phpcs-format.xml.dist

<?xml version="1.0"?>
<ruleset name="WP Register Columns (formatting)">
    <description>Formatting and style. Separate from the lint: a clean lint does not mean a clean format check.</description>

    <file>src</file>

    <arg name="extensions" value="php"/>
    <arg name="colors"/>
    <arg value="sp"/>

    <config name="installed_paths" value="vendor/wp-coding-standards/wpcs,vendor/phpcompatibility/php-compatibility,vendor/phpcompatibility/phpcompatibility-paragonie,vendor/phpcompatibility/phpcompatibility-wp,vendor/phpcsstandards/phpcsutils,vendor/phpcsstandards/phpcsextra"/>

    <rule ref="WordPress-Core">
        <exclude name="Universal.Arrays.DisallowShortArraySyntax"/>
        <exclude name="WordPress.PHP.YodaConditions"/>
        <exclude name="Generic.WhiteSpace.DisallowSpaceIndent"/>
        <exclude name="Generic.WhiteSpace.ScopeIndent"/>
        <exclude name="PEAR.Functions.FunctionCallSignature"/>
        <exclude name="Squiz.Commenting.FileComment"/>
        <exclude name="Universal.Operators.DisallowShortTernary"/>
        <exclude name="Generic.Formatting.MultipleStatementAlignment"/>
        <exclude name="WordPress.Arrays.MultipleStatementAlignment"/>

        <!--
            $object is the third parameter of render_column_content(), which
            four plugins implement. PHP does not reserve it as a variable name
            and WordPress core uses it itself; renaming it here would be a
            breaking change to the abstract's signature for no gain.
        -->
        <exclude name="Universal.NamingConventions.NoReservedKeywordParameterNames"/>
    </rule>

    <rule ref="WordPress.Security.EscapeOutput">
        <!--
            Every one of these echoes the return value of an EDD markup helper:
            EDD()->html->select(), ->product_dropdown(), ->date_field() and the
            rest. They return escaped HTML by design, and escaping the result
            again would print the tags instead of rendering the controls.
            Rendering EDD's own fields is what this library is for, so the
            exclusion is the whole file rather than a line list.
        -->
    </rule>


    <rule ref="WordPress.Files.FileName">
        <!--
            Off, not waived. This is a Composer library autoloaded by PSR-4,
            which requires the file to be named for the class it declares:
            Exporters.php. WordPress wants class-exporters.php. The two rules
            are mutually exclusive, and renaming the files to satisfy this one
            would stop the autoloader finding them at all.
        -->
        <exclude-pattern>*</exclude-pattern>
    </rule>


    <rule ref="WordPress.Security.EscapeOutput">
        <!--
            These echo the return value of a plugin's own display_callback.
            Column content is markup by contract; the whole point of the
            callback is to let a plugin return a link or a badge, and escaping
            it here would print the tags. Escaping is the callback's job, and
            the consuming plugins do it.
        -->
        <exclude-pattern>src/Tables/*</exclude-pattern>
    </rule>

    <rule ref="WordPress.Security.NonceVerification">
        <!--
            Reads `order` and `orderby` out of the query string to work out how
            the list table is sorted, both through sanitize_key(). Nothing is
            written, and a sortable column header is a link, which carries no
            nonce.
        -->
        <exclude-pattern>src/Traits/Request.php</exclude-pattern>
    </rule>

    <rule ref="WordPress.DB.SlowDBQuery">
        <!--
            "meta_key" here is a key in this library's own column config array,
            describing which meta a column reads. It is not a query argument,
            and the sniff has no way to tell the difference.
        -->
        <exclude-pattern>src/Abstracts/Columns.php</exclude-pattern>
        <exclude-pattern>src/Tables/*.php</exclude-pattern>

        <!--
            And the filters, where tax_query and meta_query are the whole
            point: filtering a list table by a term or a meta value is what
            the library is for, and there is no cheaper query that does it.
        -->
        <exclude-pattern>src/Filters/*.php</exclude-pattern>
    </rule>

    <rule ref="WordPress.Security.NonceVerification">
        <!--
            A list filter is read from the query string, which is how every
            list table in WordPress carries its own state: core reads orderby,
            paged and s the same way and without a nonce. A GET navigation to
            a filtered view has no nonce to check, nothing here writes, and
            every value is sanitized at the point of read.
        -->
        <exclude-pattern>src/Filters/*.php</exclude-pattern>
        <exclude-pattern>src/Abstracts/ListFilters.php</exclude-pattern>

        <!--
            And the bulk-action notice, which reads back the query args its
            own redirect just set. The action itself was nonce-checked by
            core before handle_bulk_actions- fired; this is only what to say
            about it afterwards, and every value is sanitized on read and
            escaped on output.
        -->
        <exclude-pattern>src/Abstracts/BulkActions.php</exclude-pattern>
    </rule>

</ruleset>