prepare release of v1.2.3 (#29)

Ticker ID is user input and may contain literally anything. While this
is properly escaped in the internal query, we should also escape it in
the generated HTML output.

.drone.yml

@@ -8,17 +8,17 @@ steps:
     commands:
       - composer install --ignore-platform-req=php
   - name: lint-php
-    image: php:7.4
+    image: php:8.2
     commands:
       - ./vendor/bin/phpcs
     depends_on:
       - composer-install
   - name: node-install
-    image: node:16
+    image: node:22
     commands:
       - npm install
   - name: lint-assets
-    image: node:16
+    image: node:22
     commands:
       - npx eslint scripts/block.js
       - npx eslint scripts/liveticker.js
@@ -26,4 +26,3 @@ steps:
       - npx stylelint styles/liveticker.css
     depends_on:
       - node-install
-

.github/workflows/test.yml

@@ -6,20 +6,35 @@ jobs:
     strategy:
       matrix:
         include:
+          - php: '8.3'
+            wordpress: '6.6'
+          - php: '8.2'
+            wordpress: '6.4'
+          - php: '8.1'
+            wordpress: '6.2'
+          - php: '8.0'
+            wordpress: '6.0'
           - php: '7.4'
-            wordpress: '5.8'
+            wordpress: '5.9'
           - php: '5.6'
             wordpress: '4.7'
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
+      - name: Install SVN
+        run: |
+          if ! command -v svn > /dev/null; then
+            sudo apt-get update
+            sudo apt-get install -y subversion
+          fi
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php }}
+          coverage: xdebug
           tools: composer
       - name: Setup DB
-        run: sudo /etc/init.d/mysql start
+        run: sudo sudo systemctl start mysql.service
       - name: Setup WP
         run: bash bin/install-wp-tests.sh wordpress root root localhost "${{ matrix.wordpress }}"
       - name: Install
@@ -31,16 +46,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '7.4'
+          php-version: '8.2'
           tools: composer
       - name: Setup Node
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@v4
         with:
-          node-version: '14'
+          node-version: '22'
       - name: Install
         run: |
           composer install --no-interaction
@@ -55,11 +70,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Analyze with SonarCloud
-        uses: sonarsource/sonarcloud-github-action@master
+        if: env.SONAR_TOKEN != ''
+        uses: sonarsource/sonarcloud-github-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/wordpress-plugin-asset-update.yml

@@ -9,11 +9,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '7.4'
+          php-version: '8.2'
           tools: composer
       - name: Install
         run: composer install --no-interaction

.github/workflows/wordpress-plugin-check.yml

@@ -0,0 +1,23 @@
+name: Plugin check
+on:
+  push:
+    branches: [ 'stable', 'release/*' ]
+  pull_request:
+    branches: [ 'stable' ]
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Package plugin
+        run: |
+          mkdir -p ./dist
+          tail -n +7 README.md > README.md.tmp && mv README.md.tmp README.md
+          rsync -rc --exclude-from=.distignore ./ ./dist/stklcode-liveticker --delete --delete-excluded
+
+      - name: Check WP plugin
+        uses: wordpress/plugin-check-action@v1
+        with:
+          build-dir: ./dist/stklcode-liveticker

.github/workflows/wordpress-plugin-deploy.yml

@@ -10,11 +10,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '7.4'
+          php-version: '8.2'
           tools: composer
       - name: Install
         run: composer install --no-interaction

README.md

@@ -9,9 +9,9 @@
 * Contributors:      Stefan Kalscheuer
 * Tags:              liveticker, feed, rss
 * Requires at least: 4.7
-* Tested up to:      5.9
+* Tested up to:      6.7
 * Requires PHP:      5.6
-* Stable tag:        1.2.1
+* Stable tag:        1.2.3
 * License:           GPLv2 or later
 * License URI:       http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -80,6 +80,17 @@ caching time of 12 hours obviously makes no sense.
 
 ## Changelog
 
+### 1.2.3 - 2025-02-04
+
+* Escape ticker ID in shortcode output
+* Tested with WP 6.7
+
+### 1.2.2 - 2024-03-02
+
+* Update use of deprecated WP core functions
+* Extend output sanitization
+* Tested with WP 6.4
+
 ### 1.2.1 - 2022-02-01
 
 * Fix issue with limit in Gutenberg block.

bin/install-wp-tests.sh

@@ -22,6 +22,17 @@ download() {
         curl -s "$1" > "$2";
     elif [ `which wget` ]; then
         wget -nv -O "$2" "$1"
+    else
+        echo "Error: Neither curl nor wget is installed."
+        exit 1
+    fi
+}
+
+# Check if svn is installed
+check_svn_installed() {
+    if ! command -v svn > /dev/null; then
+        echo "Error: svn is not installed. Please install svn and try again."
+        exit 1
     fi
 }
 
@@ -64,6 +75,7 @@ install_wp() {
 	if [[ $WP_VERSION == 'nightly' || $WP_VERSION == 'trunk' ]]; then
 		mkdir -p $TMPDIR/wordpress-trunk
 		rm -rf $TMPDIR/wordpress-trunk/*
+        check_svn_installed
 		svn export --quiet https://core.svn.wordpress.org/trunk $TMPDIR/wordpress-trunk/wordpress
 		mv $TMPDIR/wordpress-trunk/wordpress/* $WP_CORE_DIR
 	else
@@ -92,7 +104,7 @@ install_wp() {
 		tar --strip-components=1 -zxmf $TMPDIR/wordpress.tar.gz -C $WP_CORE_DIR
 	fi
 
-	download https://raw.github.com/markoheijnen/wp-mysqli/master/db.php $WP_CORE_DIR/wp-content/db.php
+	download https://raw.githubusercontent.com/markoheijnen/wp-mysqli/master/db.php $WP_CORE_DIR/wp-content/db.php
 }
 
 install_test_suite() {
@@ -108,6 +120,7 @@ install_test_suite() {
 		# set up testing suite
 		mkdir -p $WP_TESTS_DIR
 		rm -rf $WP_TESTS_DIR/{includes,data}
+        check_svn_installed
 		svn export --quiet --ignore-externals https://develop.svn.wordpress.org/${WP_TESTS_TAG}/tests/phpunit/includes/ $WP_TESTS_DIR/includes
 		svn export --quiet --ignore-externals https://develop.svn.wordpress.org/${WP_TESTS_TAG}/tests/phpunit/data/ $WP_TESTS_DIR/data
 	fi

composer.json

@@ -1,6 +1,6 @@
 {
   "name": "stklcode/stklcode-liveticker",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "A simple Liveticker for Wordpress.",
   "keywords": [
     "wordpress",
@@ -21,14 +21,14 @@
     "composer/installers": "~1.12"
   },
   "require-dev": {
-    "dealerdirect/phpcodesniffer-composer-installer": "^0.7",
+    "dealerdirect/phpcodesniffer-composer-installer": "^v1.0",
     "matthiasmullie/minify": "^1.3",
     "phpcompatibility/phpcompatibility-wp": "^2.1",
-    "phpunit/phpunit": "^5|^6|^7",
+    "phpunit/phpunit": "^5|^6|^7|^8|^9",
     "slowprog/composer-copy-file": "~0.3",
-    "squizlabs/php_codesniffer": "^3.6",
-    "wp-coding-standards/wpcs": "^2.3",
-    "yoast/phpunit-polyfills": "^1.0"
+    "squizlabs/php_codesniffer": "^3.9",
+    "wp-coding-standards/wpcs": "^3.0",
+    "yoast/phpunit-polyfills": "^2.0"
   },
   "scripts": {
     "post-install-cmd": [
@@ -65,5 +65,11 @@
       "minifyjs scripts/block.js > scripts/block.min.js",
       "minifyjs scripts/liveticker.js > scripts/liveticker.min.js"
     ]
+  },
+  "config": {
+    "allow-plugins": {
+      "composer/installers": true,
+      "dealerdirect/phpcodesniffer-composer-installer": true
+    }
   }
 }

includes/class-scliveticker.php

@@ -26,7 +26,7 @@ class SCLiveticker {
 	 *
 	 * @var string OPTIONS
 	 */
-	const VERSION = '1.2.1';
+	const VERSION = '1.2.3';
 
 	/**
 	 * Options tag.
@@ -232,7 +232,7 @@ class SCLiveticker {
 			$output = '<div class="wp-block-scliveticker-ticker';
 			if ( 1 === self::$options['enable_ajax'] ) {
 				$output .= ' sclt-ajax" '
-							. 'data-sclt-ticker="' . $ticker . '" '
+							. 'data-sclt-ticker="' . esc_attr( $ticker ) . '" '
 							. 'data-sclt-limit="' . $limit . '" '
 							. 'data-sclt-last="' . $last;
 			}
@@ -242,9 +242,9 @@ class SCLiveticker {
 			if ( $show_feed ) {
 				$feed_link = get_post_type_archive_feed_link( 'scliveticker_tick' ) . '';
 				if ( false === strpos( $feed_link, '&' ) ) {
-					$feed_link .= '?scliveticker_ticker=' . $ticker;
+					$feed_link .= '?scliveticker_ticker=' . rawurlencode( $ticker );
 				} else {
-					$feed_link .= '&scliveticker_ticker=' . $ticker;
+					$feed_link .= '&scliveticker_ticker=' . rawurlencode( $ticker );
 				}
 				$output .= '<a href="' . esc_attr( $feed_link ) . '">Feed</a>';
 			}

includes/class-widget.php

@@ -95,15 +95,16 @@ class Widget extends WP_Widget {
 
 		$wp_query = new WP_Query( $args );
 		$cnt      = 0;
-		while ( $wp_query->have_posts() && ( $count <= 0 || ++ $cnt < $count ) ) {
+		while ( $wp_query->have_posts() && ( $count <= 0 || ++$cnt < $count ) ) {
 			$wp_query->the_post();
-			// @codingStandardsIgnoreLine
+			// phpcs:disable WordPress.Security.EscapeOutput.OutputNotEscaped
 			echo SCLiveticker::tick_html_widget(
 				esc_html( get_the_time( 'd.m.Y - H:i' ) ),
 				get_the_title(),
 				( '1' === $highlight && get_the_time( 'U' ) > ( time() - $highlight_time ) ),
 				get_the_ID()
 			);
+			// phpcs:enable
 		}
 
 		echo '</ul>';
@@ -145,7 +146,13 @@ class Widget extends WP_Widget {
 		$highlight      = isset( $instance['highlight'] ) ? esc_attr( $instance['highlight'] ) : '0';
 		$highlight_time = isset( $instance['highlight_time'] ) ? esc_attr( $instance['highlight_time'] ) : '0';
 		$ajax           = isset( $instance['ajax'] ) ? esc_attr( $instance['ajax'] ) : '0';
-		$categories     = get_terms( 'scliveticker_ticker', 'orderby=name&order=ASC' );
+		$categories     = get_terms(
+			array(
+				'taxonomy' => 'scliveticker_ticker',
+				'orderby'  => 'name',
+				'order'    => 'ASC',
+			)
+		);
 
 		include SCLIVETICKER_DIR . 'views/widget-form.php';
 	}

package.json

@@ -1,13 +1,13 @@
 {
   "name": "stklcode-liveticker",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "A simple Liveticker for Wordpress.",
   "author": "Stefan Kalscheuer",
   "license": "GPL-2.0+",
   "devDependencies": {
-    "@wordpress/eslint-plugin": "^9",
-    "@wordpress/stylelint-config": "^19",
-    "eslint": "^7",
-    "stylelint": "^13"
+    "@wordpress/eslint-plugin": "^22",
+    "@wordpress/stylelint-config": "^23",
+    "eslint": "^8",
+    "stylelint": "^16"
   }
 }

stklcode-liveticker.php

@@ -9,7 +9,7 @@
  * @wordpress-plugin
  * Plugin Name: Liveticker (by stklcode)
  * Description: A simple Liveticker for WordPress.
- * Version:     1.2.1
+ * Version:     1.2.3
  * Author:      Stefan Kalscheuer
  * Author URI:  https://www.stklcode.de
  * Text Domain: stklcode-liveticker
@@ -64,11 +64,11 @@ spl_autoload_register( 'scliveticker_autoload' );
 /**
  * Autoloader for Liveticker classes.
  *
- * @param string $class  Name of the class to load.
+ * @param string $class_name  Name of the class to load.
  *
  * @return void
  */
-function scliveticker_autoload( $class ) {
+function scliveticker_autoload( $class_name ) {
 	$plugin_classes = array(
 		'SCLiveticker\\SCLiveticker',
 		'SCLiveticker\\Admin',
@@ -76,11 +76,11 @@ function scliveticker_autoload( $class ) {
 		'SCLiveticker\\System',
 		'SCLiveticker\\Widget',
 	);
-	if ( in_array( $class, $plugin_classes, true ) ) {
+	if ( in_array( $class_name, $plugin_classes, true ) ) {
 		require_once sprintf(
 			'%s/includes/class-%s.php',
 			SCLIVETICKER_DIR,
-			strtolower( str_replace( '_', '-', substr( $class, 13 ) ) )
+			strtolower( str_replace( '_', '-', substr( $class_name, 13 ) ) )
 		);
 	}
 }

tests/test-api.php

@@ -24,8 +24,8 @@ class Test_API extends WP_UnitTestCase {
 	 *
 	 * @return void
 	 */
-	public function setUp() {
-		parent::setUp();
+	public function set_up() {
+		parent::set_up();
 		global $wp_rest_server;
 		$wp_rest_server = new WP_REST_Server();
 		do_action( 'rest_api_init' );

views/widget-form.php

@@ -54,10 +54,10 @@ if ( ! defined( 'ABSPATH' ) ) {
 					<?php esc_html_e( 'all', 'stklcode-liveticker' ); ?>
 				</option>
 				<?php
-				for ( $i = 1; $i <= 10; $i ++ ) {
+				for ( $i = 1; $i <= 10; $i++ ) {
 					printf(
 						'<option value="%d"%s>%d</option>',
-						$i,
+						intval( $i ),
 						( $i === $count ) ? ' selected' : '',
 						intval( $i )
 					);