felixarntz/global-admin

Avoid deeply nested control flow statements.

Open

                                    if ( $details->userblog_id != get_network()->site_id ) { // main blog not a spam !
                                        update_blog_status( $details->userblog_id, 'spam', '1' );
                                    }

Avoid deeply nested control flow statements.

Open

                                if ( is_global_administrator( $user->ID ) || is_super_admin( $user->ID ) ) {
                                    wp_die( sprintf( __( 'Warning! User cannot be modified. The user %s is a network administrator.' ), esc_html( $user->user_login ) ) );
                                }

Avoid deeply nested control flow statements.

Open

                                if ( ! current_user_can( 'delete_users' ) ) {
                                    wp_die( __( 'Sorry, you are not allowed to access this page.' ), 403 );
                                }

Detected usage of a non-validated input variable: $_POST

Open

            if ( is_array( $_POST['user'] ) && ! empty( $_POST['user'] ) ) {

• Exclude checks
  • Disable engine
  • Disable check

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

Open

                _e( 'Users marked as spam.' );

• Exclude checks
  • Disable engine
  • Disable check

Detected usage of a non-validated input variable: $_POST

Open

                confirm_delete_users( $_POST['allusers'] );

• Exclude checks
  • Disable engine
  • Disable check

Missing wp_unslash() before sanitization.

Open

                $doaction     = $_POST['action'] != -1 ? $_POST['action'] : $_POST['action2'];

• Exclude checks
  • Disable engine
  • Disable check

Missing wp_unslash() before sanitization.

Open

                foreach ( (array) $_POST['allusers'] as $user_id ) {

• Exclude checks
  • Disable engine
  • Disable check

Detected usage of a non-sanitized input variable: $_POST

Open

                foreach ( $_POST['user'] as $id ) {

• Exclude checks
  • Disable engine
  • Disable check

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '__'.

Open

    wp_die( __( 'Multinetwork support is not enabled.', 'wp-global-admin' ) );

• Exclude checks
  • Disable engine
  • Disable check

Detected usage of a non-validated input variable: $_GET

Open

            $id = intval( $_GET['id'] );

• Exclude checks
  • Disable engine
  • Disable check

Missing wp_unslash() before sanitization.

Open

                foreach ( $_POST['user'] as $id ) {

• Exclude checks
  • Disable engine
  • Disable check

Missing wp_unslash() before sanitization.

Open

                $doaction     = $_POST['action'] != -1 ? $_POST['action'] : $_POST['action2'];

• Exclude checks
  • Disable engine
  • Disable check

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '__'.

Open

                                    wp_die( sprintf( __( 'Warning! User cannot be modified. The user %s is a network administrator.' ), esc_html( $user->user_login ) ) );

• Exclude checks
  • Disable engine
  • Disable check

Missing wp_unslash() before sanitization.

Open

                                confirm_delete_users( $_POST['allusers'] );

• Exclude checks
  • Disable engine
  • Disable check

Use Yoda Condition checks, you must.

Open

                $doaction     = $_POST['action'] != -1 ? $_POST['action'] : $_POST['action2'];

• Exclude checks
  • Disable engine
  • Disable check

Terminating statement must be indented to the same level as the CASE body

Open

            break;

• Exclude checks
  • Disable engine
  • Disable check

Detected usage of a non-sanitized input variable: $_POST

Open

                                confirm_delete_users( $_POST['allusers'] );

• Exclude checks
  • Disable engine
  • Disable check

Use Yoda Condition checks, you must.

Open

            if ( $i == 1 ) {

• Exclude checks
  • Disable engine
  • Disable check

Detected usage of a non-sanitized input variable: $_POST

Open

                foreach ( $_POST['blog'] as $id => $users ) {

• Exclude checks
  • Disable engine
  • Disable check

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

Open

                _e( 'User deleted.' );

• Exclude checks
  • Disable engine
  • Disable check

Terminating statement must be indented to the same level as the CASE body

Open

            break;

• Exclude checks
  • Disable engine
  • Disable check

A gettext call containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

Open

                                    wp_die( sprintf( __( 'Warning! User cannot be modified. The user %s is a network administrator.' ), esc_html( $user->user_login ) ) );

• Exclude checks
  • Disable engine
  • Disable check

Inline comments must end in full-stops, exclamation marks, or question marks

Open

                $_POST['allusers'] = array( $id ); // confirm_delete_users() can only handle with arrays

• Exclude checks
  • Disable engine
  • Disable check

Missing wp_unslash() before sanitization.

Open

                confirm_delete_users( $_POST['allusers'] );

• Exclude checks
  • Disable engine
  • Disable check

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '__'.

Open

    wp_die( __( 'You do not have permission to access this page.' ), 403 );

• Exclude checks
  • Disable engine
  • Disable check

Use Yoda Condition checks, you must.

Open

            if ( $id != '0' && $id != '1' ) {

• Exclude checks
  • Disable engine
  • Disable check

Detected usage of a non-sanitized input variable: $_POST

Open

                confirm_delete_users( $_POST['allusers'] );

• Exclude checks
  • Disable engine
  • Disable check

Detected usage of a non-sanitized input variable: $_POST

Open

                $doaction     = $_POST['action'] != -1 ? $_POST['action'] : $_POST['action2'];

• Exclude checks
  • Disable engine
  • Disable check

Detected usage of a non-sanitized input variable: $_POST

Open

                foreach ( (array) $_POST['allusers'] as $user_id ) {

• Exclude checks
  • Disable engine
  • Disable check

Missing wp_unslash() before sanitization.

Open

                    $user_ids = (array) $_POST['allusers'];

• Exclude checks
  • Disable engine
  • Disable check

Detected usage of a non-sanitized input variable: $_POST

Open

                    $user_ids = (array) $_POST['allusers'];

• Exclude checks
  • Disable engine
  • Disable check

Use Yoda Condition checks, you must.

Open

                                    if ( $details->userblog_id != get_network()->site_id ) { // main blog not a spam !

• Exclude checks
  • Disable engine
  • Disable check

Each array item in a multi-line array declaration must end in a comma

Open

        '<p>' . __( 'You can make an existing user an additional global admin by going to the Edit User profile page and checking the box to grant that privilege.', 'wp-global-admin' ) . '</p>'

• Exclude checks
  • Disable engine
  • Disable check

Use Yoda Condition checks, you must.

Open

if ( isset( $_REQUEST['updated'] ) && $_REQUEST['updated'] == 'true' && ! empty( $_REQUEST['action'] ) ) {

• Exclude checks
  • Disable engine
  • Disable check

Use Yoda Condition checks, you must.

Open

            if ( $id != '0' && $id != '1' ) {

• Exclude checks
  • Disable engine
  • Disable check

Detected usage of a non-sanitized input variable: $_POST

Open

                $doaction     = $_POST['action'] != -1 ? $_POST['action'] : $_POST['action2'];

• Exclude checks
  • Disable engine
  • Disable check

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '__'.

Open

                                    wp_die( __( 'Sorry, you are not allowed to access this page.' ), 403 );

• Exclude checks
  • Disable engine
  • Disable check

Missing wp_unslash() before sanitization.

Open

                foreach ( $_POST['blog'] as $id => $users ) {

• Exclude checks
  • Disable engine
  • Disable check

Terminating statement must be indented to the same level as the CASE body

Open

            break;

• Exclude checks
  • Disable engine
  • Disable check

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

Open

                _e( 'Users deleted.' );

• Exclude checks
  • Disable engine
  • Disable check

Terminating statement must be indented to the same level as the CASE body

Open

            break;

• Exclude checks
  • Disable engine
  • Disable check

Terminating statement must be indented to the same level as the CASE body

Open

            break;

• Exclude checks
  • Disable engine
  • Disable check

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

Open

                _e( 'Users removed from spam.' );

• Exclude checks
  • Disable engine
  • Disable check

All output should be run through an escaping function (like esc_html_e() or esc_attr_e()), found '_e'.

Open

                _e( 'User added.' );

• Exclude checks
  • Disable engine
  • Disable check

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '__'.

Open

        printf( '<span class="subtitle">' . __( 'Search results for &#8220;%s&#8221;' ) . '</span>', esc_html( $usersearch ) );

• Exclude checks
  • Disable engine
  • Disable check

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found 'global_admin_url'.

Open

        <a href="<?php echo global_admin_url( 'user-new.php' ); ?>" class="page-title-action"><?php echo esc_html_x( 'Add New', 'user' ); ?></a>

• Exclude checks
  • Disable engine
  • Disable check