Skip to content

Challenge 1 and 2 - Gabriel - #25

Open
gabrielgpacheco wants to merge 3 commits into
masterfrom
feature/gabrielpacheco1
Open

Challenge 1 and 2 - Gabriel#25
gabrielgpacheco wants to merge 3 commits into
masterfrom
feature/gabrielpacheco1

Conversation

@gabrielgpacheco

@gabrielgpacheco gabrielgpacheco commented May 4, 2026 •
edited
Loading

Copy link
Copy Markdown

@gabrielgpacheco
gabrielgpacheco requested a review from steinbachr May 4, 2026 20:12
@gabrielgpacheco
feat: implement complete law firm backend schema inside theme
3324fc5 
- Register 6 custom post types (attorney, practice_area, case_result,
  testimonial, office, faq) with proper hierarchical flags
- Register 4 taxonomies (practice-area-group, case-type, region,
  attorney-position) attached to the relevant post types
- Add native meta boxes using register_post_meta (single, typed) with
  editor UI for every field, all exposed in REST
- Enrich REST API with related posts hydration and
  case_result.amount_formatted (cents to human-readable amount)
- Create front-page.php schema overview listing CPTs and taxonomies
  with direct admin and REST links
- Add recommended plugins notice (ACF Free, CF7, Yoast, Redirection,
  WP Super Cache, Wordfence, UpdraftPlus) with purpose descriptions
- Include professional README.md with setup instructions and testing
  steps
- Write all code comments in English; update style.css header for the
  Pug & Puggle theme
@gabrielgpacheco

gabrielgpacheco commented May 4, 2026

Copy link
Copy Markdown
Author

Pull Request Description

Overview
This PR delivers the completed work for Challenge 1 (Airpug) and Challenge 2 (Pug & Puggle Backend).

✅ Challenge 1 – Airpug (Front‑End Theme)

  • Fully dynamic homepage built with ACF (free) and Tailwind CSS.
  • Header with banner, custom logo, language switcher, user block, and notifications.
  • Search section with tabs, labels, and dynamic placeholders.
  • Hero section with gradient overlay and CTA.
  • Featured destinations section.
  • Modular JavaScript (mobile menu, tabs).
  • All fields are editable via a “Theme Options” page and the front page.

✅ Challenge 2 – Law Firm Backend Schema (This PR)

All code lives inside the theme (pug-puggle/inc/) – no external plugins required.

  • Custom Post Types (6): attorney, practice_area (hierarchical), case_result, testimonial, office, faq.
    Each has show_in_rest = true and appears in the admin menu.
  • Taxonomies (4): practice-area-group, case-type, region, attorney-position.
    Correct show_admin_column and attachment to relevant CPTs.
  • Post Meta & Native Meta Boxes:
    • Attorney: position, bar_admissions.
    • Practice Area: icon (media ID), short_description.
    • Case Result: verdict_amount (cents), case_summary.
    • Testimonial: client_name, rating.
    • Office: address, phone, city.
    • FAQ: faq_answer.
      All fields are registered with register_post_meta (single => true, typed) and exposed in REST.
  • REST Enrichment:
    • related field on attorney, practice_area, case_result that hydrates stored ID lists into minimal post objects.
    • amount_formatted on case_result that converts cents to a human‑readable dollar string.
  • Developer‑Facing Schema Overview (front-page.php):
    A clean HTML page listing every CPT and taxonomy with direct links to their admin screens and REST endpoints.
  • Recommended Plugins Notice:
    Admin notice suggesting free, essential plugins (ACF Free, CF7, Yoast, Redirection, WP Super Cache, Wordfence, UpdraftPlus) with a short description of each. The schema works without any of them.
  • Professional README.md:
    Complete setup instructions, testing steps, and architecture overview for new developers.

🔬 How to Test (Challenge 2)

  1. Pull this branch and run docker compose up -d from challenge-2/.
  2. Activate the Pug & Puggle theme and flush permalinks (Settings > Permalinks > Save).
  3. In the admin, you’ll see all 6 CPTs and their taxonomies.
  4. Create test posts and fill in the native meta boxes – save and verify persistence.
  5. Hit the REST API:
    • GET /wp-json/wp/v2/attorney
    • GET /wp-json/wp/v2/case_result (check amount_formatted and related fields).
  6. Visit the homepage (or a page using front-page.php) to see the schema overview with live admin/REST links.
  7. Deactivate one recommended plugin (e.g., Wordfence) and observe the admin notice.

📝 Notes for Reviewers

  • All code comments are in English.
  • The theme uses the same modular structure as the Challenge 1 framework (inc/*/all.php loaders).
  • The backend is standalone – no dependency on ACF or any other plugin for the schema to function.
  • This sets the stage for the front‑end team to start consuming data via WP_Query or REST.

Feedback welcome! 🐾

@gabrielgpacheco gabrielgpacheco changed the title Challenge 1 - Gabriel Challenge 1 and 2 - Gabriel May 4, 2026
@gabrielgpacheco
Security Hardening: Fix XSS, CSRF, input sanitization, and file opera…
243583d 
…tion vulnerabilities

SUMMARY
This commit addresses multiple critical security vulnerabilities across the theme,
implementing WordPress security best practices for output escaping, input sanitization,
CSRF protection, and safe file operations.

CHANGES BY PHASE

Phase 1: Cross-Site Scripting (XSS) Prevention (50+ fixes)
- header.php: Escaped unescaped ACF field outputs (URLs and text)
  * Fixed contact_phone['url'] with esc_url()
  * Fixed contact_phone['title'] with esc_html()
  * Applied escaping to both desktop and mobile nav sections

- inc/template_functions.php: Secured inf_acf_link() function
  * Added esc_url() for link URLs
  * Added esc_attr() for CSS classes
  * Added esc_html() for link text
  * Fixed missing quotes in href attribute

- searchform.php: Fixed variable naming bug
  * Corrected $ps_unique_id to $inf_unique_id on label reference

- templates/ppc-landing-page-matchup.php: Escaped 40+ field outputs
  * Applied esc_url() to all image src and href attributes
  * Applied esc_attr() to alt text and data attributes
  * Applied esc_html() to all text content
  * Applied wp_kses_post() to rich HTML content
  * Fixed inline style URL syntax with proper quote handling

- inc/services/locations.php: Secured AJAX response output
  * Escaped link URLs with esc_url()
  * Escaped link titles with esc_html()

Phase 2: Input Sanitization & CSRF Protection
- inc/services/locations.php: Added nonce verification and input sanitization
  * Added wp_verify_nonce() check for AJAX requests
  * Sanitized $_POST['q'] and $_POST['post_type'] with sanitize_text_field()
  * Validated post_type against registered post types
  * Sanitized geopoint array values with floatval()
  * Added documentation note for frontend nonce requirement

- functions.php: Added AJAX nonce to frontend
  * Added location_navigator_nonce to wp_localize_script()
  * Makes nonce available to JavaScript AJAX calls

- inc/hooks.php: Secured review submission handler
  * Added input validation for required fields
  * Sanitized post_title with sanitize_text_field()
  * Sanitized post_content with wp_kses_post()
  * Validated rating as integer in range (0-5)
  * Added error checking with is_wp_error()
  * Sanitized reviewer_name before database update

Phase 5: File Operations & Path Validation
- functions.php: Implemented safe file version retrieval
  * Added inf_get_asset_version() helper function
  * Checks file existence before filemtime() call
  * Falls back to theme version if file missing
  * Suppresses warnings with error control operator
  * Updated all asset enqueueing to use helper function

- functions.php: Added path traversal protection
  * Added regex validation in inf_load_blocks(): /^[a-z0-9\-]+$/
  * Prevents arbitrary path access via block names
  * Skips invalid block names safely
  * Uses helper function for all block file version retrieval

SECURITY IMPACT
- Prevents XSS attacks via unescaped user-controllable data
- Blocks CSRF attacks on AJAX endpoints
- Validates and sanitizes all user input
- Prevents path traversal vulnerabilities
- Improves error handling and graceful degradation

TESTING NOTES
- All escaping functions follow WordPress standards
- AJAX nonce must be included in frontend JavaScript calls
- Requires update to frontend code to send 'nonce' parameter
- File operations now fail gracefully with theme version fallback

FILES MODIFIED
- theme/header.php
- theme/inc/template_functions.php
- theme/searchform.php
- theme/templates/ppc-landing-page-matchup.php
- theme/inc/services/locations.php
- theme/inc/hooks.php
- theme/functions.php

RELATED ISSUES
Security audit identified 50+ vulnerabilities across XSS, CSRF, input sanitization,
and file operation categories.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@steinbachr steinbachr Awaiting requested review from steinbachr

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gabrielgpacheco