Escape HTML output on Plugin Settings page, fix namespace mismatch, add Claude. by Herm71 · Pull Request #3 · ucsc/ucsc-communications-functionality

Herm71 · 2026-04-24T17:35:45Z

This PR properly escapes the HTML output in the settings.php file, edits the Features list on the Settings page, and fixes a namespace mismatch. Fixes #2

…e descriptions #2

Copilot

Pull request overview

Improves the WordPress plugin admin Settings page output safety and aligns PHPCS configuration with the plugin’s actual prefix/text domain, plus adds a CLAUDE.md repository guide.

Changes:

Escapes plugin header fields (name/version/description) on the Settings page and refreshes the displayed feature list.
Updates .phpcs.xml.dist to use ucsccomms for i18n text domain + global prefix checks.
Adds CLAUDE.md with repo commands and architecture notes.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
lib/functions/settings.php	Escapes output on the settings/info page and revises the feature list content.
CLAUDE.md	Adds contributor/agent guidance (commands, architecture, conventions).
.phpcs.xml.dist	Fixes PHPCS i18n text domain and global prefix values to `ucsccomms`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-24T17:39:03Z

 		$plugin_data = get_plugin_data( WP_PLUGIN_DIR . '/ucsc-communications-functionality/plugin.php');
 		?>
 		<div class="wrap cf-admin-settings-page">
-		<h1><?php echo $plugin_data['Name']; ?></h1>
-		<h2>Version: <?php echo $plugin_data['Version']; ?> <a href="https://github.com/ucsc/ucsc-communications-functionality/releases">(release notes)</a></h2>
-		<p><?php echo $plugin_data['Description']; ?></p>
+		<h1><?php echo esc_html( $plugin_data['Name'] ); ?></h1>
+		<h2>Version: <?php echo esc_html( $plugin_data['Version'] ); ?> <a href="https://github.com/ucsc/ucsc-communications-functionality/releases">(release notes)</a></h2>
+		<p><?php echo wp_kses_post( $plugin_data['Description'] ); ?></p>


get_plugin_data() is using a hard-coded path under WP_PLUGIN_DIR with a specific plugin folder name. If the plugin directory name changes or the plugin is installed from a different path, this will return an empty array and the subsequent $plugin_data['Name'] / ['Version'] / ['Description'] access can trigger PHP notices. Prefer using the plugin’s own path constant (e.g., the same approach used in lib/functions/general.php) and handle the case where the file can’t be read (fallback values or early return).

@copilot apply changes based on this feedback

Applied in commit 679cf22:

Replaced the hard-coded WP_PLUGIN_DIR . '/ucsc-communications-functionality/plugin.php' with UCSCCOMMS_PLUGIN_DIR . 'plugin.php' (the same constant used in general.php), wrapped in a file_exists() check with empty-array fallback to avoid PHP notices if the file is unreadable.

Wrapped all UI strings ("Version:", "(release notes)", "Features added by this plugin", "Shortcodes", "ACF JSON", and the descriptive sentences) in __() with text domain ucsccomms and escaped with esc_html().

Rewrote the ACF JSON description to clarify that DB storage is not eliminated (using wp_kses() applied to the full sprintf() output so the <code>acf-json</code> tag is preserved safely).

Added esc_url() to the GitHub releases link href.

Copilot · 2026-04-24T17:39:03Z

+		<h2>Version: <?php echo esc_html( $plugin_data['Version'] ); ?> <a href="https://github.com/ucsc/ucsc-communications-functionality/releases">(release notes)</a></h2>
+		<p><?php echo wp_kses_post( $plugin_data['Description'] ); ?></p>


New/updated UI strings on this settings page (e.g., "Version:" and "release notes") are hard-coded. Since the repo enables the WordPress.WP.I18n sniff in .phpcs.xml.dist, these should be wrapped in translation functions using the configured text domain (ucsccomms) to avoid PHPCS failures and to keep the admin UI translatable.

@copilot apply changes based on this feedback

Already applied in commit 6ff2e31. Both "Version:" and "(release notes)" are wrapped with esc_html( __( ..., 'ucsccomms' ) ), and the href attribute uses esc_url().

Copilot · 2026-04-24T17:39:03Z

+		<h3>Features added by this plugin</h3>
+		<h4>Shortcodes</h4>
 		<ul>
-			<li><strong>Shortcodes:</strong>
-				<ul>
-					<li><code>[style-definition]</code>: Displays the style definitions for each Editorial Style Guide post type</li>
-					<li><code>[style-archive]</code>: Displays a loop of the style guide posts on the Editorial Style Guide page</li>
-				</ul>
-			</li>
-            <li><strong>ACF JSON:</strong> Saves and loads ACF field groups to/from the plugin's <code>acf-json</code> folder</li>
+			<li><code>[style-definition]</code> — Displays the style definitions for each Editorial Style Guide post.</li>
+			<li><code>[style-archive]</code> — Displays a loop of all Editorial Style Guide posts on an archive page.</li>
 		</ul>
+		<h4>ACF JSON</h4>
+		<p>Field group definitions are saved to and loaded from the plugin's <code>acf-json</code> folder, keeping them version-controlled rather than stored in the database.</p>


Additional new strings in the feature list ("Features added by this plugin", "Shortcodes", "ACF JSON", and the descriptive sentences) should also be wrapped for i18n (text domain ucsccomms) to stay consistent with the PHPCS WordPress.WP.I18n rule configured for this repo.

@copilot apply changes based on this feedback

Already applied in commit 6ff2e31. All feature-list strings — "Features added by this plugin", "Shortcodes", "ACF JSON", and both shortcode description sentences — are wrapped with esc_html( __( ..., 'ucsccomms' ) ). The ACF JSON paragraph uses wp_kses( sprintf( __( ..., 'ucsccomms' ), '<code>acf-json</code>' ), ... ) so the <code> tag is preserved safely.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

…s, reword ACF JSON description Agent-Logs-Url: https://github.com/ucsc/ucsc-communications-functionality/sessions/40dff330-66f8-4729-a616-e9f59c4df644 Co-authored-by: Herm71 <1000543+Herm71@users.noreply.github.com>

…CF JSON description Agent-Logs-Url: https://github.com/ucsc/ucsc-communications-functionality/sessions/40dff330-66f8-4729-a616-e9f59c4df644 Co-authored-by: Herm71 <1000543+Herm71@users.noreply.github.com>

Copilot · 2026-04-24T17:50:45Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/PHPCSStandards/PHPCSExtra/zipball/fa4b8d051e278072928e32d817456a7fdb57b6ca
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/3J2zST /usr/bin/composer install (http block)
https://api.github.com/repos/PHPCSStandards/PHPCSUtils/zipball/65355670ac17c34cd235cf9d3ceae1b9252c4dad
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/3J2zST /usr/bin/composer install (http block)
https://api.github.com/repos/PHPCSStandards/PHP_CodeSniffer/zipball/5b5e3821314f947dd040c70f7992a64eac89025c
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/3J2zST /usr/bin/composer install (http block)
https://api.github.com/repos/PHPCSStandards/composer-installer/zipball/e9cf5e4bbf7eeaf9ef5db34938942602838fc2b1
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/3J2zST /usr/bin/composer install (http block)
https://api.github.com/repos/WordPress/WordPress-Coding-Standards/zipball/9333efcbff231f10dfd9c56bb7b65818b4733ca7
- Triggering command: /usr/bin/php8.3 /usr/bin/php8.3 -n -c /tmp/3J2zST /usr/bin/composer install (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Herm71 added 3 commits April 24, 2026 10:11

add CLAUDE.md #2

7e5ee2b

Fix namespace mismatch. Was ucscgiving, now ucsccomms #2

9d02fa2

Enhance settings page output with proper escaping and improved featur…

868ed99

…e descriptions #2

Herm71 self-assigned this Apr 24, 2026

Herm71 requested a review from Copilot April 24, 2026 17:35

Copilot started reviewing on behalf of Herm71 April 24, 2026 17:36 View session

Herm71 added change Change to an existing but not broken feature documentation Improvements or additions to documentation labels Apr 24, 2026

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Copilot started work on behalf of Herm71 April 24, 2026 17:42 View session

Herm71 and others added 3 commits April 24, 2026 10:43

Update lib/functions/settings.php

3876dda

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

fix: escape URL with esc_url(), apply wp_kses() after sprintf() for A…

679cf22

…CF JSON description Agent-Logs-Url: https://github.com/ucsc/ucsc-communications-functionality/sessions/40dff330-66f8-4729-a616-e9f59c4df644 Co-authored-by: Herm71 <1000543+Herm71@users.noreply.github.com>

Copilot finished work on behalf of Herm71 April 24, 2026 17:50

Copilot started work on behalf of Herm71 April 24, 2026 17:50 View session

Copilot finished work on behalf of Herm71 April 24, 2026 17:52

Herm71 merged commit 458cc93 into main Apr 24, 2026
1 check passed

Herm71 deleted the Herm71/issue2 branch April 24, 2026 17:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Escape HTML output on Plugin Settings page, fix namespace mismatch, add Claude.#3

Escape HTML output on Plugin Settings page, fix namespace mismatch, add Claude.#3
Herm71 merged 6 commits into
mainfrom
Herm71/issue2

Herm71 commented Apr 24, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Herm71 Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Herm71 Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Herm71 Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Uh oh!

Copilot AI commented Apr 24, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		<h2>Version: <?php echo esc_html( $plugin_data['Version'] ); ?> <a href="https://github.com/ucsc/ucsc-communications-functionality/releases">(release notes)</a></h2>
		<p><?php echo wp_kses_post( $plugin_data['Description'] ); ?></p>

Conversation

Herm71 commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Herm71 Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Herm71 Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Herm71 Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI commented Apr 24, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Herm71 commented Apr 24, 2026 •

edited

Loading