PCP Plugin Check

phpcs.xml

@@ -2,8 +2,24 @@
 <ruleset>
   <config name="testVersion" value="5.6-"/>
 
-  <rule ref="WordPress-Core">
-     <exclude name="Universal.Operators.StrictComparisons" />
+  <rule ref="WordPress">
+    <exclude name="Universal.Operators.StrictComparisons" />
+
+    <!-- Resolve commenting related violations -->
+    <exclude name="Squiz.Commenting" />
+    <exclude name="Generic.Commenting" />
+    <exclude name="Squiz.PHP.CommentedOutCode.Found" />
+
+    <!-- Fix security issues -->
+    <exclude name="WordPress.Security.EscapeOutput" />
+    <exclude name="WordPress.Security.ValidatedSanitizedInput" />
+    <exclude name="WordPress.Security.NonceVerification" />
+
+    <!-- Fix AlternativeFunctons-->
+    <exclude name="WordPress.WP.AlternativeFunctions" />
+    <exclude name="WordPress.WP.GlobalVariablesOverride.Prohibited" />
+    <exclude name="WordPress.DB.DirectDatabaseQuery.DirectQuery" />
+    <exclude name="WordPress.DB.DirectDatabaseQuery.NoCaching" />
   </rule>
   <rule ref="Generic.Files.LineLength">
     <properties>

src/class-tiny-apache-rewrite.php

@@ -31,6 +31,7 @@ class Tiny_Apache_Rewrite extends Tiny_WP_Base {
 
 	/**
 	 * seperator when rules are inserted
+	 *
 	 * @var string
 	 */
 	const MARKER = 'tiny-compress-images';
@@ -40,9 +41,8 @@ class Tiny_Apache_Rewrite extends Tiny_WP_Base {
 	 * hooked into `update_option_tinypng_convert_format`
 	 * https://developer.wordpress.org/reference/hooks/update_option_option/
 	 *
-	 *
-	 * @param mixed $old_value
-	 * @param mixed $value
+	 * @param mixed  $old_value
+	 * @param mixed  $value
 	 * @param string $option
 	 * @return void
 	 */

src/class-tiny-bulk-optimization.php

@@ -42,7 +42,8 @@ public static function get_optimization_statistics( $settings, $result = null )
 				if ( isset( $last_image['ID'] ) ) {
 					$last_image_id = $last_image['ID'];
 				}
-			} while ( sizeof( $result ) == self::PAGING_SIZE );
+				$result_count = count( $result );
+			} while ( self::PAGING_SIZE == $result_count );
 		} else {
 			$stats = self::populate_optimization_statistics( $settings, $result, $stats );
 		}
@@ -104,10 +105,11 @@ private static function populate_optimization_statistics( $settings, $result, $s
 		$active_tinify_sizes = $settings->get_active_tinify_sizes();
 		$conversion_enabled  = $settings->get_conversion_enabled();
 
-		for ( $i = 0; $i < sizeof( $result ); $i++ ) {
-			$wp_metadata   = unserialize( (string) $result[ $i ]['meta_value'] );
+		$result_count = count( $result );
+		for ( $i = 0; $i < $result_count; $i++ ) {
+			$wp_metadata   = maybe_unserialize( (string) $result[ $i ]['meta_value'] );
 			$tiny_metadata = isset( $result[ $i ]['tiny_meta_value'] ) ?
-				unserialize( (string) $result[ $i ]['tiny_meta_value'] ) :
+				maybe_unserialize( (string) $result[ $i ]['tiny_meta_value'] ) :
 				array();
 			if ( ! is_array( $tiny_metadata ) ) {
 				$tiny_metadata = array();

src/class-tiny-cli.php

@@ -52,7 +52,6 @@ public static function register_command( $settings ) {
 	 *      optimize all unprocessed images
 	 *      wp tiny optimize
 	 *
-	 *
 	 * @param array $args
 	 * @param array $assoc_args
 	 * @return void

src/class-tiny-compress-client.php

@@ -192,7 +192,8 @@ public function create_key( $email, $options ) {
 	}
 
 	private function set_request_options( $client ) {
-		/* The client does not let us override cURL properties yet, so we have
+		/*
+		The client does not let us override cURL properties yet, so we have
 			to use a reflection property. */
 		$property = new ReflectionProperty( $client, 'options' );
 		$property->setAccessible( true );

src/class-tiny-compress-fopen.php

@@ -266,7 +266,7 @@ private function request_options( $method, $body = null, $headers = array() ) {
 				'header'          => array_merge(
 					$headers,
 					array(
-						'Authorization: Basic ' . base64_encode( 'api:' . $this->api_key ),
+						'Authorization: Basic ' . base64_encode( 'api:' . $this->api_key ), // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode -- Base64 encoding is required.
 						'User-Agent: ' . self::identifier(),
 						'Content-Type: multipart/form-data',
 					)

src/class-tiny-compress.php

@@ -96,9 +96,9 @@ public function get_status() {
 	/**
 	 * Compresses a single file
 	 *
-	 * @param [type] $file
-	 * @param array $resize_opts
-	 * @param array $preserve_opts
+	 * @param [type]                             $file
+	 * @param array                              $resize_opts
+	 * @param array                              $preserve_opts
 	 * @param array{ string } conversion options
 	 * @return void
 	 */

src/class-tiny-helpers.php

@@ -29,7 +29,7 @@ class Tiny_Helpers {
 	 * We can use mb_strlen & mb_substr as WordPress provides a compat function for
 	 * it if mbstring php module is not installed.
 	 *
-	 * @param string $text the text
+	 * @param string  $text the text
 	 * @param integer $length the maximum length of the string
 	 * @return string the truncated string
 	 */
@@ -173,17 +173,17 @@ public static function get_wp_filesystem() {
 	}
 
 	/**
-	* Polyfill for `str_starts_with()` function added in PHP 8.0.
-	*
-	* Performs a case-sensitive check indicating if
-	* the haystack begins with needle.
-	*
-	* @since 5.9.0
-	*
-	* @param string $haystack The string to search in.
-	* @param string $needle   The substring to search for in the `$haystack`.
-	* @return bool True if `$haystack` starts with `$needle`, otherwise false.
-	*/
+	 * Polyfill for `str_starts_with()` function added in PHP 8.0.
+	 *
+	 * Performs a case-sensitive check indicating if
+	 * the haystack begins with needle.
+	 *
+	 * @since 5.9.0
+	 *
+	 * @param string $haystack The string to search in.
+	 * @param string $needle   The substring to search for in the `$haystack`.
+	 * @return bool True if `$haystack` starts with `$needle`, otherwise false.
+	 */
 	public static function str_starts_with( $haystack, $needle ) {
 		if ( function_exists( 'str_starts_with' ) ) {
 			return str_starts_with( $haystack, $needle );

src/class-tiny-image-size.php

@@ -23,11 +23,11 @@ class Tiny_Image_Size {
 	public $meta = array();
 
 	/* Used more than once and not trivial, so we are memoizing these */
-	private $_exists;
-	private $_file_size;
-	private $_mime_type;
-	private $_duplicate         = false;
-	private $_duplicate_of_size = '';
+	private $exists;
+	private $file_size;
+	private $mime_type;
+	private $duplicate         = false;
+	private $duplicate_of_size = '';
 
 	public function __construct( $filename = null ) {
 		$this->filename = $filename;
@@ -119,33 +119,33 @@ public function never_compressed() {
 	}
 
 	public function filesize() {
-		if ( is_null( $this->_file_size ) ) {
+		if ( is_null( $this->file_size ) ) {
 			if ( $this->exists() ) {
-				$this->_file_size = filesize( $this->filename );
+				$this->file_size = filesize( $this->filename );
 			} else {
-				$this->_file_size = 0;
+				$this->file_size = 0;
 			}
 		}
-		return $this->_file_size;
+		return $this->file_size;
 	}
 
 	public function mimetype() {
-		if ( is_null( $this->_mime_type ) ) {
+		if ( is_null( $this->mime_type ) ) {
 			if ( $this->exists() ) {
-				$file             = file_get_contents( $this->filename );
-				$this->_mime_type = Tiny_Helpers::get_mimetype( $file );
+				$file            = file_get_contents( $this->filename );
+				$this->mime_type = Tiny_Helpers::get_mimetype( $file );
 			} else {
-				$this->_mime_type = 'application/octet-stream';
+				$this->mime_type = 'application/octet-stream';
 			}
 		}
-		return $this->_mime_type;
+		return $this->mime_type;
 	}
 
 	public function exists() {
-		if ( is_null( $this->_exists ) ) {
-			$this->_exists = $this->filename && file_exists( $this->filename );
+		if ( is_null( $this->exists ) ) {
+			$this->exists = $this->filename && file_exists( $this->filename );
 		}
-		return $this->_exists;
+		return $this->exists;
 	}
 
 	private function same_size() {
@@ -228,16 +228,16 @@ public function resized() {
 	}
 
 	public function mark_duplicate( $duplicate_size_name ) {
-		$this->_duplicate         = true;
-		$this->_duplicate_of_size = $duplicate_size_name;
+		$this->duplicate         = true;
+		$this->duplicate_of_size = $duplicate_size_name;
 	}
 
 	public function is_duplicate() {
-		return $this->_duplicate;
+		return $this->duplicate;
 	}
 
 	public function duplicate_of_size() {
-		return $this->_duplicate_of_size;
+		return $this->duplicate_of_size;
 	}
 
 	/**

src/class-tiny-image.php

@@ -51,7 +51,8 @@ private function parse_wp_metadata() {
 		}
 
 		if ( ! is_array( $this->wp_metadata ) || ! isset( $this->wp_metadata['file'] ) ) {
-			/* No file metadata found, this might be another plugin messing with
+			/*
+			No file metadata found, this might be another plugin messing with
 				metadata. Simply ignore this! */
 			return;
 		}
@@ -63,7 +64,8 @@ private function parse_wp_metadata() {
 			$path_prefix .= $path_info['dirname'] . '/';
 		}
 
-		/* Do not use pathinfo for getting the filename.
+		/*
+		Do not use pathinfo for getting the filename.
 			It doesn't work when the filename starts with a special character. */
 		$path_parts                    = explode( '/', $this->wp_metadata['file'] );
 		$this->name                    = end( $path_parts );
@@ -471,7 +473,7 @@ public function get_savings( $stats ) {
 
 	public function get_statistics( $active_sizes, $active_tinify_sizes ) {
 		if ( $this->statistics ) {
-			error_log( 'Strangely the image statistics are asked for again.' );
+			Tiny_Logger::error( 'Strangely the image statistics are asked for again.' );
 			return $this->statistics;
 		}
 

src/class-tiny-logger.php

@@ -22,7 +22,6 @@
 /**
  * Handles logging of plugin events to file.
  *
- *
  * @since 3.7.0
  */
 class Tiny_Logger {
@@ -73,7 +72,7 @@ public static function init() {
 			'pre_update_option_tinypng_logging_enabled',
 			'Tiny_Logger::on_save_log_enabled',
 			10,
-			3
+			2
 		);
 	}
 
@@ -114,7 +113,7 @@ public function get_log_file_path() {
 	 *
 	 * @return bool true if enabled
 	 */
-	public static function on_save_log_enabled( $log_enabled, $old, $option ) {
+	public static function on_save_log_enabled( $log_enabled, $old ) {
 		$instance              = self::get_instance();
 		$was_enabled           = 'on' === $old;
 		$is_now_enabled        = 'on' === $log_enabled;
@@ -190,6 +189,7 @@ private function log( $level, $message, $context = array() ) {
 		$context_str = ! empty( $context ) ? ' ' . wp_json_encode( $context ) : '';
 		$log_entry   = "[{$timestamp}] [{$level_str}] {$message}{$context_str}" . PHP_EOL;
 
+		// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
 		error_log( $log_entry, 3, $this->log_file_path );
 	}
 

src/class-tiny-php.php

@@ -37,8 +37,8 @@ public static function curl_exec_disabled() {
 	}
 
 	public static function client_supported() {
-		return Tiny_PHP::has_fully_supported_php() &&
-						Tiny_PHP::curl_available() &&
-						! Tiny_PHP::curl_exec_disabled();
+		return self::has_fully_supported_php() &&
+						self::curl_available() &&
+						! self::curl_exec_disabled();
 	}
 }

src/class-tiny-picture.php

@@ -109,7 +109,7 @@ private function replace_picture_sources( $content ) {
 	private function replace_img_sources( $content ) {
 		$image_sources = $this->filter_images( $content );
 		foreach ( $image_sources as $image_source ) {
-			$content = Tiny_Picture::replace_image( $content, $image_source );
+			$content = self::replace_image( $content, $image_source );
 		}
 		return $content;
 	}
@@ -145,7 +145,7 @@ private function filter_pictures( $content ) {
 	/**
 	 * Will add additional sourcesets to picture elements.
 	 *
-	 * @param string $content the full page content
+	 * @param string              $content the full page content
 	 * @param Tiny_Source_Picture $source the picture element
 	 *
 	 * @return string the updated content including augmented picture elements
@@ -159,7 +159,7 @@ private function replace_picture( $content, $source ) {
 	/**
 	 * Will replace img elements with picture elements that (possibly) have additional formats.
 	 *
-	 * @param string $content the full page content
+	 * @param string            $content the full page content
 	 * @param Tiny_Source_Image $source the picture element
 	 *
 	 * @return string the updated content including augmented picture elements

src/class-tiny-plugin.php

@@ -32,7 +32,8 @@ public static function jpeg_quality() {
 	}
 
 	public static function version() {
-		/* Avoid using get_plugin_data() because it is not loaded early enough
+		/*
+		Avoid using get_plugin_data() because it is not loaded early enough
 			in xmlrpc.php. */
 		return self::VERSION;
 	}
@@ -111,7 +112,8 @@ public function ajax_init() {
 			$this->get_method( 'mark_image_as_compressed' )
 		);
 
-		/* When touching any functionality linked to image compressions when
+		/*
+		When touching any functionality linked to image compressions when
 			uploading images make sure it also works with XML-RPC. See README. */
 		add_filter(
 			'wp_ajax_nopriv_tiny_rpc',
@@ -697,7 +699,7 @@ public function media_library_bulk_action() {
 			$location = add_query_arg( 'm', $_REQUEST['m'], $location );
 		}
 
-		wp_redirect( admin_url( $location ) );
+		wp_safe_redirect( admin_url( $location ) );
 		exit();
 	}
 
@@ -788,7 +790,8 @@ public function add_dashboard_widget() {
 			true
 		);
 
-		/* This might be deduplicated with the admin script localization, but
+		/*
+		This might be deduplicated with the admin script localization, but
 			the order of including scripts is sometimes different. So in that
 			case we need to make sure that the order of inclusion is correc.t */
 		wp_localize_script(
@@ -850,6 +853,7 @@ public function friendly_user_name() {
 	 * Will clean up converted files (if any) when the original is deleted
 	 *
 	 * Hooked to the `delete_attachment` action.
+	 *
 	 * @see https://developer.wordpress.org/reference/hooks/deleted_post/
 	 *
 	 * @param [int] $post_id