From 91b39e705560db5202c14e85fe6d35cd5b4ba39b Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 19 Jun 2026 16:51:26 +0000 Subject: [PATCH 1/3] fix: extend phpcs:disable to cover both lines of the manual CSS POST read --- SLASHED-for-WP/includes/class-manual-css-page.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/SLASHED-for-WP/includes/class-manual-css-page.php b/SLASHED-for-WP/includes/class-manual-css-page.php index 648d8eb1..e58d5366 100644 --- a/SLASHED-for-WP/includes/class-manual-css-page.php +++ b/SLASHED-for-WP/includes/class-manual-css-page.php @@ -61,10 +61,11 @@ public function handle_save() { if ( 'clear' === $action ) { update_option( self::OPTION_KEY, '' ); } else { - // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- CSS cannot be sanitized via wp_kses without corrupting valid rules (e.g. `>`, `[attr~="val"]`). The value is validated below and stored raw; output is escaped at render time. + // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- CSS cannot be sanitized via wp_kses without corrupting valid rules (e.g. `>`, `[attr~="val"]`). The value is validated below against injection patterns and stored raw; output is escaped at render time. $raw_css = isset( $_POST['slashed_manual_css'] ) ? wp_unslash( $_POST['slashed_manual_css'] ) : ''; + // phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized // CSS must not be able to break out of an inline , corrupting valid CSS like From a43b33f6f22ef622dbc81abc097b7c05ac9f85f9 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 19 Jun 2026 16:55:55 +0000 Subject: [PATCH 2/3] fix: include readme.txt and license.txt in plugin zip, fix phpcs:disable scope --- scripts/zip-plugin.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/zip-plugin.js b/scripts/zip-plugin.js index f1b57468..1e8725de 100644 --- a/scripts/zip-plugin.js +++ b/scripts/zip-plugin.js @@ -39,6 +39,8 @@ const PLUGIN_ROOT = 'SLASHED-for-WP'; // src is the repo path; dest is the path inside the slashed/ zip folder. const INCLUDE = [ { src: `${PLUGIN_ROOT}/slashed.php`, dest: 'slashed.php' }, + { src: `${PLUGIN_ROOT}/readme.txt`, dest: 'readme.txt' }, + { src: `${PLUGIN_ROOT}/license.txt`, dest: 'license.txt' }, { src: `${PLUGIN_ROOT}/includes`, dest: 'includes' }, { src: `${PLUGIN_ROOT}/assets/admin-app`, dest: 'assets/admin-app', required: true }, { src: `${PLUGIN_ROOT}/dist`, dest: 'dist', required: true }, From 2286a2e402bef9988931e154b366b9139a393d4b Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 19 Jun 2026 17:04:18 +0000 Subject: [PATCH 3/3] fix: mark readme.txt and license.txt as required in zip packaging --- scripts/zip-plugin.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/zip-plugin.js b/scripts/zip-plugin.js index 1e8725de..c1ffaa64 100644 --- a/scripts/zip-plugin.js +++ b/scripts/zip-plugin.js @@ -39,8 +39,8 @@ const PLUGIN_ROOT = 'SLASHED-for-WP'; // src is the repo path; dest is the path inside the slashed/ zip folder. const INCLUDE = [ { src: `${PLUGIN_ROOT}/slashed.php`, dest: 'slashed.php' }, - { src: `${PLUGIN_ROOT}/readme.txt`, dest: 'readme.txt' }, - { src: `${PLUGIN_ROOT}/license.txt`, dest: 'license.txt' }, + { src: `${PLUGIN_ROOT}/readme.txt`, dest: 'readme.txt', required: true }, + { src: `${PLUGIN_ROOT}/license.txt`, dest: 'license.txt', required: true }, { src: `${PLUGIN_ROOT}/includes`, dest: 'includes' }, { src: `${PLUGIN_ROOT}/assets/admin-app`, dest: 'assets/admin-app', required: true }, { src: `${PLUGIN_ROOT}/dist`, dest: 'dist', required: true },