Lint main plugin file

composer.json

@@ -8,7 +8,8 @@
         "wp-coding-standards/wpcs": "^3.0"
     },
     "scripts":{
-        "lint": "phpcs --standard=phpcs.xml",
+        "lint": "phpcs --standard=phpcs.xml -s",
+        "lint:fix": "phpcbf --standard=phpcs.xml",
         "dev:start": "wp-env start --debug && wp-env run cli wp rewrite structure '/%postname%/'",
         "dev:debug": "wp-env start --xdebug",
         "dev:stop": "wp-env stop",

phpcs.xml

@@ -5,14 +5,16 @@
     <arg name="colors"/>
     <arg name="extensions" value="php"/>
 
-    <file>./bin/</file>
     <!--
     <file>./includes/</file>
     <file>./templates/</file>
     <file>./tests/</file>
-    <file>./wporg-gp-translation-events.php</file>
     -->
+    <file>./wporg-gp-translation-events.php</file>
 
     <rule ref="WordPress">
+        <exclude name="Squiz.Commenting.FileComment.MissingPackageTag"/>
+        <exclude name="Squiz.Commenting.FileComment.Missing"/>
+        <exclude name="Squiz.Commenting.FunctionComment.Missing"/>
     </rule>
 </ruleset>

wporg-gp-translation-events.php

@@ -16,14 +16,13 @@
  * @package Translation Events
  */
 
-
 /**
  * Check if a slug is being used by another post type.
  *
  * @param string $slug The slug to check.
  * @return bool
  */
-function slug_exists( $slug ) {
+function slug_exists( string $slug ): bool {
 	$post_types = get_post_types( array( '_builtin' => false ) );
 	foreach ( $post_types as $post_type ) {
 		$post_type_object = get_post_type_object( $post_type );
@@ -82,7 +81,7 @@ function event_meta_boxes() {
  *
  * @param  WP_Post $post The current post object.
  */
-function event_dates_meta_box( $post ) {
+function event_dates_meta_box( WP_Post $post ) {
 	wp_nonce_field( 'event_dates_nonce', 'event_dates_nonce' );
 	$event_start = get_post_meta( $post->ID, '_event_start', true );
 	$event_end   = get_post_meta( $post->ID, '_event_end', true );
@@ -97,29 +96,36 @@ function event_dates_meta_box( $post ) {
  *
  * @param  int $post_id The current post ID.
  */
-function save_event_meta_boxes( $post_id ) {
+function save_event_meta_boxes( int $post_id ) {
 	$nonces = array( 'event_dates' );
 	foreach ( $nonces as $nonce ) {
-		if ( ! isset( $_POST[ $nonce . '_nonce' ] ) || ! wp_verify_nonce( $_POST[ $nonce . '_nonce' ], $nonce . '_nonce' ) ) {
+		$nonce_name = $nonce . '_nonce';
+		if ( ! isset( $_POST[ $nonce_name ] ) ) {
+			return;
+		}
+		$nonce_value = sanitize_text_field( wp_unslash( $_POST[ $nonce_name ] ) );
+		if ( ! wp_verify_nonce( $nonce_value, $nonce_name ) ) {
 			return;
 		}
 	}
 
 	$fields = array( 'event_start', 'event_end' );
 	foreach ( $fields as $field ) {
 		if ( isset( $_POST[ $field ] ) ) {
-			update_post_meta( $post_id, '_' . $field, sanitize_text_field( $_POST[ $field ] ) );
+			update_post_meta( $post_id, '_' . $field, sanitize_text_field( wp_unslash( $_POST[ $field ] ) ) );
 		}
 	}
 }
+
 /**
  * Validate the event dates.
  *
- * @param  string $event_start The event start date.
- * @param  string $event_end   The event end date.
- * @return bool                     Whether the event dates are valid.
+ * @param string $event_start The event start date.
+ * @param string $event_end The event end date.
+ * @return bool Whether the event dates are valid.
+ * @throws Exception When dates are invalid.
  */
-function validate_event_dates( $event_start, $event_end ) {
+function validate_event_dates( string $event_start, string $event_end ): bool {
 	if ( ! $event_start || ! $event_end ) {
 		return false;
 	}
@@ -135,25 +141,49 @@ function submit_event_ajax() {
 	$event_id         = null;
 	$response_message = '';
 	$form_actions     = array( 'draft', 'publish' );
-	if ( ! isset( $_POST['_event_nonce'] ) || ! wp_verify_nonce( $_POST['_event_nonce'], '_event_nonce' ) ) {
+
+	$is_nonce_valid = false;
+	$nonce_name     = '_event_nonce';
+	if ( isset( $_POST[ $nonce_name ] ) ) {
+		$nonce_value = sanitize_text_field( wp_unslash( $_POST[ $nonce_name ] ) );
+		if ( wp_verify_nonce( $nonce_value, $nonce_name ) ) {
+			$is_nonce_valid = true;
+		}
+	}
+	if ( ! $is_nonce_valid ) {
 		wp_send_json_error( 'Nonce verification failed' );
 	}
-	$title          = isset( $_POST['event_title'] ) ? sanitize_text_field( $_POST['event_title'] ) : '';
-	$description    = isset( $_POST['event_description'] ) ? sanitize_text_field( $_POST['event_description'] ) : '';
-	$event_start    = isset( $_POST['event_start'] ) ? sanitize_text_field( $_POST['event_start'] ) : '';
-	$event_end      = isset( $_POST['event_end'] ) ? sanitize_text_field( $_POST['event_end'] ) : '';
-	$event_timezone = isset( $_POST['event_timezone'] ) ? sanitize_text_field( $_POST['event_timezone'] ) : '';
 
-	$is_valid_event_date = validate_event_dates( $event_start, $event_end );
+	$title          = isset( $_POST['event_title'] ) ? sanitize_text_field( wp_unslash( $_POST['event_title'] ) ) : '';
+	$description    = isset( $_POST['event_description'] ) ? sanitize_text_field( wp_unslash( $_POST['event_description'] ) ) : '';
+	$event_start    = isset( $_POST['event_start'] ) ? sanitize_text_field( wp_unslash( $_POST['event_start'] ) ) : '';
+	$event_end      = isset( $_POST['event_end'] ) ? sanitize_text_field( wp_unslash( $_POST['event_end'] ) ) : '';
+	$event_timezone = isset( $_POST['event_timezone'] ) ? sanitize_text_field( wp_unslash( $_POST['event_timezone'] ) ) : '';
 
+	$is_valid_event_date = false;
+	try {
+		$is_valid_event_date = validate_event_dates( $event_start, $event_end );
+	} catch ( Exception $e ) { // phpcs:ignore Generic.CodeAnalysis.EmptyStatement.DetectedCatch
+		// Deliberately ignored, handled below.
+	}
 	if ( ! $is_valid_event_date ) {
 		wp_send_json_error( 'Invalid event dates' );
 	}
 
-	if ( isset( $_POST['event_form_action'] ) && in_array( $_POST['event_form_action'], $form_actions ) ) {
-		$event_status = sanitize_text_field( $_POST['event_form_action'] );
+	$event_status = '';
+	if ( isset( $_POST['event_form_action'] ) && in_array( $_POST['event_form_action'], $form_actions, true ) ) {
+		$event_status = sanitize_text_field( wp_unslash( $_POST['event_form_action'] ) );
+	}
+
+	if ( ! isset( $_POST['form_name'] ) ) {
+		wp_send_json_error( 'Form name must be set' );
+	}
+	$action = sanitize_text_field( wp_unslash( $_POST['form_name'] ) );
+	if ( ! in_array( $action, array( 'create_event', 'edit_event' ), true ) ) {
+		wp_send_json_error( 'Invalid form name' );
 	}
-	if ( 'create_event' === $_POST['form_name'] ) {
+
+	if ( 'create_event' === $action ) {
 		$event_id         = wp_insert_post(
 			array(
 				'post_type'    => 'event',
@@ -164,8 +194,11 @@ function submit_event_ajax() {
 		);
 		$response_message = 'Event created successfully!';
 	}
-	if ( 'edit_event' === $_POST['form_name'] ) {
-		$event_id = $_POST['event_id'];
+	if ( 'edit_event' === $action ) {
+		if ( ! isset( $_POST['event_id'] ) ) {
+			wp_send_json_error( 'Event id is required' );
+		}
+		$event_id = sanitize_text_field( wp_unslash( $_POST['event_id'] ) );
 		$event    = get_post( $event_id );
 		if ( ! $event || 'event' !== $event->post_type || ! ( current_user_can( 'edit_post', $event->ID ) || intval( $event->post_author ) === get_current_user_id() ) ) {
 			wp_send_json_error( 'Event does not exist' );
@@ -183,13 +216,19 @@ function submit_event_ajax() {
 	if ( ! $event_id ) {
 		wp_send_json_error( 'Event could not be created or updated' );
 	}
-	update_post_meta( $event_id, '_event_start', convert_to_UTC( $event_start, $event_timezone ) );
-	update_post_meta( $event_id, '_event_end', convert_to_UTC( $event_end, $event_timezone ) );
+	try {
+		update_post_meta( $event_id, '_event_start', convert_to_utc( $event_start, $event_timezone ) );
+		update_post_meta( $event_id, '_event_end', convert_to_utc( $event_end, $event_timezone ) );
+	} catch ( Exception $e ) {
+		wp_send_json_error( 'Invalid start or end' );
+	}
+
 	update_post_meta( $event_id, '_event_timezone', $event_timezone );
 
 	try {
 		WPORG_GP_Translation_Events_Active_Events_Cache::invalidate();
 	} catch ( Exception $e ) {
+		// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
 		error_log( $e );
 	}
 
@@ -213,12 +252,12 @@ function submit_event_ajax() {
 /**
  * Convert a date time in a time zone to UTC.
  *
- * @param  string $date_time The date time in the time zone.
- * @param  string $time_zone The time zone.
- *
- * @return string            The date time in UTC.
+ * @param string $date_time The date time in the time zone.
+ * @param string $time_zone The time zone.
+ * @return string The date time in UTC.
+ * @throws Exception When dates are invalid.
  */
-function convert_to_UTC( $date_time, $time_zone ) {
+function convert_to_utc( string $date_time, string $time_zone ): string {
 	$date_time = new DateTime( $date_time, new DateTimeZone( $time_zone ) );
 	$date_time->setTimezone( new DateTimeZone( 'UTC' ) );
 	return $date_time->format( 'Y-m-d H:i:s' );
@@ -247,26 +286,24 @@ function register_translation_event_js() {
 /**
  * Add the events link to the GlotPress main menu.
  *
- * @param array  $items    The menu items.
- * @param string $location The menu location.
- *
- * @return array           The modified menu items.
+ * @param array $items The menu items.
+ * @return array The modified menu items.
  */
-function gp_event_nav_menu_items( $items, $location ) {
-	$new[ esc_url( gp_url( '/events/' ) ) ] = esc_html__('Events', 'gp-translation-events' );
+function gp_event_nav_menu_items( array $items ): array {
+	$new[ esc_url( gp_url( '/events/' ) ) ] = esc_html__( 'Events', 'gp-translation-events' );
 	return array_merge( $items, $new );
 }
 // Add the events link to the GlotPress main menu.
-add_filter( 'gp_nav_menu_items', 'gp_event_nav_menu_items', 10, 2);
+add_filter( 'gp_nav_menu_items', 'gp_event_nav_menu_items' );
 
 add_action(
 	'gp_init',
-	function() {
+	function () {
 		require_once __DIR__ . '/includes/class-wporg-gp-translation-events-route.php';
-		GP::$router->add( '/events?', array( 'WPORG_GP_Translation_Events_Route', 'events_list' ), 'get' );
-		GP::$router->add( '/events/new', array( 'WPORG_GP_Translation_Events_Route', 'events_create' ), 'get' );
-		GP::$router->add( '/events/edit/(\d+)', array( 'WPORG_GP_Translation_Events_Route', 'events_edit' ), 'get' );
-		GP::$router->add( '/events/([a-z0-9_-]+)', array( 'WPORG_GP_Translation_Events_Route', 'events_details' ), 'get' );
+		GP::$router->add( '/events?', array( 'WPORG_GP_Translation_Events_Route', 'events_list' ) );
+		GP::$router->add( '/events/new', array( 'WPORG_GP_Translation_Events_Route', 'events_create' ) );
+		GP::$router->add( '/events/edit/(\d+)', array( 'WPORG_GP_Translation_Events_Route', 'events_edit' ) );
+		GP::$router->add( '/events/([a-z0-9_-]+)', array( 'WPORG_GP_Translation_Events_Route', 'events_details' ) );
 
 		require_once __DIR__ . '/includes/class-wporg-gp-translation-events-event.php';
 		require_once __DIR__ . '/includes/class-wporg-gp-translation-events-active-events-cache.php';