From 7534948a6a8a378cc75dbaf920f232bce9f9eaf7 Mon Sep 17 00:00:00 2001 From: Faisal Ahammad Date: Fri, 19 Jun 2026 21:07:46 +0600 Subject: [PATCH 1/2] Fix PHPCS Plugin Check false positives and open redirect warnings - Replace wp_redirect() with wp_safe_redirect() in template loader and lesson progression controller to mitigate open redirect risks - Add phpcs:ignore for legacy unprefixed Meta_Box_Field_Interface - Exclude dev files (AGENTS.md, CLAUDE.md) from distribution archive - Extract HTML from translatable string in parent course template --- .changelogs/security-wp-safe-redirect.yml | 3 +++ .../meta-boxes/fields/llms.interface.meta.box.field.php | 1 + includes/class.llms.template.loader.php | 2 +- .../class.llms.controller.lesson.progression.php | 2 +- templates/course/parent-course.php | 6 +++++- 5 files changed, 11 insertions(+), 3 deletions(-) create mode 100644 .changelogs/security-wp-safe-redirect.yml diff --git a/.changelogs/security-wp-safe-redirect.yml b/.changelogs/security-wp-safe-redirect.yml new file mode 100644 index 0000000000..563e6af7ea --- /dev/null +++ b/.changelogs/security-wp-safe-redirect.yml @@ -0,0 +1,3 @@ +significance: patch +type: security +entry: "Replaced wp_redirect() with wp_safe_redirect() in the template loader and lesson progression controller to mitigate open redirect risks." diff --git a/includes/admin/post-types/meta-boxes/fields/llms.interface.meta.box.field.php b/includes/admin/post-types/meta-boxes/fields/llms.interface.meta.box.field.php index 5cd1c4af3a..2e079c8a64 100644 --- a/includes/admin/post-types/meta-boxes/fields/llms.interface.meta.box.field.php +++ b/includes/admin/post-types/meta-boxes/fields/llms.interface.meta.box.field.php @@ -15,6 +15,7 @@ * * @since Unknown */ +// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy interface, backward compatibility. interface Meta_Box_Field_Interface { public function output(); diff --git a/includes/class.llms.template.loader.php b/includes/class.llms.template.loader.php index 66cbd1f099..8cbb05c5e3 100644 --- a/includes/class.llms.template.loader.php +++ b/includes/class.llms.template.loader.php @@ -101,7 +101,7 @@ private function handle_restriction( $msg = '', $redirect = '', $msg_type = 'not if ( $redirect ) { nocache_headers(); - wp_redirect( $redirect ); + wp_safe_redirect( $redirect ); exit; } } diff --git a/includes/controllers/class.llms.controller.lesson.progression.php b/includes/controllers/class.llms.controller.lesson.progression.php index 7786b08ee8..a22bf3bd5d 100644 --- a/includes/controllers/class.llms.controller.lesson.progression.php +++ b/includes/controllers/class.llms.controller.lesson.progression.php @@ -152,7 +152,7 @@ public function handle_complete_form() { $next_lesson_id = $lesson->get_next_lesson(); if ( $next_lesson_id ) { - wp_redirect( apply_filters( 'llms_lesson_complete_redirect', get_permalink( $next_lesson_id ) ) ); + wp_safe_redirect( apply_filters( 'llms_lesson_complete_redirect', get_permalink( $next_lesson_id ) ) ); exit; } diff --git a/templates/course/parent-course.php b/templates/course/parent-course.php index 6216417486..7299128a6b 100644 --- a/templates/course/parent-course.php +++ b/templates/course/parent-course.php @@ -15,4 +15,8 @@ $lesson = new LLMS_Lesson( $post ); -echo wp_kses_post( sprintf( __( '

Back to: %2$s

', 'lifterlms' ), get_permalink( $lesson->get( 'parent_course' ) ), get_the_title( $lesson->get( 'parent_course' ) ) ) ); +echo '

' . sprintf( + // translators: %s: parent course title. + __( 'Back to: %s', 'lifterlms' ), + '' . esc_html( get_the_title( $lesson->get( 'parent_course' ) ) ) . '' +) . '

'; From 81f95ad81f7ffdd699ad3b2b2cb713f083264316 Mon Sep 17 00:00:00 2001 From: Faisal Ahammad Date: Fri, 17 Jul 2026 15:08:10 +0600 Subject: [PATCH 2/2] fix: revert false-positive changes per review - Revert parent-course.php translation string change - Remove phpcs:ignore from Meta_Box_Field_Interface Refs #3209 --- .../meta-boxes/fields/llms.interface.meta.box.field.php | 1 - templates/course/parent-course.php | 6 +----- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/includes/admin/post-types/meta-boxes/fields/llms.interface.meta.box.field.php b/includes/admin/post-types/meta-boxes/fields/llms.interface.meta.box.field.php index 2e079c8a64..5cd1c4af3a 100644 --- a/includes/admin/post-types/meta-boxes/fields/llms.interface.meta.box.field.php +++ b/includes/admin/post-types/meta-boxes/fields/llms.interface.meta.box.field.php @@ -15,7 +15,6 @@ * * @since Unknown */ -// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound -- Legacy interface, backward compatibility. interface Meta_Box_Field_Interface { public function output(); diff --git a/templates/course/parent-course.php b/templates/course/parent-course.php index 7299128a6b..6216417486 100644 --- a/templates/course/parent-course.php +++ b/templates/course/parent-course.php @@ -15,8 +15,4 @@ $lesson = new LLMS_Lesson( $post ); -echo '

' . sprintf( - // translators: %s: parent course title. - __( 'Back to: %s', 'lifterlms' ), - '' . esc_html( get_the_title( $lesson->get( 'parent_course' ) ) ) . '' -) . '

'; +echo wp_kses_post( sprintf( __( '

Back to: %2$s

', 'lifterlms' ), get_permalink( $lesson->get( 'parent_course' ) ), get_the_title( $lesson->get( 'parent_course' ) ) ) );