thatguygriffandClaude Fable 5
1d6ac46ba3
CI / No Debug Code (pull_request) Successful in 3s
CI / Tests (PHP 8.2) (pull_request) Successful in 48s
CI / Tests (PHP 8.3) (pull_request) Successful in 52s
CI / Coding Standards (pull_request) Successful in 57s
CI / Tests (PHP 8.1) (pull_request) Successful in 1m1s
CI / PHPStan (pull_request) Successful in 1m11s
CI / Build Plugin Zip (pull_request) Has been skipped
- Bump phpstan/phpstan ^2.0 and szepeviktor/phpstan-wordpress ^2.0 - Move the analysis level into phpstan.neon (single source) and raise it to 10 - Add Val, a runtime coercion helper that narrows untyped WordPress boundary values (wpdb rows, REST params, superglobals, options) with explicit checks instead of blind casts, plus unit tests - Type value-object fromRow() params as stdClass (what wpdb returns) and map columns through Val so unexpected shapes degrade safely - Use %i identifier placeholders for table names in all wpdb::prepare() calls so every query string is a literal and identifiers are escaped by WordPress; raises the minimum WordPress version to 6.2 where %i was introduced - Guard wpdb::prepare() null result before wpdb::query() in updateTax() - Fix nullable get_permalink()/strtotime() handling, list types at REST and capability call sites, dead null-coalescing on checked superglobals, and narrow get_users() results before mapping - Register Val method names with the ValidatedSanitizedInput sniff so it validates the real sanitizer around each superglobal read - Update repository unit tests for the %i placeholder arguments Co-Authored-By: Claude Fable 5 <[email protected]>
76 lines
2.6 KiB
PHP
76 lines
2.6 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
namespace Unsupervised\Schedular\Policy;
|
|
|
|
use Unsupervised\Schedular\Auth\RoleManager;
|
|
use Unsupervised\Schedular\Val;
|
|
|
|
class PolicyController {
|
|
|
|
public function __construct(
|
|
private PolicyRepository $policies,
|
|
private PolicyVersionRepository $versions,
|
|
private PolicyService $service,
|
|
) {}
|
|
|
|
public function renderPage(): void {
|
|
if ( ! current_user_can( RoleManager::CAP_MANAGE_POLICIES ) ) {
|
|
wp_die( esc_html__( 'You do not have permission to manage policies.', 'unsupervised-schedular' ) );
|
|
}
|
|
|
|
if ( isset( $_POST['usc_action'] ) && check_admin_referer( 'usc_policy_action' ) ) {
|
|
$this->handleFormAction();
|
|
}
|
|
|
|
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- read-only policy selector.
|
|
$policyId = absint( Val::int( $_GET['policy_id'] ?? 0 ) );
|
|
$policyList = $this->policies->findAll();
|
|
$selectedPolicy = $policyId > 0 ? $this->policies->findById( $policyId ) : null;
|
|
$policyVersions = null !== $selectedPolicy ? $this->versions->findByPolicy( (int) $selectedPolicy->id ) : null;
|
|
|
|
include USC_PLUGIN_DIR . 'templates/admin/policies.php';
|
|
}
|
|
|
|
private function handleFormAction(): void {
|
|
// Nonce is verified by the caller (renderPage) before this method runs.
|
|
// phpcs:disable WordPress.Security.NonceVerification.Missing
|
|
$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );
|
|
|
|
if ( 'create_policy' === $action ) {
|
|
$title = sanitize_text_field( Val::string( wp_unslash( $_POST['title'] ?? '' ) ) );
|
|
$slugRaw = sanitize_text_field( Val::string( wp_unslash( $_POST['slug'] ?? '' ) ) );
|
|
$slug = sanitize_title( '' !== $slugRaw ? $slugRaw : $title );
|
|
$scope = sanitize_key( Val::string( wp_unslash( $_POST['acceptance_scope'] ?? Policy::SCOPE_BOOKING ) ) );
|
|
|
|
if ( ! in_array( $scope, Policy::VALID_SCOPES, true ) ) {
|
|
$scope = Policy::SCOPE_BOOKING;
|
|
}
|
|
|
|
if ( '' !== $title && '' !== $slug && null === $this->policies->findBySlug( $slug ) ) {
|
|
$this->service->createPolicy( $title, $slug, $scope );
|
|
}
|
|
|
|
return;
|
|
}
|
|
|
|
$policyId = absint( Val::int( $_POST['policy_id'] ?? 0 ) );
|
|
if ( $policyId <= 0 || null === $this->policies->findById( $policyId ) ) {
|
|
return;
|
|
}
|
|
|
|
if ( 'add_version' === $action ) {
|
|
$body = wp_kses_post( Val::string( wp_unslash( $_POST['body'] ?? '' ) ) );
|
|
$this->service->addDraftVersion( $policyId, $body );
|
|
}
|
|
|
|
if ( 'publish_version' === $action ) {
|
|
$versionId = absint( Val::int( $_POST['version_id'] ?? 0 ) );
|
|
if ( $versionId > 0 ) {
|
|
$this->service->publishVersion( $policyId, $versionId );
|
|
}
|
|
}
|
|
// phpcs:enable WordPress.Security.NonceVerification.Missing
|
|
}
|
|
}
|