| @@ -131,11 +131,11 @@ | ||
| 131 | 131 | */ |
| 132 | 132 | public function mark_new_custom_html_page() |
| 133 | 133 | { |
| 134 | 134 | // Check if this is a page being created |
| 135 | - if (isset($_GET['post_type']) && $_GET['post_type'] === 'page') { | |
| 135 | + if (isset($_GET['post_type']) && $_GET['post_type'] === 'page') { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- core gates post-new.php, this only flags the new auto-draft | |
| 136 | 136 | // Check if the metasync_html_page parameter is set |
| 137 | - if (isset($_GET['metasync_html_page']) && $_GET['metasync_html_page'] === '1') { | |
| 137 | + if (isset($_GET['metasync_html_page']) && $_GET['metasync_html_page'] === '1') { // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- core gates post-new.php, this only flags the new auto-draft | |
| 138 | 138 | // Set a flag in session or add a filter to mark this page on first save |
| 139 | 139 | add_filter('wp_insert_post_data', array($this, 'flag_custom_html_page_on_insert'), 10, 2); |
| 140 | 140 | } |
| 141 | 141 | } |
| @@ -260,9 +260,9 @@ | ||
| 260 | 260 | class="large-text code" |
| 261 | 261 | rows="20" |
| 262 | 262 | style="font-family: Consolas, Monaco, monospace; width: 100%;"><?php |
| 263 | 263 | // Output HTML content - don't use esc_textarea as it might break large HTML |
| 264 | - echo htmlspecialchars($html_content, ENT_QUOTES, 'UTF-8'); | |
| 264 | + echo htmlspecialchars($html_content, ENT_QUOTES, 'UTF-8'); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- htmlspecialchars(ENT_QUOTES) is the escaping call (esc_textarea equivalent for large HTML) | |
| 265 | 265 | ?></textarea> |
| 266 | 266 | </div> |
| 267 | 267 | |
| 268 | 268 | <div class="metasync-html-preview" style="margin-top: 15px;"> |
| @@ -424,9 +424,9 @@ | ||
| 424 | 424 | $has_fetch_detector = class_exists('Metasync_Otto_Render_Strategy') && method_exists('Metasync_Otto_Render_Strategy', 'is_internal_fetch'); |
| 425 | 425 | |
| 426 | 426 | $is_otto_fetch = $has_fetch_detector |
| 427 | 427 | ? Metasync_Otto_Render_Strategy::is_internal_fetch() |
| 428 | - : (isset($_GET['is_otto_page_fetch']) && $_GET['is_otto_page_fetch'] === '1'); | |
| 428 | + : (isset($_GET['is_otto_page_fetch']) && $_GET['is_otto_page_fetch'] === '1'); // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only per-request flag to skip cache headers | |
| 429 | 429 | |
| 430 | 430 | // Permission check for draft/pending pages |
| 431 | 431 | if ($post->post_status !== 'publish') { |
| 432 | 432 | // Allow preview for users with edit permissions |
| @@ -521,8 +521,9 @@ | ||
| 521 | 521 | |
| 522 | 522 | if (!in_array($file_ext, $allowed_extensions, true)) { |
| 523 | 523 | wp_send_json_error(array( |
| 524 | 524 | 'message' => sprintf( |
| 525 | + /* translators: %s: list of allowed file extensions. */ | |
| 525 | 526 | esc_html__('Invalid file type. Only %s files are allowed.', 'metasync'), |
| 526 | 527 | implode(', ', $allowed_extensions) |
| 527 | 528 | ) |
| 528 | 529 | )); |
| @@ -552,9 +553,9 @@ | ||
| 552 | 553 | )); |
| 553 | 554 | } |
| 554 | 555 | |
| 555 | 556 | // Clean up temp file |
| 556 | - @unlink($file['tmp_name']); | |
| 557 | + @wp_delete_file($file['tmp_name']); | |
| 557 | 558 | |
| 558 | 559 | // Return success with content |
| 559 | 560 | wp_send_json_success(array( |
| 560 | 561 | 'content' => $html_content, |
| @@ -589,9 +590,8 @@ | ||
| 589 | 590 | $cm_settings = wp_enqueue_code_editor(array('type' => 'text/html')); |
| 590 | 591 | |
| 591 | 592 | // Check if CodeMirror loaded successfully |
| 592 | 593 | if ($cm_settings === false) { |
| 593 | - error_log('MetaSync Custom Pages: CodeMirror failed to load'); | |
| 594 | 594 | return; |
| 595 | 595 | } |
| 596 | 596 | |
| 597 | 597 | // Enqueue custom scripts for enhanced editor |
