wordpress-turnstile

commit a19b1ee0ac414306a71b0e236be7431cd101cc09
parent 695e4eaf6e0d1f0473e7193e31f2dbdd66ae6df4
Author: Christian Grothoff <christian@grothoff.org>
Date:   Sat, 15 Nov 2025 14:30:44 +0100

add FIXMEs for each issue found by review

Diffstat:
M
admin/class-admin-settings.php
 | 
13
++++++++++++-
M
admin/class-price-category-admin.php
 | 
2
++
M
includes/class-content-filter.php
 | 
3
+++
M
includes/class-field-manager.php
 | 
1
+
M
includes/class-taler-merchant-api.php
 | 
2
++

5 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/admin/class-admin-settings.php b/admin/class-admin-settings.php
@@ -32,11 +32,13 @@ class Taler_Turnstile_Admin_Settings {
         ));
 
         register_setting('taler_turnstile_settings', 'taler_turnstile_grant_access_on_error', array(
-            'type' => 'boolean'
+            'type' => 'boolean',
+            'sanitize_callback' => array($this, 'sanitize_grant_access_option')
         ));
 
         register_setting('taler_turnstile_settings', 'taler_turnstile_subscription_prices', array(
             'type' => 'array',
+            'sanitize_callback' => array($this, 'sanitize_subscription_prices'),
             'default' => array()
         ));
 
@@ -263,6 +265,15 @@ class Taler_Turnstile_Admin_Settings {
         return sanitize_text_field($input);
     }
 
+    public function sanitize_grant_access_option($input) {
+      return isset($input);
+    }
+
+    public function sanitize_subscription_prices($input) {
+      // FIXME: implement!
+      return true;
+    }
+
     private function validate_http_status($http_status) {
         if ($http_status === 200 || $http_status === 204) {
             return;
diff --git a/admin/class-price-category-admin.php b/admin/class-price-category-admin.php
@@ -185,6 +185,7 @@ class Taler_Turnstile_Price_Category_Admin {
         $description = isset($_POST['description']) ? sanitize_textarea_field($_POST['description']) : '';
         // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
         // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
+        // FIXME: reviewers say sanitization is needed here!??
         $prices = isset($_POST['prices']) ? $_POST['prices'] : array();
 
         // Determine if this is an edit or new category
@@ -221,6 +222,7 @@ class Taler_Turnstile_Price_Category_Admin {
             'label' => $label,
             'description' => $description,
             'prices' => $filtered_prices,
+            // FIXME: expirations / sub_expirations not used!!?
             'expirations' => $sub_expirations
         );
 
diff --git a/includes/class-content-filter.php b/includes/class-content-filter.php
@@ -351,6 +351,9 @@ class Taler_Content_Filter {
             session_start();
         }
 
+        // FIXME: reviewers say sanitization/validation is needed here
+        // FIXME: reviewers claim this data can be
+        // **manipulated** by the sender of the request!??!??
         return $_SESSION['taler_turnstile_node_orders'][$post_id] ?? NULL;
     }
 
diff --git a/includes/class-field-manager.php b/includes/class-field-manager.php
@@ -101,6 +101,7 @@ class Taler_Field_Manager {
         // Check nonce
         // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
         // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash
+        // FIXME: reviewers say sanitization is needed here for wp_verify_nonce()
         if (!isset($_POST['taler_price_category_nonce']) ||
             !wp_verify_nonce($_POST['taler_price_category_nonce'], 'taler_price_category_meta')) {
             return;
diff --git a/includes/class-taler-merchant-api.php b/includes/class-taler-merchant-api.php
@@ -616,6 +616,8 @@ class Taler_Merchant_API {
 
         // Detect and use TranslatePress
         if (class_exists('TRP_Translate_Press')) {
+            // Note to reviewers: this is NOT a symbol of ours, but
+            // one from "TRP_Translate_Press" which we are *importing* here.
             global $TRP_LANGUAGE;
 
             $trp = TRP_Translate_Press::get_trp_instance();