prepare release of v1.2.3 (#29)

Ticker ID is user input and may contain literally anything. While this
is properly escaped in the internal query, we should also escape it in
the generated HTML output.

.drone.yml

@@ -14,11 +14,11 @@ steps:
     depends_on:
       - composer-install
   - name: node-install
-    image: node:18
+    image: node:22
     commands:
       - npm install
   - name: lint-assets
-    image: node:20
+    image: node:22
     commands:
       - npx eslint scripts/block.js
       - npx eslint scripts/liveticker.js
@@ -26,4 +26,3 @@ steps:
       - npx stylelint styles/liveticker.css
     depends_on:
       - node-install
-

.github/workflows/test.yml

@@ -7,25 +7,34 @@ jobs:
       matrix:
         include:
           - php: '8.3'
-            wordpress: '6.4'
+            wordpress: '6.6'
           - php: '8.2'
-            wordpress: '6.3'
+            wordpress: '6.4'
           - php: '8.1'
-            wordpress: '6.1'
+            wordpress: '6.2'
           - php: '8.0'
+            wordpress: '6.0'
+          - php: '7.4'
             wordpress: '5.9'
           - php: '5.6'
             wordpress: '4.7'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - name: Install SVN
+        run: |
+          if ! command -v svn > /dev/null; then
+            sudo apt-get update
+            sudo apt-get install -y subversion
+          fi
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php }}
+          coverage: xdebug
           tools: composer
       - name: Setup DB
-        run: sudo /etc/init.d/mysql start
+        run: sudo sudo systemctl start mysql.service
       - name: Setup WP
         run: bash bin/install-wp-tests.sh wordpress root root localhost "${{ matrix.wordpress }}"
       - name: Install
@@ -44,9 +53,9 @@ jobs:
           php-version: '8.2'
           tools: composer
       - name: Setup Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
-          node-version: '20'
+          node-version: '22'
       - name: Install
         run: |
           composer install --no-interaction
@@ -65,7 +74,8 @@ jobs:
         with:
           fetch-depth: 0
       - name: Analyze with SonarCloud
-        uses: sonarsource/sonarcloud-github-action@master
+        if: env.SONAR_TOKEN != ''
+        uses: sonarsource/sonarcloud-github-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/wordpress-plugin-asset-update.yml

@@ -13,7 +13,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.0'
+          php-version: '8.2'
           tools: composer
       - name: Install
         run: composer install --no-interaction

.github/workflows/wordpress-plugin-check.yml

@@ -0,0 +1,23 @@
+name: Plugin check
+on:
+  push:
+    branches: [ 'stable', 'release/*' ]
+  pull_request:
+    branches: [ 'stable' ]
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Package plugin
+        run: |
+          mkdir -p ./dist
+          tail -n +7 README.md > README.md.tmp && mv README.md.tmp README.md
+          rsync -rc --exclude-from=.distignore ./ ./dist/stklcode-liveticker --delete --delete-excluded
+
+      - name: Check WP plugin
+        uses: wordpress/plugin-check-action@v1
+        with:
+          build-dir: ./dist/stklcode-liveticker

.github/workflows/wordpress-plugin-deploy.yml

@@ -14,7 +14,7 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '7.4'
+          php-version: '8.2'
           tools: composer
       - name: Install
         run: composer install --no-interaction

README.md

@@ -9,9 +9,9 @@
 * Contributors:      Stefan Kalscheuer
 * Tags:              liveticker, feed, rss
 * Requires at least: 4.7
-* Tested up to:      6.4
+* Tested up to:      6.7
 * Requires PHP:      5.6
-* Stable tag:        1.2.2
+* Stable tag:        1.2.3
 * License:           GPLv2 or later
 * License URI:       http://www.gnu.org/licenses/gpl-2.0.html
 
@@ -80,7 +80,12 @@ caching time of 12 hours obviously makes no sense.
 
 ## Changelog
 
-### 1.2.2 - 2023-03-02
+### 1.2.3 - 2025-02-04
+
+* Escape ticker ID in shortcode output
+* Tested with WP 6.7
+
+### 1.2.2 - 2024-03-02
 
 * Update use of deprecated WP core functions
 * Extend output sanitization

bin/install-wp-tests.sh

@@ -22,6 +22,17 @@ download() {
         curl -s "$1" > "$2";
     elif [ `which wget` ]; then
         wget -nv -O "$2" "$1"
+    else
+        echo "Error: Neither curl nor wget is installed."
+        exit 1
+    fi
+}
+
+# Check if svn is installed
+check_svn_installed() {
+    if ! command -v svn > /dev/null; then
+        echo "Error: svn is not installed. Please install svn and try again."
+        exit 1
     fi
 }
 
@@ -64,6 +75,7 @@ install_wp() {
 	if [[ $WP_VERSION == 'nightly' || $WP_VERSION == 'trunk' ]]; then
 		mkdir -p $TMPDIR/wordpress-trunk
 		rm -rf $TMPDIR/wordpress-trunk/*
+        check_svn_installed
 		svn export --quiet https://core.svn.wordpress.org/trunk $TMPDIR/wordpress-trunk/wordpress
 		mv $TMPDIR/wordpress-trunk/wordpress/* $WP_CORE_DIR
 	else
@@ -92,7 +104,7 @@ install_wp() {
 		tar --strip-components=1 -zxmf $TMPDIR/wordpress.tar.gz -C $WP_CORE_DIR
 	fi
 
-	download https://raw.github.com/markoheijnen/wp-mysqli/master/db.php $WP_CORE_DIR/wp-content/db.php
+	download https://raw.githubusercontent.com/markoheijnen/wp-mysqli/master/db.php $WP_CORE_DIR/wp-content/db.php
 }
 
 install_test_suite() {
@@ -108,6 +120,7 @@ install_test_suite() {
 		# set up testing suite
 		mkdir -p $WP_TESTS_DIR
 		rm -rf $WP_TESTS_DIR/{includes,data}
+        check_svn_installed
 		svn export --quiet --ignore-externals https://develop.svn.wordpress.org/${WP_TESTS_TAG}/tests/phpunit/includes/ $WP_TESTS_DIR/includes
 		svn export --quiet --ignore-externals https://develop.svn.wordpress.org/${WP_TESTS_TAG}/tests/phpunit/data/ $WP_TESTS_DIR/data
 	fi

composer.json

@@ -1,6 +1,6 @@
 {
   "name": "stklcode/stklcode-liveticker",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "A simple Liveticker for Wordpress.",
   "keywords": [
     "wordpress",

includes/class-scliveticker.php

@@ -26,7 +26,7 @@ class SCLiveticker {
 	 *
 	 * @var string OPTIONS
 	 */
-	const VERSION = '1.2.2';
+	const VERSION = '1.2.3';
 
 	/**
 	 * Options tag.
@@ -232,7 +232,7 @@ class SCLiveticker {
 			$output = '<div class="wp-block-scliveticker-ticker';
 			if ( 1 === self::$options['enable_ajax'] ) {
 				$output .= ' sclt-ajax" '
-							. 'data-sclt-ticker="' . $ticker . '" '
+							. 'data-sclt-ticker="' . esc_attr( $ticker ) . '" '
 							. 'data-sclt-limit="' . $limit . '" '
 							. 'data-sclt-last="' . $last;
 			}
@@ -242,9 +242,9 @@ class SCLiveticker {
 			if ( $show_feed ) {
 				$feed_link = get_post_type_archive_feed_link( 'scliveticker_tick' ) . '';
 				if ( false === strpos( $feed_link, '&' ) ) {
-					$feed_link .= '?scliveticker_ticker=' . $ticker;
+					$feed_link .= '?scliveticker_ticker=' . rawurlencode( $ticker );
 				} else {
-					$feed_link .= '&scliveticker_ticker=' . $ticker;
+					$feed_link .= '&scliveticker_ticker=' . rawurlencode( $ticker );
 				}
 				$output .= '<a href="' . esc_attr( $feed_link ) . '">Feed</a>';
 			}

package.json

@@ -1,13 +1,13 @@
 {
   "name": "stklcode-liveticker",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "A simple Liveticker for Wordpress.",
   "author": "Stefan Kalscheuer",
   "license": "GPL-2.0+",
   "devDependencies": {
-    "@wordpress/eslint-plugin": "^17",
-    "@wordpress/stylelint-config": "^21",
+    "@wordpress/eslint-plugin": "^22",
+    "@wordpress/stylelint-config": "^23",
     "eslint": "^8",
-    "stylelint": "^14"
+    "stylelint": "^16"
   }
 }

stklcode-liveticker.php

@@ -9,7 +9,7 @@
  * @wordpress-plugin
  * Plugin Name: Liveticker (by stklcode)
  * Description: A simple Liveticker for WordPress.
- * Version:     1.2.2
+ * Version:     1.2.3
  * Author:      Stefan Kalscheuer
  * Author URI:  https://www.stklcode.de
  * Text Domain: stklcode-liveticker