Update to newer WordPress code standard ruleset

Author: Antti Kuosmanen

classes/class-cpt-wplf-form.php

@@ -401,7 +401,7 @@ function save_cpt( $post_id ) {
     // verify nonce
     if ( ! isset( $_POST['wplf_form_meta_nonce'] ) ) {
       return;
-    } else if ( ! wp_verify_nonce( $_POST['wplf_form_meta_nonce'], 'wplf_form_meta' ) ) {
+    } elseif ( ! wp_verify_nonce( $_POST['wplf_form_meta_nonce'], 'wplf_form_meta' ) ) {
       return;
     }
 
@@ -502,7 +502,7 @@ function wplf_form( $id, $content = '', $xclass = '' ) {
       ob_start();
 ?>
 <form
-  class="libre-form libre-form-<?php esc_attr_e( $id . ' ' . $xclass ); ?>"
+  class="libre-form libre-form-<?php echo esc_attr( $id . ' ' . $xclass ); ?>"
   <?php
     // check if form contains file inputs
     if ( strpos( $content, "type='file'" ) >= 0 || strpos( $content, 'type="file"' ) >= 0 ) {
@@ -531,8 +531,8 @@ class="libre-form libre-form-<?php esc_attr_e( $id . ' ' . $xclass ); ?>"
     // @codingStandardsIgnoreEnd
   ?>
   <input type="hidden" name="referrer" value="<?php the_permalink(); ?>">
-  <input type="hidden" name="_referrer_id" value="<?php esc_attr_e( get_the_id() ) ?>">
-  <input type="hidden" name="_form_id" value="<?php esc_attr_e( $id ); ?>">
+  <input type="hidden" name="_referrer_id" value="<?php echo esc_attr( get_the_id() ) ?>">
+  <input type="hidden" name="_form_id" value="<?php echo esc_attr( $id ); ?>">
 </form>
 <?php
       $output = ob_get_clean();

classes/class-cpt-wplf-submission.php

@@ -87,7 +87,7 @@ function custom_columns_display_cpt( $column, $post_id ) {
     if ( 'form' === $column ) {
       if ( $form_id = get_post_meta( $post_id, '_form_id', true ) ) {
         $form = get_post( $form_id );
-        echo '<a href="' . esc_url_raw( get_edit_post_link( $form_id, '' ) ). '" target="_blank">';
+        echo '<a href="' . esc_url_raw( get_edit_post_link( $form_id, '' ) ) . '" target="_blank">';
         echo esc_html( $form->post_title );
         echo '</a>';
       }
@@ -197,14 +197,16 @@ function wplf_submission_bulk_action_admin_notice() {
       $count = intval( $_REQUEST['wplf_resent'] );
       printf(
         '<div id="wplf-submission-bulk-resend-message" class="notice notice-success"><p>' .
-         esc_html__(
-           _n( 'Resent email copy of %s submission.',
-               'Resent email copy of %s submissions.',
-               $count ),
-           'wp-libre-form'
-        ) . '</p></div>',
-        intval( $count )
-      );
+          esc_html(
+             // translators: %s is number of submissions
+             _n( 'Resent email copy of %s submission.',
+                 'Resent email copy of %s submissions.',
+                 $count,
+             'wp-libre-form'
+             )
+          ) .
+          '</p></div>',
+        intval( $count ) );
     }
   }
 
@@ -242,7 +244,7 @@ function metabox_submission() {
     </thead>
     <tbody>
       <?php foreach ( $fields as $field ) : ?>
-        <?php if ( '_' !== $field[0]  ) : ?>
+        <?php if ( '_' !== $field[0] ) : ?>
         <?php
         $value = $postmeta[ $field ][0];
 
@@ -272,7 +274,7 @@ function metabox_submission() {
           <?php if ( strlen( $value ) > 60 || strpos( $value, "\n" ) ) : ?>
           <td><textarea style="width:100%" readonly><?php echo esc_textarea( $value ); ?></textarea></td>
           <?php else : ?>
-          <td><input style="width:100%" type="text" value="<?php esc_attr_e( $value ); ?>" readonly></td>
+          <td><input style="width:100%" type="text" value="<?php echo esc_attr( $value ); ?>" readonly></td>
           <?php endif; ?>
         </tr>
         <?php endif; ?>

inc/wplf-ajax.php

@@ -55,7 +55,9 @@ function wplf_ajax_submit_handler() {
     foreach ( $_FILES as $key => $file ) {
       // Is this enough security wise?
       // Currenly only supports 1 file per input
-      $attach_id = media_handle_upload( $key, 0, array(), array( 'test_form' => false ) );
+      $attach_id = media_handle_upload( $key, 0, array(), array(
+        'test_form' => false,
+      ) );
       add_post_meta( $post_id, $key, wp_get_attachment_url( $attach_id ) );
       add_post_meta( $post_id, $key . '_attachment', $attach_id );
     }

inc/wplf-form-actions.php

@@ -21,17 +21,20 @@ function wplf_send_email_copy( $return, $submission_id = null ) {
     || isset( $submission_id ) ) {
 
     $to = $form_meta['_wplf_email_copy_to'][0];
+    // translators: %s is email address of form submitter
     $subject = wp_sprintf( __( 'New submission from %s', 'wp-libre-form' ), $referrer );
 
     if ( isset( $submission_id ) ) {
       $to = get_post_meta( $submission_id, '_wplf_email_copy_to', true );
+      // translators: %s is email address of form submitter
       $subject = wp_sprintf( __( 'Submission from %s', 'wp-libre-form' ), $referrer );
     }
 
     $to = empty( $to ) ? get_option( 'admin_email' ) : $to;
     $content = wp_sprintf(
-      __( 'Form "%s" (ID %d) was submitted with values below: ', 'wp-libre-form' ), $form_title, $form_id );
-    $content = apply_filters( 'wplf_email_copy_content_start', $content, $form_title, $form_id ). "\n\n";
+      // translators: %1$s is form title, %2$d is form ID
+      __( 'Form "%1$s" (ID %2$d) was submitted with values below: ', 'wp-libre-form' ), $form_title, $form_id );
+    $content = apply_filters( 'wplf_email_copy_content_start', $content, $form_title, $form_id ) . "\n\n";
 
     $fields = $_POST;
     if ( isset( $submission_id ) ) {

inc/wplf-form-validation.php

@@ -16,6 +16,7 @@ function wplf_validate_form_exists( $return ) {
     || 'wplf-form' !== get_post_type( $_POST['_form_id'] )
   ) {
     $return->ok = 0;
+    // translators: %d is form ID
     $return->error = sprintf( __( "Form id %d doesn't exist!", 'wp-libre-form' ), intval( $_POST['_form_id'] ) );
   }
   return $return;

phpcs.xml

@@ -108,5 +108,15 @@
 
     <!-- We don't use nonce verification in this plugin -->
     <exclude name="WordPress.CSRF.NonceVerification.NoNonceVerification" />
+
+    <!-- We like assignments in if -->
+    <exclude name="Squiz.PHP.DisallowMultipleAssignments.Found" />
+
+    <!-- Our hooks use dashes, not underscores -->
+    <exclude name="WordPress.NamingConventions.ValidHookName.UseUnderscores" />
+
+    <!-- This would be nice to enforce, but plugin main file shouldn't be called class-something -->
+    <exclude name="WordPress.Files.FileName.InvalidClassFileName" />
+
   </rule>
 </ruleset>