fix: resolve PHPCS Plugin Check false positives and wp_redirect security warnings - #3209
Conversation
- Replace wp_redirect() with wp_safe_redirect() in template loader and lesson progression controller to mitigate open redirect risks - Add phpcs:ignore for legacy unprefixed Meta_Box_Field_Interface - Exclude dev files (AGENTS.md, CLAUDE.md) from distribution archive - Extract HTML from translatable string in parent course template
|
@faisalahammad The "fixes" number is pointing to a pull request. Not sure if there's an issue this is fixing or if that should be removed from the description? |
|
Removed the |
|
@faisalahammad I see the description change but could you confirm the changes have been pushed? I'm still seeing the change to includes/admin/post-types/meta-boxes/fields/llms.interface.meta.box.field.php and templates/course/parent-course.php in the diff https://github.com/gocodebox/lifterlms/pull/3209/changes. Thanks! |
- Revert parent-course.php translation string change - Remove phpcs:ignore from Meta_Box_Field_Interface Refs gocodebox#3209
|
@brianhogg I had to step away from my desk halfway through because of Jumma prayer, so the changes weren’t fully pushed yet. When you get a chance, could you please take another look and re-review it? Really appreciate your help! Thanks a lot. |
Summary
Replace
wp_redirect()withwp_safe_redirect()in the template loader and lesson progression controller to mitigate open redirect risks flagged by the WordPress Plugin Check tool.Changes
includes/class.llms.template.loader.php
Before:
wp_redirect()used for content restriction redirects.After:
wp_safe_redirect().Why: Restricts redirect destinations to local URLs, prevents open redirect.
includes/controllers/class.llms.controller.lesson.progression.php
Before:
wp_redirect()used for lesson auto-advance after completion.After:
wp_safe_redirect().Why: Same open redirect mitigation.
Testing
Test: Lesson auto-advance
Result: Works as expected
Test: Content restriction redirect