Skip to content

v2.4.2 — Plugin Check pass

Choose a tag to compare

View all tags
@dukenukemall dukenukemall released this 18 May 09:46
· 6 commits to main since this release
v2.4.2
529d3e4

v2.4.2 — WordPress.org Plugin Check pass

Resolves every Error and warning flagged by the WP.org Plugin Check tool. No runtime behaviour changes.

Errors fixed

  • WordPress.DB.PreparedSQL.NotPrepared (class-fungies-workspace-meta.php lines 94-95) — Replaced the string-concatenated meta_key clause with a fully prepared statement using $wpdb->prepare() + $wpdb->esc_like(). Removed the now-dead pushed_offer_meta_key_sql_clause helper.
  • WordPress.DB.PreparedSQL.InterpolatedNotPrepared + PluginCheck.Security.DirectDB.UnescapedDBParameter (class-fungies-product-sync.php lines 114, 120) — cleanup_pushed_duplicates() is now a single $wpdb->prepare() call with %s placeholders. The interpolated $pushed_clause string is gone.
  • WordPress.WP.I18n.MissingTranslatorsComment — Added /* translators: ... */ comments above every gettext call with placeholders:
    • class-fungies-admin-settings.php lines 216, 302
    • class-fungies-order-sync.php lines 87, 144, 194
    • class-fungies-product-sync.php line 51
  • WordPress.WP.I18n.UnorderedPlaceholdersText (class-fungies-admin-settings.php line 302) — Reworked 'Connected to %s API! (%s)' into ordered placeholders 'Connected to %1$s API! (%2$s)' so translators can reorder.

Warnings annotated with narrow, justified phpcs:ignore

Each suppression has an inline rationale comment immediately above it, so reviewers can see why the warning is being silenced:

  • WordPress.Security.NonceVerification.Recommended — Two read-only branches: the wc-api=fungies_return redirect handler (class-fungies-checkout.php) and the admin-settings tab discrimination (class-fungies-admin-settings.php). Neither mutates state; payment state lives in the parallel HMAC-SHA256-verified webhook.
  • WordPress.DB.DirectDatabaseQuery.DirectQuery + NoCaching — Three single-row prepared lookups against indexed meta_key / meta_value pairs (one each in workspace-meta, product-sync, order-sync). Running them through WP_Query adds overhead with no caching benefit since they fire once per webhook line item / sync pass.
  • WordPress.DB.SlowDBQuery.* — Same indexed lookups + the single meta_query NOT EXISTS on _fungies_offer_id used by the push pass. Low-cardinality keys set only on synced products.

Upgrade

Drop-in replacement for v2.4.1. No data migrations, no config changes required.

Assets 3
Loading