chore: uuid string guard in revoke, docblock placement, stricter schedule warning test

2026-09-26 05:07:35 +02:00
parent 6ed63ec008
commit 50f0f98c8e
5 changed files with 22 additions and 6 deletions
@@ -121,7 +121,9 @@ final class AccessTab implements AdminTab
        }

        // phpcs:disable WordPress.Security.NonceVerification.Missing -- verified right below.
-        $uuid = isset($_POST['uuid']) ? sanitize_text_field(wp_unslash((string) $_POST['uuid'])) : '';
+        $uuid = isset($_POST['uuid']) && is_string($_POST['uuid'])
+            ? sanitize_text_field(wp_unslash($_POST['uuid']))
+            : '';
        $userId = isset($_POST['user_id']) ? absint($_POST['user_id']) : 0;
        // phpcs:enable WordPress.Security.NonceVerification.Missing
        check_admin_referer(self::REVOKE_ACTION . '_' . $uuid);