PR Review: mhr-options-panel → fixes-release-2.4.1

1. Nonce Action String Mismatch — Save Will Fail

File: includes/settings/classes/class-ere-settings.php (line 45) + class-ere-settings-saver.php (line 31)

The nonce is created with action ere_save_settings but verified with action ere_save_settings_nonce. These must match or the save will always fail with a nonce verification error.

// In class-ere-settings.php (enqueue_assets):
'nonce' => wp_create_nonce( 'ere_save_settings' ),  // Action: ere_save_settings

// In class-ere-settings.php (render):
wp_nonce_field( 'ere_save_settings_nonce' );  // Action: ere_save_settings_nonce

// In class-ere-settings-saver.php:
check_ajax_referer( 'ere_save_settings_nonce', 'security' );  // Expects 'security' param

// In ere-settings.js:
formData += '&_wpnonce=' + formNonce;  // Sends as '_wpnonce', not 'security'

Fix: Use the same nonce action string everywhere. The JS must send the nonce as security (not _wpnonce) to match the saver's check_ajax_referer parameter.

2. Duplicate Function Declaration — ere_is_inspiry_membership_enabled

File: includes/functions/basic.php

The function ere_is_inspiry_membership_enabled() is defined twice with identical code. The function_exists() guard prevents a fatal error but this is dead code.

// First definition (correct)
if ( ! function_exists( 'ere_is_inspiry_membership_enabled' ) ) {
    function ere_is_inspiry_membership_enabled(): bool { ... }
}

// Second definition (DUPLICATE — remove this)
if ( ! function_exists( 'ere_is_inspiry_membership_enabled' ) ) {
    function ere_is_inspiry_membership_enabled(): bool { ... }  // ❌ Dead code
}

Fix: Delete the second duplicate definition.

3. Typo in Option Name — inspiry_respoeader_option

File: includes/settings/config-files/property/search.php

The name field contains a typo (respoeader) and doesn't match the id. This saves to the wrong wp_options key, breaking the Responsive Header Display setting.

'id'   => 'inspiry_respor_option',
'name' => 'inspiry_respoeader_option',  // ❌ Typo

Fix: Fix the name to match the intended option key (likely inspiry_responsive_header_option or match the id).

4. JavaScript Typo — preventDeefault()

File: js/ere-settings.js (line 396)

e.preventDeefault() has a double 'e'. This will throw a TypeError at runtime, completely breaking the click handler.

$( document ).on( 'click', '.ere-users-approval-filters a', function ( e ) {
    e.preventDeefault();  // ❌ TypeError: e.preventDeefault is not a function
    console.log( $( this ) );
} );

Fix: Change to e.preventDefault().

5. Unsanitized $_POST in settings-request-handler.php

File: includes/functions/settings-request-handler.php

Multiple direct $_POST accesses without wp_unslash() or proper sanitization. This is a WordPress VIP-level security requirement.

// ❌ No sanitization
update_option( 'rsl_settings', $_POST['rsl_settings'] );
update_option( 'ere_user_role_options', $_POST['user_role_options'] );
update_option( 'inspiry_user_sync', $_POST['ere_role_post_type_sync'] );
update_option( 'ere_forms_webhook_url', $_POST['ere_forms_webhook_url'] );

$inspiry_property_energy_classes = array_values( $_POST['inspiry_property_energy_classes'] );  // ❌

Fix: Every $_POST value must use wp_unslash() + type-appropriate sanitization (sanitize_text_field, sanitize_url, map_deep, etc.).

6. Generic Sanitization in ERE_Settings_Saver

File: includes/settings/classes/class-ere-settings-saver.php

sanitize_text_field() is used as a blanket fallback for ALL field types. This strips HTML from textarea fields, corrupts URLs, and mishandles color values.

// ❌ Current
return sanitize_text_field( $value );

// ✅ Should be type-aware:
// textarea → wp_kses_post() or sanitize_textarea_field()
// url → esc_url_raw()
// email → sanitize_email()
// number → intval() / floatval()
// color → sanitize_hex_color()

Fix: Reference the field type from the config and apply the correct sanitizer per type.

7. HTML Syntax Errors in Callback — Stray ?>

File: includes/settings/callbacks/user-approval-management.php

Missing space before closing brackets produces broken HTML with stray ?> in class attributes.

Fix: Remove the stray ?> from class attribute values.

8. Toggle Field Rendering Bug — Extra Quote

File: includes/settings/classes/class-ere-settings.php (~line 1093)

The printf format string has an extra double-quote before %3$s, producing invalid HTML.

printf(
    '',
    //                                                      ↑ extra quote
);
// Outputs: value="1" "checked='checked' />  ← invalid HTML

Fix: Remove the extra double-quote: value="1" %3$s />.

9. XSS Risk — Raw AJAX Response Injected as HTML

File: js/ere-settings.js (line 434)

The raw AJAX response is directly inserted into the DOM as HTML without escaping, enabling potential XSS if the response contains user-controlled data.

// ❌ Direct HTML injection of response
$this.after( '' + response + '' );

// Also:
usersList.html( request.data );     // line 514
usersList.html( request.message );  // line 518

Fix: Use .text() instead of string concatenation, or sanitize the response before inserting.

10. console.log Left in Production JS

File: js/ere-settings.js (lines 397, 858)

Debug console.log() statements are left in production code at lines 397 and 858.

Fix: Remove both console.log statements.

11. Scripts/Styles Load on ALL Admin Pages

File: includes/settings/classes/class-ere-settings.php (line 19, 29)

enqueue_assets() hooks into admin_enqueue_scripts without checking the current screen. The JS and CSS load on every admin page, impacting performance.

Fix: Add a screen check: if ( get_current_screen()->id !== 'toplevel_page_ere-settings' ) return;

12. Missing Nonce in User Approval AJAX

File: js/ere-settings.js (line 424-437)

The update_user_approve_status AJAX call sends no nonce/security token. This is a CSRF vulnerability.

Fix: Add nonce: ereSettings.nonce to the AJAX data object and verify it server-side.

13. $_GET['tab'] Not Sanitized

File: includes/settings/classes/class-ere-settings.php

$_GET['tab'] is used without sanitize_key() or wp_unslash().

Fix: Use sanitize_key( wp_unslash( $_GET['tab'] ) ).

14. Commented-Out Dead Code

File: includes/settings/loader.php + includes/functions/settings-request-handler.php

Commented-out code left in production: //ERE_Settings_Config::load_configs_from_dir(...) and //add_action('wp_ajax_ere_save_settings',...)

Fix: Remove all commented-out code before merge.

15. sprintf Bug in Callback

File: includes/settings/callbacks/user-approval-management.php

sprintf($user->first_name, $user->last_name) uses first_name as format string with no specifiers, silently dropping last_name.

Fix: Change to: $user->first_name . ' ' . $user->last_name

16. echo ERE_VERSION Without Escaping

File: includes/settings/classes/class-ere-settings.php (line ~144)

echo ERE_VERSION; outputs without escaping. Per WPCS, all output must be escaped.

Fix: Use echo esc_html( ERE_VERSION );

17. Unescaped $condition_attr Echo

File: includes/settings/classes/class-ere-settings.php

echo $condition_attr; outputs the data-condition attribute without escaping. The phpcs:ignore comment acknowledges but doesn't fix it.

Fix: Consider using echo wp_kses_post( $condition_attr ); or restructure to avoid raw echo.

18. Dual Save Mechanism Confusion

File: includes/functions/settings-request-handler.php

Two save paths exist: ERE_Settings_Saver (new AJAX) and ere_ajax_save_settings() (old manual). The old hook is commented out but the function remains, creating confusion.

Fix: Either fully remove the old save function or clearly mark it as deprecated.

19. ucfirst() Output Not Escaped

File: includes/settings/callbacks/user-approval-management.php

echo ucfirst( $current_user_role ); outputs user role without esc_html().

Fix: Wrap in esc_html().

20. Missing File Newlines

File: loader.php, settings-request-handler.php

Files missing trailing newline per WPCS.

21. Short Array Syntax

File: class-ere-settings-saver.php

Uses [] instead of array() per WPCS.

22. Inconsistent Text Domain

File: class-ere-settings.php

Uses 'easy-real-estate' string instead of ERE_TEXT_DOMAIN constant.

23. Mixed Indentation

File: class-ere-settings.php

HTML output mixes tabs and spaces. WPCS requires tabs.

24. Missing @package Tags

File: Multiple new files

Several new files lack the standard @package Easy_Real_Estate PHPDoc tag.