| @@ -250,13 +250,15 @@ | ||
| 250 | 250 | |
| 251 | 251 | // Get total notifications count |
| 252 | 252 | global $wpdb; |
| 253 | 253 | $table_name = $wpdb->prefix . 'nx_posts'; |
| 254 | + // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- False positive: the query is prepared via $this->wpdb->prepare(), which this sniff does not recognise, and only $wpdb->prefix table names are interpolated. Audited 2026-07-16. | |
| 254 | 255 | $total_notifications = $wpdb->get_var("SELECT COUNT(*) FROM {$table_name} WHERE enabled = 1"); |
| 255 | 256 | $total_notifications = $total_notifications ? intval($total_notifications) : 0; |
| 256 | 257 | |
| 257 | 258 | } catch (\Exception $e) { |
| 258 | 259 | // Fallback to default values if there's an error |
| 260 | + // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- deliberate failure logging, not debug output. | |
| 259 | 261 | error_log('NotificationX Milestone: Error fetching analytics data - ' . $e->getMessage()); |
| 260 | 262 | } |
| 261 | 263 | |
| 262 | 264 | // Format numbers for display |
| @@ -501,12 +503,14 @@ | ||
| 501 | 503 | |
| 502 | 504 | // Get total notifications count |
| 503 | 505 | global $wpdb; |
| 504 | 506 | $table_name = $wpdb->prefix . 'nx_posts'; |
| 507 | + // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching, WordPress.DB.PreparedSQL.InterpolatedNotPrepared -- False positive: the query is prepared via $this->wpdb->prepare(), which this sniff does not recognise, and only $wpdb->prefix table names are interpolated. Audited 2026-07-16. | |
| 505 | 508 | $total_notifications = $wpdb->get_var("SELECT COUNT(*) FROM {$table_name} WHERE enabled = 1"); |
| 506 | 509 | $total_notifications = $total_notifications ? intval($total_notifications) : 0; |
| 507 | 510 | |
| 508 | 511 | } catch (\Exception $e) { |
| 512 | + // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- deliberate failure logging, not debug output. | |
| 509 | 513 | error_log('NotificationX Milestone: Error fetching analytics data - ' . $e->getMessage()); |
| 510 | 514 | return false; |
| 511 | 515 | } |
| 512 | 516 | |
| @@ -575,9 +579,9 @@ | ||
| 575 | 579 | */ |
| 576 | 580 | public function ajax_mark_milestone_seen() |
| 577 | 581 | { |
| 578 | 582 | // Verify nonce |
| 579 | - if (!isset($_POST['nonce']) || !wp_verify_nonce($_POST['nonce'], 'notificationx_milestone_nonce')) { | |
| 583 | + if (!isset($_POST['nonce']) || !wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['nonce'] ) ), 'notificationx_milestone_nonce')) { | |
| 580 | 584 | wp_send_json_error('Invalid nonce'); |
| 581 | 585 | return; |
| 582 | 586 | } |
| 583 | 587 | |
