Update to the latest live version

checks/style_tags.php

@@ -17,7 +17,7 @@ function check( $php_files, $css_files, $other_files ) {
 			return $ret;
 		}
 		$deprecated_tags = array("flexible-width","fixed-width","black","blue","brown","gray","green","orange","pink","purple","red","silver","tan","white","yellow","dark","light","fixed-layout","fluid-layout","responsive-layout","blavatar","holiday","photoblogging","seasonal");
-		$allowed_tags = array('grid-layout',"one-column","two-columns","three-columns","four-columns","left-sidebar","right-sidebar","flexible-header",'footer-widgets',"accessibility-ready","buddypress","custom-background","custom-colors","custom-header","custom-menu","custom-logo","editor-style","featured-image-header","featured-images","front-page-post-form","full-width-template","microformats","post-formats","rtl-language-support","sticky-post","theme-options","threaded-comments","translation-ready",'blog','e-commerce','education','entertainment','food-and-drink','holiday','news','photography','portfolio');
+		$allowed_tags = array('grid-layout',"one-column","two-columns","three-columns","four-columns","left-sidebar","right-sidebar","wide-blocks","flexible-header",'footer-widgets',"accessibility-ready","block-styles","buddypress","custom-background","custom-colors","custom-header","custom-menu","custom-logo","editor-style","featured-image-header","featured-images","front-page-post-form","full-width-template","microformats","post-formats","rtl-language-support","sticky-post","theme-options","threaded-comments","translation-ready",'blog','e-commerce','education','entertainment','food-and-drink','holiday','news','photography','portfolio');
 		$subject_tags = array('blog','e-commerce','education','entertainment','food-and-drink','holiday','news','photography','portfolio');
 		$subject_tags_count = 0;
 		$subject_tags_name = "";
@@ -36,7 +36,7 @@ function check( $php_files, $css_files, $other_files ) {
 					$ret = false;
 				}
 			}
-			
+
 			if ( in_array( strtolower( $tag ), $subject_tags ) ) {
 				$subject_tags_name .= strtolower( $tag ) . ', ';
 				$subject_tags_count++;
@@ -48,14 +48,14 @@ function check( $php_files, $css_files, $other_files ) {
 					$ret = false;
 				}
 			}
-			
+
 		}
-		
+
 		if ( $subject_tags_count > 3 ) {
 			$this->error[] = '<span class="tc-lead tc-required">'. __('REQUIRED','theme-check'). '</span>: ' . sprintf( __('A maximum of 3 subject tags are allowed. The theme has %1$u subjects tags ( %2$s ). Please remove the subject tags, which do not directly apply to the theme.', 'theme-check'), $subject_tags_count, '<strong>' . rtrim( $subject_tags_name, ', ' ) . '</strong>' ) . ' ' . '<a target="_blank" href="https://make.wordpress.org/themes/handbook/review/required/theme-tags/">' . __( 'See Theme Tags', 'theme-check' ) . '</a>';
 			$ret = false;
 		}
-		
+
 		return $ret;
 	}
 

main.php

@@ -121,7 +121,7 @@ function tc_strip_comments( $code ) {
 		$token = next($tokens);
 	}
 	return $return;
-} 
+}
 
 
 function tc_intro() {
@@ -170,5 +170,6 @@ function tc_form() {
 	echo '<input class="button" type="submit" value="' . __( 'Check it!', 'theme-check' ) . '" />';
 	if ( defined( 'TC_PRE' ) || defined( 'TC_POST' ) ) echo ' <input name="trac" type="checkbox" /> ' . __( 'Output in Trac format.', 'theme-check' );
 	echo '<input name="s_info" type="checkbox" /> ' . __( 'Suppress INFO.', 'theme-check' );
+	wp_nonce_field( 'themecheck-nonce' );
 	echo '</form>';
 }

readme.txt

@@ -3,9 +3,9 @@ Contributors: Otto42, pross
 Author URI: http://ottopress.com/
 Plugin URL: http://ottopress.com/wordpress-plugins/theme-check/
 Requires at Least: 3.7
-Tested Up To: 4.4
+Tested Up To: 5.2
 Tags: template, theme, check, checker, tool, wordpress, wordpress.org, upload, uploader, test, guideline, review
-Stable tag: 20151211.1
+Stable tag: 20190801.1
 
 A simple and easy way to test your theme for all the latest WordPress standards and practices. A great theme development tool!
 
@@ -54,6 +54,17 @@ comments, or feedback:[[br]]
 If **either** of these two vars are defined a new trac tickbox will appear next to the *Check it!* button.
 
 == Changelog ==
+= 20190801.1 =
+* Fix missing nonce and nonce check on admin page. props Steven Stern for reporting the issue to the plugins team. Though this is technically a CSRF, there is no vulnerability arising from it, as the only thing that could be done with the form is to scan a theme.
+
+= 20190208.1 =
+* Add new styles for the block editor. See https://meta.trac.wordpress.org/ticket/3921
+
+= 20160523.1 =
+* Fix for theme-names with dashes in them
+* Comments stripping changes
+* Many changes by the theme review team and others. See Github for full change list.
+
 = 20151211.1 = 
 * Full sync with Github and all the changes that have happened there.
 * Release for 4.4 deprecated functions.

theme-check.php

@@ -5,7 +5,7 @@
 Description: A simple and easy way to test your theme for all the latest WordPress standards and practices. A great theme development tool!
 Author: Otto42, pross
 Author URI: http://ottopress.com
-Version: 20160523.1
+Version: 20190801.1
 Text Domain: theme-check
 License: GPLv2
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -57,8 +57,9 @@ function themecheck_do_page() {
 		}
 
 		if ( isset( $_POST[ 'themename' ] ) ) {
+			check_admin_referer( 'themecheck-nonce' );
 			if ( isset( $_POST[ 'trac' ] ) ) define( 'TC_TRAC', true );
-			if ( defined( 'WP_MAX_MEMORY_LIMIT' ) ) { 
+			if ( defined( 'WP_MAX_MEMORY_LIMIT' ) ) {
 				@ini_set( 'memory_limit', WP_MAX_MEMORY_LIMIT );
 			}
 			check_main( $_POST[ 'themename' ] );