Skip to content

Fix PHPCS and PHPStan issues across multiple files#818

Open
aslamdoctor wants to merge 7 commits intoWordPress:masterfrom
aslamdoctor:437-php-wpcs-fixes
Open

Fix PHPCS and PHPStan issues across multiple files#818
aslamdoctor wants to merge 7 commits intoWordPress:masterfrom
aslamdoctor:437-php-wpcs-fixes

Conversation

@aslamdoctor
Copy link
Contributor

@aslamdoctor aslamdoctor commented Feb 26, 2026

Summary

  • Add PHPStan bootstrap file for runtime constants (TWO_FACTOR_DIR, TWO_FACTOR_VERSION) unreachable during static analysis
  • Add missing properties ($new, $last_used) to Registration class in includes/Yubico/U2F.php
  • Fix PHPDoc types for show_two_factor_login, process_provider, authentication_page, rename_link, delete_link, and pack64
  • Fix undefined variable bug in wp_ajax_inline_save where a non-matching key could be incorrectly updated
  • Add input validation, sanitization (sanitize_text_field), and wp_unslash for $_POST/$_REQUEST usage in class-two-factor-fido-u2f-admin.php
  • Remove redundant isset($user->ID) checks and always-true conditions
  • Cast base_convert() result to (int) for array offset usage in base32_encode()

Reference #437

Test plan

  • Run ./vendor/bin/phpstan analyse --memory-limit=1G --no-progress — should pass with 0 errors at level 0
  • Temporarily set PHPStan level to 3 in phpstan.dist.neon and run analysis — should pass with 0 errors
  • Temporarily set PHPStan level to 4 in phpstan.dist.neon and run analysis — should pass with 0 errors
  • Run ./vendor/bin/phpcs --standard=WordPress providers/class-two-factor-fido-u2f-admin.php — should pass with 0 errors/warnings
  • Verify TOTP authentication and setup still works
  • Verify email-based two-factor authentication still works

@github-actions
Copy link

github-actions bot commented Feb 26, 2026

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: aslamdoctor <aslamdoctor@git.wordpress.org>
Co-authored-by: masteradhoc <masteradhoc@git.wordpress.org>
Co-authored-by: georgestephanis <georgestephanis@git.wordpress.org>
Co-authored-by: kasparsd <kasparsd@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@masteradhoc
Copy link
Collaborator

@aslamdoctor U2F.php and fido-u2f-admin you can ignore, we'll remove them in PR #439 completely.

@masteradhoc masteradhoc requested review from georgestephanis, kasparsd and masteradhoc and removed request for kasparsd and masteradhoc February 28, 2026 21:43
- Add PHPStan bootstrap file for runtime constants (TWO_FACTOR_DIR, TWO_FACTOR_VERSION)
- Add missing properties ($new, $last_used) to Registration class
- Fix PHPDoc types for show_two_factor_login, process_provider, authentication_page,
  rename_link, delete_link, and pack64
- Fix undefined variable bug in wp_ajax_inline_save
- Add input validation, sanitization, and wp_unslash for $_POST/$_REQUEST usage
- Remove redundant isset($user->ID) checks and always-true conditions
- Cast base_convert() result to int for array offset usage
FIDO/U2F files will be removed entirely in PR WordPress#439, so changes
to U2F.php and class-two-factor-fido-u2f-admin.php are unnecessary.
@georgestephanis
Copy link
Collaborator

Whoops my stuff was outdated. That's what I get for being up and working early on a Sunday.

@masteradhoc
Copy link
Collaborator

Thanks for your reviews @georgestephanis. Always highly appreciated!! :)

@aslamdoctor
Copy link
Contributor Author

Can you mark them resolved? I didn't as I wanted to make sure all is ok.

Tests pass false as $user to authentication methods. Replace the
removed isset($user->ID) checks with explicit early return guards
to safely handle this case without accessing properties on false.
@masteradhoc masteradhoc added this to the 0.17.0 milestone Mar 2, 2026
Rename phpstan-bootstrap.php to constants.php and include it from
two-factor.php so TWO_FACTOR_DIR and TWO_FACTOR_VERSION are defined
in a single place.
constants.php Outdated
@@ -0,0 +1,17 @@
<?php
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

While having this in a standalone file helps with unifying the source of truth, having another file to update during the release cycle makes it more difficult (version strings are spread across two files) and we would need to update the release documentation to account for this change.

I feel like we should not change the plugin DX just because phpstan can't reach those constants. Is there a way to update the plugin bootstrap/entry file (remove the ABSPATH check) so that phpstan is able to read the constants? Maybe just move the ABSPATH guard to after the constants are defined?

Copy link
Contributor Author

@aslamdoctor aslamdoctor Mar 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point — having a separate file adds release friction without enough benefit.

Addressed in ac5d59a:

  • Moved TWO_FACTOR_DIR and TWO_FACTOR_VERSION definitions into two-factor.php before the ABSPATH guard, so PHPStan can discover them directly from the scanned file. Tested it aswell ✅
  • Removed constants.php entirely — version strings stay in one file.
  • Removed the bootstrapFiles entry from phpstan.dist.neon since PHPStan (1.7.0+) picks up constants from scanned sources.

}

$code = $this->sanitize_code_from_request( 'two-factor-email-code' );
if ( ! isset( $user->ID ) || ! $code ) {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question: Is phpstan complaining about the isset( $user->ID ) when the $user is false or not WP_User?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PHPStan at level 0 doesn't flag the isset( $user->ID ) pattern — it would only become an issue at higher levels (accessing a property on false). The early return guards were added as a code quality improvement to make the false handling explicit and keep the @param docblock accurate (WP_User|false). Happy to revert these changes if you'd prefer keeping the original isset() approach.

- Define TWO_FACTOR_DIR and TWO_FACTOR_VERSION in two-factor.php before
  the ABSPATH check so PHPStan can discover them from scanned files
- Remove constants.php to keep version strings in a single file
- Bump PHPStan analysis level from 0 to 4
- Exclude FIDO/U2F files from PHPStan analysis
- Add phpstan-ignore for Jetpack runtime compatibility check
@jeffpaul jeffpaul moved this from In progress to In review in Two Factor project board Mar 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: In review

Development

Successfully merging this pull request may close these issues.

4 participants