| @@ -13,8 +13,9 @@ | ||
| 13 | 13 | |
| 14 | 14 | /** |
| 15 | 15 | * Class PH_Plugin_Updates |
| 16 | 16 | */ |
| 17 | +// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy public global class PH_Plugin_Updates; preserving the existing PH_* class name is required for plugin and extension compatibility. | |
| 17 | 18 | class PH_Plugin_Updates { |
| 18 | 19 | |
| 19 | 20 | /** |
| 20 | 21 | * The upgrade notice shown inline. |
| @@ -78,8 +79,9 @@ | ||
| 78 | 79 | |
| 79 | 80 | if ( !$valid_license ) |
| 80 | 81 | { |
| 81 | 82 | $add_ons = ''; |
| 83 | + // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only refresh of public add-on metadata; this flag does not install, activate or change licensing. | |
| 82 | 84 | if ( false === ( $add_ons = get_transient( 'propertyhive_features' ) ) || isset($_GET['ph_force_get_features']) ) |
| 83 | 85 | { |
| 84 | 86 | // It wasn't there, so regenerate the data and save the transient |
| 85 | 87 | $response = wp_remote_get( |
| @@ -163,9 +165,9 @@ | ||
| 163 | 165 | public function in_plugin_update_message( $args, $response ) { |
| 164 | 166 | $this->new_version = $response->new_version; |
| 165 | 167 | $this->upgrade_notice = $this->get_upgrade_notice( $response->new_version ); |
| 166 | 168 | |
| 167 | - echo apply_filters( 'propertyhive_in_plugin_update_message', $this->upgrade_notice ? '<br><span style="color:#900">' . wp_kses_post( $this->upgrade_notice ) . '</span>' : '' ); // phpcs:ignore WordPress.XSS.EscapeOutput.OutputNotEscaped | |
| 169 | + echo apply_filters( 'propertyhive_in_plugin_update_message', $this->upgrade_notice ? '<br><span style="color:#900">' . wp_kses_post( $this->upgrade_notice ) . '</span>' : '' ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- The remote notice is sanitized with wp_kses_post before this trusted PHP extension HTML filter. | |
| 168 | 170 | } |
| 169 | 171 | |
| 170 | 172 | /** |
| 171 | 173 | * Get the upgrade notice from WordPress.org. |
