Changeset 8085 for sites/trunk/wordcamp.org/public_html/wp-content/plugins/wcpt/wcpt-meetup/class-meetup-admin.php

Timestamp:

01/16/2019 03:36:24 PM (6 years ago)

Author:

vedjain

Message:

WCPT: Applies code standard changes to wcpt plugin.

Most of the changes are small, but these are some important ones:

1. Added nonce check in multiple places. This will ensure that request is always coming from the intended page.

2. Escaped output HTML in many places. These are not necessarily XSS vulnerabilities, and in most places they were hardcoded. But its a good practice to always escape regardless of source.

Summary:

• wcpt-event/class-event-admin.php
  • Added nonce check in metabox_save.
  • Escaped output in dislpay_meta_boxes

• wcpt-event/class-event-application.php
  • Change definition of submit_application to pass $POST arguments

• wcpt-loader.php
  • Indent whole file by 1 indent.

• wcpt-meetup/class-meetup-admin.php
  • Added nonce check in maybe_update_meetup_data

• wcpt-wordcamp/wordcamp-admin.php
  • Escaping in user_profile_wordcamp, column_data
  • Escaping using kses in post_row_actions
  • Use post_data_raw instead of $_POST in enforce_post_status

File:

• sites/trunk/wordcamp.org/public_html/wp-content/plugins/wcpt/wcpt-meetup/class-meetup-admin.php (modified) (20 diffs)

sites/trunk/wordcamp.org/public_html/wp-content/plugins/wcpt/wcpt-meetup/class-meetup-admin.php

@@ -120 +120 @@
         /**
          * Checks if a field is read only.
+         *
          * @param string $key Name of the field.
          *
@@ -168 +169 @@
          * TODO: Remove quickedit action.
          *
-         * @param $actions
-         * @param $post
+         * @param array   $actions
+         * @param WP_Post $post
          *
          * @return mixed
@@ -296 +297 @@
                 $last_synced_on = 'Never';
             } else {
-                $last_synced_on = date( "Y-m-d",  substr( $last_synced_on, 0, 10 ) );
+                $last_synced_on = date( 'Y-m-d',  substr( $last_synced_on, 0, 10 ) );
             }
             ?>
             <div class="wcb submitbox">
                 <div class="misc-pub-section">
-                    <label>Last sync: <?php echo $last_synced_on ?></label>
+                    <label>Last sync: <?php echo esc_html( $last_synced_on ); ?></label>
                 </div>
                 <div class="misc-pub-section">
                     <label>
-                        <input type="checkbox" name="<?php echo $element_name ?>" >
+                        <input type="checkbox" name="<?php echo esc_html( $element_name ); ?>" >
                         Sync Now
                     </label>
@@ -316 +317 @@
          * Updates meetup fields using meetup.com API only if Sync now checkbox is checked.
          *
-         * @param int   $post_id
-         * @param array $original_meta_values
-         */
-        public function maybe_update_meetup_data( $post_id ){
+         * @param int $post_id
+         */
+        public function maybe_update_meetup_data( $post_id ) {
             if ( $this->get_event_type() !== get_post_type() ) {
                 return;
             }
 
-            $should_sync = $_POST[ 'sync_with_meetup_api' ] ?? false;
+            //phpcs:ignore WordPress.Security.NonceVerification.Missing -- Nonce verified in `metabox_save` in class-event-admin.php.
+            $should_sync = $_POST['sync_with_meetup_api'] ?? false;
             if ( ! $should_sync ) {
                 return;
@@ -340 +341 @@
          * Update meetup fields using meetup.com API
          *
-         * @param $post_id
+         * @param int $post_id
          *
          * @return array|WP_Error
@@ -350 +351 @@
             $parsed_url = wp_parse_url( $meetup_url, -1 );
 
-            if( ! $parsed_url ) {
+            if ( ! $parsed_url ) {
                 return new WP_Error( 'invalid-url', __('Provided Meetup URL is not a valid URL.', 'wordcamporg' ) );
             }
@@ -391 +392 @@
                 foreach ( $group_leads as $event_host ) {
                     if ( WCPT_WORDPRESS_MEETUP_ID === $event_host['id'] ) {
-                        // Skip WordPress admin user
+                        // Skip WordPress admin user.
                         continue;
                     }
                     $event_hosts[] = array(
-                            'name' => $event_host['name'],
-                            'id'   => $event_host['id'],
+                        'name' => $event_host['name'],
+                        'id'   => $event_host['id'],
                     );
                 }
@@ -406 +407 @@
             update_post_meta( $post_id, 'Meetup group created on', $group_details['created'] / 1000 );
 
-
             if ( isset( $group_details['last_event'] ) && is_array( $group_details['last_event'] ) ) {
                 update_post_meta( $post_id, 'Number of past meetups', $group_details['past_event_count'] );
@@ -423 +423 @@
          * @param array $original_data
          */
-        public function meetup_organizers_changed( $post_id, $original_data ){
+        public function meetup_organizers_changed( $post_id, $original_data ) {
             global $post;
 
@@ -509 +509 @@
          * Send notification when a new Meetup groups is added to the chapter.
          *
-         * @param WP_Post $meetup Meetup post object
+         * @param WP_Post $meetup Meetup post object.
          *
          * @return bool|string
@@ -519 +519 @@
             $organizer_slack = get_post_meta( $meetup->ID, 'Slack', true );
             $meetup_link     = get_post_meta( $meetup->ID, 'Meetup URL', true );
-            $title           = "New meetup group added";
+            $title           = 'New meetup group added';
 
             $message = sprintf(
@@ -557 +557 @@
          * Helper method which triggers action `update_meetup_organizers`
          *
-         * @param $organizers
-         * @param $post
+         * @param array   $organizers
+         * @param WP_Post $post
          */
         protected function update_meetup_organizers( $organizers, $post ) {
@@ -580 +580 @@
                 'invalid-response'   => array(
                     'type'   => 'notice',
-                    'notice' => __( 'Received invalid response from Meetup API. Please make sure Meetup URL is correct, or try again after some time.', 'wordcamporg' )
+                    'notice' => __( 'Received invalid response from Meetup API. Please make sure Meetup URL is correct, or try again after some time.', 'wordcamporg' ),
                 ),
                 'group_error'        => array(
                     'type'   => 'notice',
-                    'notice' => __( 'Received invalid response from Meetup API. Please make sure Meetup URL is correct, or try again after some time.', 'wordcamporg' )
+                    'notice' => __( 'Received invalid response from Meetup API. Please make sure Meetup URL is correct, or try again after some time.', 'wordcamporg' ),
                 ),
                 'http_response_code' => array(
                     'type'   => 'notice',
-                    'notice' => __( 'Received invalid response code from Meetup API. Please make sure Meetup URL is correct, or try again after some time.', 'wordcamporg' )
+                    'notice' => __( 'Received invalid response code from Meetup API. Please make sure Meetup URL is correct, or try again after some time.', 'wordcamporg' ),
                 ),
             );
@@ -597 +597 @@
          * Render list of co-organizer of meetup linking to their profile on meetup.com
          *
-         * @param string $key Name of meetup field. Should be 'Meetup Co-organizer names'
+         * @param string $key Name of meetup field. Should be 'Meetup Co-organizer names'.
          */
         public function render_co_organizers_list( $key ) {
@@ -605 +605 @@
             }
             $organizers = get_post_meta( $post_id, $key, true );
-            if ( isset ( $organizers ) && is_array( $organizers ) ) {
+            if ( isset( $organizers ) && is_array( $organizers ) ) {
                 $group_slug = get_post_meta( $post_id, 'Meetup URL', true );
-                if ( empty ( $group_slug ) ) {
+                if ( empty( $group_slug ) ) {
                     echo 'Invalid Meetup Group URL';
                     return;
@@ -625 +625 @@
                 echo '</ul>';
             } else {
-                echo __( 'No meetup organizers set.', 'wordcamp.org' );
+                esc_html_e( 'No meetup organizers set.', 'wordcamp.org' );
             }
         }
@@ -742 +742 @@
          */
         public static function meetup_api_sync() {
-            $query = new WP_Query( array(
-                'post_type'   => self::get_event_type(),
-                'post_status' => 'wcpt-mtp-active',
-                'fields'      => 'ids',
-                'posts_per_page' => -1,
-            ) );
+            $query = new WP_Query(
+                array(
+                    'post_type'      => self::get_event_type(),
+                    'post_status'    => 'wcpt-mtp-active',
+                    'fields'         => 'ids',
+                    'posts_per_page' => - 1,
+                )
+            );
 
             $new_meetup_org_data = array();
@@ -769 +771 @@
                 }
 
-                if ( empty ( $new_ids ) ) {
+                if ( empty( $new_ids ) ) {
                     continue;
                 }
@@ -802 +804 @@
             $count = 0;
             foreach ( $new_meetup_org_data as $post_id => $new_meetup_org ) {
-                $count += 1;
+                $count ++;
                 $title = get_the_title( $post_id );
                 $meetup_tracker_url = get_site_url() . "/wp-admin/post.php?post=$post_id&action=edit";
@@ -813 +815 @@
                     $meetup_members[] = "<a href='$meetup_group_url/members/$organizer_id' target='_blank' rel='noreferrer' >$organizer_name</a>";
                 }
-                $template = $template . join( ', ', $meetup_members ) . "<br>";
-
-                // Add a tag for meetup
+                $template = $template . join( ', ', $meetup_members ) . '<br>';
+
+                // Add a tag for meetup.
                 wp_set_object_terms( $post_id, 'Needs to update Organizer list', 'meetup_tags', true );
             }