PHPCS: Allowlist custom capabilities instead of disabling the sniff#580
PHPCS: Allowlist custom capabilities instead of disabling the sniff#580
Conversation
Replace the blanket severity override for WordPress.WP.Capabilities.Unknown with an explicit allowlist of all custom capabilities used across the codebase. This also fixes two capability bugs surfaced by enabling the sniff: - Plugin Directory ES Status tool used the role name `plugin_admin` instead of a capability. Replace with `plugin_approve`, which is the distinguishing capability for the plugin admin role. - Plugin Directory comment row actions checked `manage_comments`, which is not a WordPress capability. Replace with `moderate_comments`. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
There was a problem hiding this comment.
Pull request overview
This PR tightens PHPCS capability checking by replacing a blanket disable of the “unknown capability” sniff with an explicit allowlist of custom capabilities used in the WordPress.org environment, and fixes a couple of incorrect capability checks in the Plugin Directory admin UI.
Changes:
- Replace the
WordPress.WP.Capabilities.Unknownseverity override with an explicitcustom_capabilitiesallowlist inphpcs.xml.dist. - Fix Plugin Directory ES Status tool permissions by replacing the role name
plugin_adminwith the capabilityplugin_approve. - Fix internal-note comment row action gating by replacing the non-existent
manage_commentscapability withmoderate_comments.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/tools/class-elasticsearch-status.php |
Updates menu and AJAX permission checks to use a real capability (plugin_approve). |
wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/class-customizations.php |
Fixes internal-note row action permissions by using moderate_comments. |
phpcs.xml.dist |
Introduces an explicit allowlist for custom capabilities under the WPCS capabilities sniffs. |
Comments suppressed due to low confidence (1)
wordpress.org/public_html/wp-content/plugins/plugin-directory/admin/class-customizations.php:826
- The docblock above this logic says internal-note actions are limited to replying for plugin reviewers and that plugin admins can additionally trash/untrash/quickedit. However, the gate here is
current_user_can( 'moderate_comments' ), and the plugin-directoryplugin_reviewerrole is grantedmoderate_comments(seeclass-capabilities.php), so reviewers will also see trash/untrash/quickedit. Please update the docblock to match the actual permission model (or change the capability check to the intended one).
*
* Actions for internal notes can be limited to replying for plugin reviewers.
* Plugin Admins can additionally trash, untrash, and quickedit a note.
*
* @param array $actions An array of comment actions. Default actions include:
* 'Approve', 'Unapprove', 'Edit', 'Reply', 'Spam',
* 'Delete', and 'Trash'.
* @param \WP_Comment $comment The comment object.
* @return array Array of comment actions.
*/
public function custom_comment_row_actions( $actions, $comment ) {
if ( 'internal-note' === $comment->comment_type && isset( $_REQUEST['mode'] ) && 'single' === $_REQUEST['mode'] ) {
$allowed_actions = array( 'reply' => true );
if ( current_user_can( 'moderate_comments' ) ) {
$allowed_actions['trash'] = true;
$allowed_actions['untrash'] = true;
$allowed_actions['quickedit'] = true;
}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Add singular theme caps (suspend_theme, reinstate_theme) and bbPress caps (bbp_forums_admin, edit_topic, edit_reply, read_topic) to the allowlist. - Photo Directory used the role name photos_moderator instead of a capability. Replace with edit_photos. - BuddyPress checked four role names instead of capabilities in the admin redirect. Replace with a single edit_posts check, which all contributors and above have. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
wordpress.org/public_html/wp-content/plugins/photo-directory/inc/moderation.php
Outdated
Show resolved
Hide resolved
|
@dd32 Wanted to give you a chance to veto. It's a long allowlist, but it enables catching misuses like the other changes in this PR. |
…p filter. Calling user_can() for edit_photos inside a user_has_cap filter that handles edit_photos would cause infinite recursion. Check the allcaps array directly instead. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
… and capability fixes Agent-Logs-Url: https://github.com/obenland/wordpress.org/sessions/96f2f701-fe73-444a-829b-7bb3a541fbea Co-authored-by: obenland <1398304+obenland@users.noreply.github.com>
Summary
<severity>0</severity>override onWordPress.WP.Capabilities.Unknownwith an explicit allowlist of all custom capabilities used across the codebase, grouped by plugin.plugin_admininstead of a capability — replaced withplugin_approve.manage_comments, which is not a WordPress capability — replaced withmoderate_comments.photos_moderatorinstead of a capability — replaced withedit_photos.contributor,author,editor,administrator) instead of capabilities — replaced with a singleedit_postscheck.Test plan
composer install && vendor/bin/phpcs --sniffs=WordPress.WP.Capabilities .and confirm no warnings or errors🤖 Generated with Claude Code