diff --git a/includes/Admin/Admin.php b/includes/Admin/Admin.php index 0bddacc1..a21bb680 100644 --- a/includes/Admin/Admin.php +++ b/includes/Admin/Admin.php @@ -253,7 +253,7 @@ public function register(): void { * * @since 1.0 */ - do_action( self::MSLS_REGISTER_ACTION, __CLASS__ ); + do_action( self::MSLS_REGISTER_ACTION, __CLASS__ ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } /** @@ -357,7 +357,7 @@ protected function add_settings_fields( array $map, string $section ): int { * * @since 2.4.4 */ - do_action( self::MSLS_ACTION_PREFIX . $section, __CLASS__, $section ); + do_action( self::MSLS_ACTION_PREFIX . $section, __CLASS__, $section ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- MSLS_ACTION_PREFIX is already prefixed with "msls_". return count( $map ); } diff --git a/includes/Admin/CustomFilter.php b/includes/Admin/CustomFilter.php index 7d4f8141..44b09fab 100644 --- a/includes/Admin/CustomFilter.php +++ b/includes/Admin/CustomFilter.php @@ -86,6 +86,7 @@ public function execute_filter( \WP_Query $query ) { $sql_cache = SqlCacher::create( __CLASS__, __METHOD__ ); // Load post we need to exclude (they already have a translation) from search query. + // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in -- admin-only, paginated post-list screen; the excluded-ID set is bounded by TranslatedPostIdQuery, not attacker-controlled. $query->query_vars['post__not_in'] = ( new TranslatedPostIdQuery( $sql_cache ) )( $blog->get_language() ); return $query; diff --git a/includes/Admin/Main.php b/includes/Admin/Main.php index 6840d111..27e3ffec 100644 --- a/includes/Admin/Main.php +++ b/includes/Admin/Main.php @@ -148,7 +148,7 @@ protected function save( $object_id, $class_name ): void { * * @since 0.9.9 */ - do_action( self::MSLS_SAVE_ACTION, $object_id, $class_name ); + do_action( self::MSLS_SAVE_ACTION, $object_id, $class_name ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". return; } diff --git a/includes/Admin/PostTag/Classic.php b/includes/Admin/PostTag/Classic.php index fc767b4f..fc3132e6 100644 --- a/includes/Admin/PostTag/Classic.php +++ b/includes/Admin/PostTag/Classic.php @@ -40,7 +40,7 @@ public function add_input( string $taxonomy ): void { $this->the_input( null, $title_format, $item_format ); echo ''; - do_action( self::MSLS_ADD_INPUT_ACTION, $taxonomy ); + do_action( self::MSLS_ADD_INPUT_ACTION, $taxonomy ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } /** @@ -72,7 +72,7 @@ public function edit_input( \WP_Term $tag, string $taxonomy ): void { $this->the_input( $tag, $title_format, $item_format ); - do_action( self::MSLS_EDIT_INPUT_ACTION, $tag, $taxonomy ); + do_action( self::MSLS_EDIT_INPUT_ACTION, $tag, $taxonomy ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } /** diff --git a/includes/Admin/PostTag/PostTag.php b/includes/Admin/PostTag/PostTag.php index a4eb6b74..c9083104 100644 --- a/includes/Admin/PostTag/PostTag.php +++ b/includes/Admin/PostTag/PostTag.php @@ -144,7 +144,7 @@ public function add_input( string $taxonomy ): void { $this->the_input( null, $title_format, $item_format ); echo ''; - do_action( self::MSLS_ADD_INPUT_ACTION, $taxonomy ); + do_action( self::MSLS_ADD_INPUT_ACTION, $taxonomy ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } /** @@ -179,7 +179,7 @@ public function edit_input( \WP_Term $tag, string $taxonomy ): void { $this->the_input( $tag, $title_format, $item_format ); - do_action( self::MSLS_EDIT_INPUT_ACTION, $tag, $taxonomy ); + do_action( self::MSLS_EDIT_INPUT_ACTION, $tag, $taxonomy ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } /** diff --git a/includes/Admin/TranslationPicker/Table.php b/includes/Admin/TranslationPicker/Table.php index ed4a9b76..cda63706 100644 --- a/includes/Admin/TranslationPicker/Table.php +++ b/includes/Admin/TranslationPicker/Table.php @@ -179,6 +179,7 @@ public function prepare_items(): void { 'post_status' => array( 'publish', 'draft', 'pending', 'future' ), 'posts_per_page' => $per_page, 'paged' => $current_page, + // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in -- admin-only, paginated translation-picker list; excluded-ID set comes from TranslatedPostIdQuery, not attacker-controlled. 'post__not_in' => $translated_ids, 'orderby' => 'date', 'order' => 'DESC', diff --git a/includes/Blog/Blog.php b/includes/Blog/Blog.php index f918e8e8..3ed39dce 100644 --- a/includes/Blog/Blog.php +++ b/includes/Blog/Blog.php @@ -143,11 +143,11 @@ protected function get_permalink( OptionsInterface $options ) { switch_to_blog( $this->obj->userblog_id ); if ( $is_front_page || $options->has_value( $this->get_language() ) ) { - $url = apply_filters( self::MSLS_GET_PERMALINK_HOOK, $options->get_permalink( $this->get_language() ), $this ); + $url = apply_filters( self::MSLS_GET_PERMALINK_HOOK, $options->get_permalink( $this->get_language() ), $this ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } elseif ( $is_posts_page ) { $page_for_posts = (int) get_option( 'page_for_posts' ); if ( $page_for_posts > 0 ) { - $url = apply_filters( self::MSLS_GET_PERMALINK_HOOK, (string) get_permalink( $page_for_posts ), $this ); + $url = apply_filters( self::MSLS_GET_PERMALINK_HOOK, (string) get_permalink( $page_for_posts ), $this ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } } @@ -201,7 +201,7 @@ public static function description( Blog $a, Blog $b ) { */ public function get_blavatar(): string { $blavatar_html = '
'; - $show_site_icons = apply_filters( self::WP_ADMIN_BAR_SHOW_SITE_ICONS_HOOK, true ); + $show_site_icons = apply_filters( self::WP_ADMIN_BAR_SHOW_SITE_ICONS_HOOK, true ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- intentionally reuses WordPress core's own "wp_admin_bar_show_site_icons" hook name, not a plugin-specific hook. switch_to_blog( $this->obj->userblog_id ); diff --git a/includes/Component/Input/Select.php b/includes/Component/Input/Select.php index 7a8d0a22..14d3b3b9 100644 --- a/includes/Component/Input/Select.php +++ b/includes/Component/Input/Select.php @@ -36,7 +36,7 @@ public function __construct( string $key, array $arr, ?string $selected = null ) * @return string */ public function render(): string { - $name = apply_filters( self::RENDER_FILTER, 'msls[' . $this->key . ']' ); + $name = apply_filters( self::RENDER_FILTER, 'msls[' . $this->key . ']' ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". return sprintf( '', diff --git a/includes/ContentImport/ContentImporter.php b/includes/ContentImport/ContentImporter.php index dbc56e3c..d4fd0117 100644 --- a/includes/ContentImport/ContentImporter.php +++ b/includes/ContentImport/ContentImporter.php @@ -296,7 +296,7 @@ public function import_content( ImportCoordinates $import_coordinates, array $po * * @param ImportCoordinates $import_coordinates */ - do_action( self::MSLS_BEFORE_IMPORT_ACTION, $import_coordinates ); + do_action( self::MSLS_BEFORE_IMPORT_ACTION, $import_coordinates ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". /** * Filters the data before the import runs. @@ -357,7 +357,7 @@ public function import_content( ImportCoordinates $import_coordinates, array $po * * @since TBD */ - do_action( self::MSLS_AFTER_IMPORT_ACTION, $import_coordinates, $logger, $relations ); + do_action( self::MSLS_AFTER_IMPORT_ACTION, $import_coordinates, $logger, $relations ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". /** * Filters the data after the import ran. diff --git a/includes/Frontend/Map/HrefLang.php b/includes/Frontend/Map/HrefLang.php index ec263893..de2f8cf6 100644 --- a/includes/Frontend/Map/HrefLang.php +++ b/includes/Frontend/Map/HrefLang.php @@ -66,6 +66,6 @@ public function get( string $language ): string { * * @since 0.9.9 */ - return (string) apply_filters( self::MSLS_HEAD_HREFLANG_HOOK, $language ); + return (string) apply_filters( self::MSLS_HEAD_HREFLANG_HOOK, $language ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } } diff --git a/includes/Frontend/Output.php b/includes/Frontend/Output.php index e660621f..296c0e97 100644 --- a/includes/Frontend/Output.php +++ b/includes/Frontend/Output.php @@ -98,7 +98,7 @@ public function get( ?int $display, bool $filter = false, $exists = false ): arr * * @since 0.9.8 */ - $arr[] = (string) apply_filters( self::MSLS_GET_HOOK, $url, $link, $is_current_blog ); + $arr[] = (string) apply_filters( self::MSLS_GET_HOOK, $url, $link, $is_current_blog ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } else { $arr[] = sprintf( '%s', @@ -127,7 +127,7 @@ public function get_alternate_links() { $default = ''; foreach ( $blogs->get_objects() as $blog ) { - $url = apply_filters( self::MSLS_ALTERNATE_LINKS_HOOK, $blog->get_url( $options ), $blog ); + $url = apply_filters( self::MSLS_ALTERNATE_LINKS_HOOK, $blog->get_url( $options ), $blog ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". if ( empty( $url ) ) { continue; } @@ -143,10 +143,10 @@ public function get_alternate_links() { } if ( 1 === count( $arr ) ) { - return apply_filters( self::MSLS_ALTERNATE_LINKS_DEFAULT_HOOK, $default ); + return apply_filters( self::MSLS_ALTERNATE_LINKS_DEFAULT_HOOK, $default ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } - $arr = (array) apply_filters( self::MSLS_ALTERNATE_LINKS_ARR_HOOK, $arr ); + $arr = (array) apply_filters( self::MSLS_ALTERNATE_LINKS_ARR_HOOK, $arr ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". return implode( PHP_EOL, $arr ); } @@ -159,7 +159,7 @@ public function get_alternate_links() { public function __toString() { $arr = $this->get( $this->options->display, false, isset( $this->options->only_with_translation ) ); if ( empty( $arr ) ) { - return apply_filters( self::MSLS_NO_TRANSLATION_FOUND_HOOK, '' ); + return apply_filters( self::MSLS_NO_TRANSLATION_FOUND_HOOK, '' ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } $tags = $this->get_tags(); @@ -190,7 +190,7 @@ public function get_tags(): array { * * @since 1.0 */ - $this->tags = (array) apply_filters( self::MSLS_GET_TAGS_HOOK, $this->tags ); + $this->tags = (array) apply_filters( self::MSLS_GET_TAGS_HOOK, $this->tags ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } return $this->tags; diff --git a/includes/Frontend/Widget.php b/includes/Frontend/Widget.php index db3e0b76..6bdb6fb3 100644 --- a/includes/Frontend/Widget.php +++ b/includes/Frontend/Widget.php @@ -55,7 +55,7 @@ public function widget( $args, $instance ) { $content = msls_output()->__toString(); if ( '' === $content ) { $text = __( 'No available translations found', 'multisite-language-switcher' ); - $content = apply_filters( self::MSLS_ALTERNATIVE_CONTENT_HOOK, $text ); + $content = apply_filters( self::MSLS_ALTERNATIVE_CONTENT_HOOK, $text ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } echo wp_kses( diff --git a/includes/Options/Post/Post.php b/includes/Options/Post/Post.php index 1bb708fe..67b392a5 100644 --- a/includes/Options/Post/Post.php +++ b/includes/Options/Post/Post.php @@ -44,7 +44,7 @@ public function get_postlink( $language ) { $post_link = apply_filters_deprecated( 'check_url', array( $post_link, $this ), '2.7.1', Options::MSLS_GET_POSTLINK_HOOK ); - return apply_filters( Options::MSLS_GET_POSTLINK_HOOK, $post_link, $this ); + return apply_filters( Options::MSLS_GET_POSTLINK_HOOK, $post_link, $this ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } /** diff --git a/includes/Options/Query/Query.php b/includes/Options/Query/Query.php index 80be9f52..d8988959 100644 --- a/includes/Options/Query/Query.php +++ b/includes/Options/Query/Query.php @@ -87,7 +87,7 @@ public function get_postlink( $language ) { if ( ! empty( $post_link ) ) { $post_link = apply_filters_deprecated( 'check_url', array( $post_link, $this ), '2.7.1', Options::MSLS_GET_POSTLINK_HOOK ); - return apply_filters( Options::MSLS_GET_POSTLINK_HOOK, $post_link, $this ); + return apply_filters( Options::MSLS_GET_POSTLINK_HOOK, $post_link, $this ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } } diff --git a/includes/Options/Tax/Tax.php b/includes/Options/Tax/Tax.php index 940ccd7e..e255e6de 100644 --- a/includes/Options/Tax/Tax.php +++ b/includes/Options/Tax/Tax.php @@ -95,7 +95,7 @@ public function get_postlink( $language ) { $post_link = apply_filters_deprecated( 'check_url', array( $post_link, $this ), '2.7.1', Options::MSLS_GET_POSTLINK_HOOK ); - return apply_filters( Options::MSLS_GET_POSTLINK_HOOK, $post_link, $this ); + return apply_filters( Options::MSLS_GET_POSTLINK_HOOK, $post_link, $this ); // phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.DynamicHooknameFound -- constant value is already prefixed with "msls_". } public function get_permalink( string $language ): string { diff --git a/includes/Plugin.php b/includes/Plugin.php index a2ac66d9..5080e69a 100644 --- a/includes/Plugin.php +++ b/includes/Plugin.php @@ -36,11 +36,15 @@ class Plugin { /** * Injected Options object + * + * @var Options */ protected Options $options; /** * MslsPlugin constructor. + * + * @param Options $options Options object. */ public function __construct( Options $options ) { $this->options = $options; @@ -52,8 +56,6 @@ public function __construct( Options $options ) { public static function init(): void { $obj = new self( msls_options() ); - add_action( 'init', array( $obj, 'init_i18n_support' ) ); - register_activation_hook( self::file(), array( __CLASS__, 'activate' ) ); if ( function_exists( 'is_multisite' ) && is_multisite() ) { @@ -194,16 +196,6 @@ public static function path(): string { return defined( 'MSLS_PLUGIN_PATH' ) ? constant( 'MSLS_PLUGIN_PATH' ) : ''; } - /** - * Loads the translation files for the plugin from the bundled /languages/ directory. - * - * Required because the plugin ships its own .mo files; WordPress only auto-loads - * translations served from wordpress.org's language packs. - */ - public function init_i18n_support(): void { - load_plugin_textdomain( 'multisite-language-switcher', false, self::dirname( '/languages/' ) ); - } - /** * Message handler * diff --git a/includes/RestApi/RestApi.php b/includes/RestApi/RestApi.php index 46ea9b6e..7e6138c7 100644 --- a/includes/RestApi/RestApi.php +++ b/includes/RestApi/RestApi.php @@ -406,6 +406,7 @@ public function list_untranslated_posts( \WP_REST_Request $request ) { 'post_type' => $post_type, 'post_status' => self::UNTRANSLATED_POST_STATUSES, 'numberposts' => self::UNTRANSLATED_POSTS_LIMIT, + // phpcs:ignore WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_post__not_in -- capability-checked REST route, bounded by UNTRANSLATED_POSTS_LIMIT; excluded-ID set comes from TranslatedPostIdQuery, not attacker-controlled. 'post__not_in' => $translated_ids, 'suppress_filters' => false, 'orderby' => 'date',