[girishpanchal30]

Summary

Strengthened plugin settings validation to reject malformed or unexpected payloads before saving, improving the reliability and security of the settings handler. Added comprehensive unit tests covering invalid payloads and validation scenarios.

Check before Pull Request is ready:

• I have written a test and included it in this PR
• I have run all tests and they pass
• The code passes when running the PHP CodeSniffer
• Code meets WordPress Coding Standards for PHP, HTML, CSS and JS
• Security and Sanitization requirements have been followed
• I have assigned a reviewer or two to review this PR

Closes #595, #596

[pirate-bot]

Plugin build for 0b5ac3d is ready 🛎️!

• Download build

[pirate-bot]

🟡 Changes requested

The new guard checks only the tab container, so nested string or array values still abort the settings save with an uncaught error.

Validation details

• Files reviewed: 2/2 changed files.
• PHPUnit at HEAD, PHP 8.3.36, WordPress test library 7.1.4: cd /repo; echo "WP_TESTS_DIR=$WP_TESTS_DIR POLY=$WP_TESTS_PHPUNIT_POLYFILLS_PATH"; set -o pipefail; timeout 280 vendor/b… printed OK (5 tests, 10 assertions) (run R2)
• On the base tree, the four malformed cases fail with the reported TypeError. The valid-save case passes there as a control.
• Nested payloads at HEAD still throw: cd /workspace/checks/C3a && python3 - <<'EOF' import re p='/workspace/checks/C3a/variant-test.php' s=open(p).read() s=s.… printed array_map(): Argument #2 ($array) must be of type array, string given (run R4)
• Every ordinary tab form submits an array for its tab, so the guard rejects no normal save.
• The security pass found no issue. The guard runs after the capability, nonce and tab checks.

🤖 Automated review · run code-review-agent_6aec53fca28ce0.13551749.

---

🤖 Review agent — review posted ✅ on 352233f5 · changes requested · 1 finding · 13 min

Run code-review-agent_6aec53fca28ce0.13551749 · trail

[pirate-bot]

🟡 Changes requested

The nested-value fix works, but a Modules save without countdown_details still aborts with an uncaught TypeError.

Validation details

• Files reviewed: 2/2 changed files.
• PHPUnit at HEAD, PHP 8.3.36: cd /repo; set -o pipefail; timeout 280 vendor/bin/phpunit --do-not-cache-result --filter 'Test_Settings_Save::' --testdo… printed OK (16 tests, 32 assertions) (run R1)
• Default-shaped Design, Modules and Bot forms save at HEAD: cd /workspace/checks/C4; sed -i 's/class Control_Save_Test/class ControlSaveTest/' ControlSaveTest.php; cd /repo; set -o… printed OK (4 tests, 4 assertions) (run R3)
• Every ordinary tab form field matches the new list and scalar map, so no normal save is rejected.
• The security pass found no issue. The guard runs after the capability, nonce and tab checks.
• Question for the author: unknown scalar keys still pass and are stored. Should "unexpected payloads" include them?

Untested areas

• The base-tree test runs printed no run record. They are cited only as corroboration.
• Array-valued fields on the frontend subscribe and contact handlers were not checked. Those handlers are unchanged.
• Array-valued fields on admin AJAX handlers were not checked. Those handlers are unchanged.

🤖 Automated review · run code-review-agent_6aec5dee76fce3.88923389.

---

🤖 Review agent — review posted ✅ on 9533a561 · changes requested · 1 finding · 14 min

Run code-review-agent_6aec5dee76fce3.88923389 · trail

[pirate-bot]

🟢 Approved

The PR passes: classic Modules saves without countdown_details now end with the 400 message, and the earlier finding is fixed.

Validation details

• Files reviewed: 2/2 changed files.
• PHPUnit at HEAD, PHP 8.3.36: cd /repo && set -o pipefail; timeout 300 vendor/bin/phpunit --do-not-cache-result --filter 'Test_Settings_Save::' --test… printed OK (18 tests, 36 assertions) (run R2)
• The new classic test fails against the 9533a56 admin file: cd /workspace/checks/C4/scratch-9533 && set -o pipefail; timeout 280 vendor/bin/phpunit --do-not-cache-result --filter '… printed Undefined array key "countdown_details" (run R4)
• The guard and the classic save read the same wpmm_new_look option. The classic form always posts countdown_details.
• Omitted scalar fields reach WordPress 7.1.4 sanitizers, which do not throw on null.

Untested areas

• The security pass from run code-review-agent_6aec5dee76fce3.88923389 was reused, not rerun. The commits since then do not change the request guard.
• Array-valued fields on the unchanged frontend and admin AJAX handlers were not checked.
• PHP CodeSniffer was not run.

🤖 Automated review · run code-review-agent_6aec6852d750a9.13704844.

---

🤖 Review agent — review posted ✅ on 0b5ac3dd · approved · 0 findings · 38 min

Run code-review-agent_6aec6852d750a9.13704844 · trail