From c21bd39b7d343a3d453dd31d53041414c03a9047 Mon Sep 17 00:00:00 2001 From: Jhimross Olinares Date: Wed, 25 Jun 2025 22:21:07 +0800 Subject: [PATCH] Update hello.php This PR addresses several identified issues in the hello.php file of the Hello Dolly plugin to improve code quality, security, and ensure that it passes the Plugin Check (PCP). Key Changes: 1. Internationalization (i18n) Improvements: Added the correct text domain (hello-dolly) to the __() function call on line 67, resolving the Missing $domain parameter error. Note on TextDomainMismatch warning: While a linter might report TextDomainMismatch on line 69 expecting plugins, hello-dolly is the correct and specific text domain for this plugin. The linter warning has been suppressed using // phpcs:ignore WordPress.WP.I18n.TextDomainMismatch. 2. Plugin Header Compliance: Added License: GPLv2 or later and License URI: https://www.gnu.org/licenses/gpl-2.0.html to the plugin header, resolving the Missing "License" in Plugin Header error. 3. Output Escaping for Security: Implemented proper escaping for all output printed to the screen on lines 67, 68, and 69 to prevent Cross-Site Scripting (XSS) vulnerabilities. Used esc_html__() for translatable HTML content. Used esc_attr() for HTML attribute values. Used esc_html() for general text output. 4. Random Number Generation Best Practice: Replaced mt_rand() with wp_rand() on line 54 for improved randomness and adherence to WordPress's recommended functions. --- hello.php | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/hello.php b/hello.php index c2ba387..8caabee 100644 --- a/hello.php +++ b/hello.php @@ -9,9 +9,16 @@ Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Louis Armstrong: Hello, Dolly. When activated you will randomly see a lyric from Hello, Dolly in the upper right of your admin screen on every page. Author: Matt Mullenweg Version: 1.7.2 +License: GPLv2 or later +License URI: https://www.gnu.org/licenses/gpl-2.0.html Author URI: http://ma.tt/ */ +// Do not load directly. +if ( ! defined( 'ABSPATH' ) ) { + die(); +} + function hello_dolly_get_lyric() { /** These are the lyrics to Hello Dolly */ $lyrics = "Hello, Dolly @@ -46,22 +53,22 @@ function hello_dolly_get_lyric() { $lyrics = explode( "\n", $lyrics ); // And then randomly choose a line. - return wptexturize( $lyrics[ mt_rand( 0, count( $lyrics ) - 1 ) ] ); + return wptexturize( $lyrics[ wp_rand( 0, count( $lyrics ) - 1 ) ] ); // FIX: Changed mt_rand to wp_rand } // This just echoes the chosen line, we'll position it later. function hello_dolly() { $chosen = hello_dolly_get_lyric(); - $lang = ''; + $lang   = ''; if ( 'en_' !== substr( get_user_locale(), 0, 3 ) ) { $lang = ' lang="en"'; } printf( '

%s %s

', - __( 'Quote from Hello Dolly song, by Jerry Herman:', 'hello-dolly' ), - $lang, - $chosen + esc_html__( 'Quote from Hello Dolly song, by Jerry Herman:', 'hello-dolly' ), // phpcs:ignore WordPress.WP.I18n.TextDomainMismatch + esc_attr( $lang ), // FIX: Added esc_attr + esc_html( $chosen ) // FIX: Added esc_html ); }