Security.EscapeOutput.OutputNotEscaped (x3):
- Lines 110+148: inline esc_url( admin_url() ) directly in echo; drop pre-assigned $form_url
- Line 128: replace $disabled variable with literal-conditional
  ( $is_const ? ' disabled aria-disabled="true"' : '' ) — no dynamic value

PEAR.Functions.FunctionCallSignature.ContentAfterOpenBracket (x1):
- Line 116: move esc_html( opening to its own line so arg starts on next line

Full file audit: no other unescaped echo found; $nonce data-attr uses esc_attr(),
$ajax_url uses esc_url(), inline <script> has existing phpcs:ignore.
No behavior change; password input still renders empty.

CHANGELOG [0.2.3]: one-line note — output-escaping hardening in key manager renderer.

Agent-Session: geomonitor / 2026-06-15
---
 CHANGELOG.md                                     |  1 +
 includes/core/class-prv-key-manager-renderer.php | 11 +++++------
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cfc7f76..fd5ae00 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ Versioning: [Semantic Versioning](https://semver.org/)
 ## [0.2.3] — 2026-06-15
 
 UI-editable provider API key: encrypted at rest, write-only, wp-config precedence.
+Output-escaping hardening in key manager renderer (`esc_url`/`esc_attr`/literal-conditional on all echoed values).
 
 ### Added
 
diff --git a/includes/core/class-prv-key-manager-renderer.php b/includes/core/class-prv-key-manager-renderer.php
index 26bcd45..d95fc22 100644
--- a/includes/core/class-prv-key-manager-renderer.php
+++ b/includes/core/class-prv-key-manager-renderer.php
@@ -106,26 +106,25 @@ class PRV_Key_Manager_Renderer {
 	 * @return void
 	 */
 	private function render_key_form( bool $is_const, bool $is_set_opt ): void {
-		$form_url = esc_url( admin_url( 'admin-post.php' ) );
-		echo '<form method="post" action="' . $form_url . '" id="prv-key-set-form" autocomplete="off">';
+		echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" id="prv-key-set-form" autocomplete="off">';
 		echo '<input type="hidden" name="action" value="prv_key_set">';
 		wp_nonce_field( PRV_Settings_Page::NONCE_KEY, 'prv_nonce' );
 
 		echo '<div class="prv-field" style="margin-top:12px">';
 		echo '<label class="prv-label" for="prv_api_key">';
-		echo esc_html( $is_set_opt
+		echo esc_html(
+			$is_set_opt
 			? __( 'Replace key (leave empty to keep current)', 'pr-vision' )
 			: __( 'Set key', 'pr-vision' )
 		);
 		echo '</label>';
 
-		$disabled = $is_const ? ' disabled aria-disabled="true"' : '';
 		// Input always renders empty — never outputs stored key.
 		echo '<input type="password" id="prv_api_key" name="prv_api_key" '
 			. 'class="prv-input" style="max-width:420px" '
 			. 'value="" autocomplete="new-password" '
 			. 'placeholder="' . esc_attr( $is_const ? __( 'Managed via wp-config — cannot override', 'pr-vision' ) : __( 'sk-or-…', 'pr-vision' ) ) . '"'
-			. $disabled . '>';
+			. ( $is_const ? ' disabled aria-disabled="true"' : '' ) . '>';
 
 		if ( $is_const ) {
 			echo '<p style="color:var(--prv-text-muted);font-size:12px;margin:4px 0 0">'
@@ -145,7 +144,7 @@ class PRV_Key_Manager_Renderer {
 
 		// Remove key form (only when admin option is set, not constant).
 		if ( $is_set_opt && ! $is_const ) {
-			echo '<form method="post" action="' . $form_url . '" id="prv-key-remove-form" style="margin-top:8px">';
+			echo '<form method="post" action="' . esc_url( admin_url( 'admin-post.php' ) ) . '" id="prv-key-remove-form" style="margin-top:8px">';
 			echo '<input type="hidden" name="action" value="prv_key_remove">';
 			wp_nonce_field( PRV_Settings_Page::NONCE_KEY, 'prv_nonce' );
 			echo '<button type="submit" class="prv-btn prv-btn-danger" '