Compatibility with WordPress Plugin Check by PGeorgiev · Pull Request #7 · DevriX/Easy-Image-Gallery

PGeorgiev · 2026-03-23T10:30:55Z

We have fixed a number of Plugin Check feedbacks and covered some vulnerability issues:
Asana task - Easy Image Gallery: Closure Notice - Security: Easy Image Gallery

Fixed vulnerability report
Works just fine with WordPress 6.9.4 and 7.0 (beta versions)
Fixed prettyPhoto issues with jumping window

Copilot

Pull request overview

This PR updates the Easy Image Gallery plugin to address WordPress Plugin Check feedback and improve security hardening/escaping, alongside a version bump for the next release.

Changes:

Bump plugin version/stable tag to 1.5.4 and update readme compatibility/changelog.
Harden admin settings + metabox saving via wp_unslash() + map_deep() sanitization and improved capability/nonce checks.
Improve output escaping and inline script handling (e.g., wp_rand(), esc_attr() for classes, wp_print_inline_script_tag()).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
readme.txt	Updates tested/stable versions and adds 1.5.4 changelog entry.
easy-image-gallery.php	Bumps plugin header version to 1.5.4.
includes/view/admin-page-view.php	Sanitizes option saving and improves escaping in admin settings UI.
includes/template-functions.php	Uses `wp_rand()`, improves escaping, and adjusts luminous init output.
includes/scripts.php	Changes Gutenberg lightbox asset enqueuing and prints inline JS via `wp_print_inline_script_tag()`.
includes/metabox.php	Improves escaping, uses `wp_rand()`, and tightens save handler validation.
includes/gutenberg-block/src/init.php	Adds shared asset versioning and sets explicit enqueue versions/media.
includes/admin-page.php	Renames the admin menu registration function for clarity.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-23T10:35:10Z

includes/scripts.php

+	wp_enqueue_script('repeatable-fields',EASY_IMAGE_GALLERY_URL . 'includes/lib/repeatable-fields.js',array( 'jquery', 'jquery-ui-core' ),EASY_IMAGE_GALLERY_VERSION,false);
+	wp_enqueue_style('easy_image_gallery_admin_css',EASY_IMAGE_GALLERY_URL . 'includes/css/easy-image-gallery-admin.css',array(),EASY_IMAGE_GALLERY_VERSION);


The admin enqueue calls were reformatted into a single line without the spacing/argument wrapping used elsewhere in this file, which makes future maintenance harder and can conflict with PHPCS/WPCS if enforced. Consider formatting these calls consistently with the rest of includes/scripts.php.

Suggested change

wp_enqueue_script('repeatable-fields',EASY_IMAGE_GALLERY_URL . 'includes/lib/repeatable-fields.js',array( 'jquery', 'jquery-ui-core' ),EASY_IMAGE_GALLERY_VERSION,false);

wp_enqueue_style('easy_image_gallery_admin_css',EASY_IMAGE_GALLERY_URL . 'includes/css/easy-image-gallery-admin.css',array(),EASY_IMAGE_GALLERY_VERSION);

wp_enqueue_script(

'repeatable-fields',

EASY_IMAGE_GALLERY_URL . 'includes/lib/repeatable-fields.js',

array( 'jquery', 'jquery-ui-core' ),

EASY_IMAGE_GALLERY_VERSION,

false

);

wp_enqueue_style(

'easy_image_gallery_admin_css',

EASY_IMAGE_GALLERY_URL . 'includes/css/easy-image-gallery-admin.css',

array(),

EASY_IMAGE_GALLERY_VERSION

);

readme.txt

Copilot · 2026-03-23T10:35:11Z

readme.txt

 Requires at least: 3.5
-Tested up to: 6.8.3
-Stable tag: 1.5.3
+Tested up to: 6.9


The readme header was updated to "Tested up to: 6.9", but the changelog/PR description indicates testing against 6.9.4. WordPress.org typically expects the exact tested version here; consider updating the header to match the specific WP version you validated (e.g. 6.9.4) to avoid confusion during Plugin Check/review.

Suggested change

Tested up to: 6.9

Tested up to: 6.9.4

Copilot · 2026-03-23T10:35:11Z

includes/scripts.php

+			// CSS (empty src: use handle registered in easy_image_gallery_scripts()).
+			wp_enqueue_style(
+				$value,
+				'',
+				array(),
+				EASY_IMAGE_GALLERY_VERSION,
+				'screen'
+			);
+
+			// JS — explicit version so caches bust when the plugin updates.
+			wp_enqueue_script(
+				$value,
+				'',
+				array(),
+				EASY_IMAGE_GALLERY_VERSION,
+				true
+			);


The Gutenberg lightbox loop is calling wp_enqueue_style() / wp_enqueue_script() with an empty string for $src. In WordPress, passing a non-false $src causes the handle to be (re)registered, so this can overwrite the previously registered pretty-photo / fancybox / luminous handles with an empty URL and produce <link href=""> / <script src=""> tags (or otherwise break enqueuing). Enqueue the already-registered handles without providing $src, and only enqueue the asset type that actually exists for each handle (e.g. no CSS handle for luminous).

Suggested change

// CSS (empty src: use handle registered in easy_image_gallery_scripts()).

wp_enqueue_style(

$value,

'',

array(),

EASY_IMAGE_GALLERY_VERSION,

'screen'

);

// JS — explicit version so caches bust when the plugin updates.

wp_enqueue_script(

$value,

'',

array(),

EASY_IMAGE_GALLERY_VERSION,

true

);

// Enqueue already-registered handles without overriding their src.

if ( 'luminous' === $value ) {

// luminous has only a JS handle.

wp_enqueue_script( 'luminous' );

} else {

// pretty-photo, fancybox, etc. have both CSS and JS handles.

wp_enqueue_style( $value );

wp_enqueue_script( $value );

}

Copilot · 2026-03-23T10:35:12Z

includes/scripts.php

+					$js = apply_filters( 'easy_image_gallery_prettyphoto_js', $js );
+					if ( preg_match( '/<script\b[^>]*>(.*)<\/script>/is', $js, $matches ) ) {
+						$js = $matches[1];
+					}
+					wp_print_inline_script_tag( trim( $js ) );


easy_image_gallery_prettyphoto_js previously received/returned a full <script>...</script> block (because $js is built with script tags). The new regex extraction strips the first <script> wrapper and drops any script attributes or additional script tags a filter might add, which is a backward-incompatible change to the filter contract. Consider generating $js as raw JS (no <script> tags) before applying the filter, or only stripping when the output exactly matches the original wrapper format so filtered HTML isn't silently truncated.

Copilot · 2026-03-23T10:35:12Z

includes/scripts.php

+					if ( preg_match( '/<script\b[^>]*>(.*)<\/script>/is', $js, $matches ) ) {
+						$js = $matches[1];
+					}
+					wp_print_inline_script_tag( trim( $js ) );


Same issue as the prettyPhoto branch: easy_image_gallery_fancybox_js receives a full <script> block, but the new regex stripping + wp_print_inline_script_tag() will drop script attributes and can truncate output if the filter returns more than one <script> tag. Consider switching the buffer to raw JS before filtering, or add stricter handling so filtered output isn't unintentionally altered.

Suggested change

if ( preg_match( '/<script\b[^>]*>(.*)<\/script>/is', $js, $matches ) ) {

$js = $matches[1];

}

wp_print_inline_script_tag( trim( $js ) );

if ( preg_match_all( '/<script\b[^>]*>(.*?)<\/script>/is', $js, $matches ) && ! empty( $matches[1] ) ) {

$scripts = array();

foreach ( $matches[1] as $script_content ) {

$script_content = trim( $script_content );

if ( '' !== $script_content ) {

$scripts[] = $script_content;

}

}

if ( ! empty( $scripts ) ) {

$js = implode( "\n", $scripts );

} else {

$js = '';

}

}

$js = trim( $js );

if ( '' !== $js ) {

wp_print_inline_script_tag( $js );

}

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

lgadzhev · 2026-03-23T12:19:39Z

@PGeorgiev , can you review and resolve the suggestions by Copilot and request another review after that 🙏

PGeorgiev · 2026-03-24T11:59:08Z

Hey @lgadzhev,
I've added the new changes, can you please review when you have a chance? 🙏

PGeorgiev added 4 commits March 18, 2026 17:04

Fix: escaped a few functions part 1

598404f

Securiry: escaped more functions and updated version

20608ee

Security: Escaped functions, and more updates from Plugincheck

83ca466

Release version ready

b469bcf

PGeorgiev requested review from Copilot and devrixgit March 23, 2026 10:30

Copilot started reviewing on behalf of PGeorgiev March 23, 2026 10:31 View session

Copilot AI reviewed Mar 23, 2026

View reviewed changes

Apply suggestion from @Copilot

bdc9f78

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Fixed Review feedback

c7808f6

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Compatibility with WordPress Plugin Check#7

Compatibility with WordPress Plugin Check#7
PGeorgiev wants to merge 6 commits intomasterfrom
bugfix/plugincheck

PGeorgiev commented Mar 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

Copilot AI Mar 23, 2026

Uh oh!

lgadzhev commented Mar 23, 2026

Uh oh!

PGeorgiev commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		wp_enqueue_script('repeatable-fields',EASY_IMAGE_GALLERY_URL . 'includes/lib/repeatable-fields.js',array( 'jquery', 'jquery-ui-core' ),EASY_IMAGE_GALLERY_VERSION,false);
		wp_enqueue_style('easy_image_gallery_admin_css',EASY_IMAGE_GALLERY_URL . 'includes/css/easy-image-gallery-admin.css',array(),EASY_IMAGE_GALLERY_VERSION);

-					if ( preg_match( '/<script\b[^>]*>(.*)<\/script>/is', $js, $matches ) ) {
-						$js = $matches[1];
-					}
-					wp_print_inline_script_tag( trim( $js ) );
+					if ( preg_match_all( '/<script\b[^>]*>(.*?)<\/script>/is', $js, $matches ) && ! empty( $matches[1] ) ) {
+						$scripts = array();
+						foreach ( $matches[1] as $script_content ) {
+							$script_content = trim( $script_content );
+							if ( '' !== $script_content ) {
+								$scripts[] = $script_content;
+							}
+						}
+						if ( ! empty( $scripts ) ) {
+							$js = implode( "\n", $scripts );
+						} else {
+							$js = '';
+						}
+					}
+					$js = trim( $js );
+					if ( '' !== $js ) {
+						wp_print_inline_script_tag( $js );
+					}

Conversation

PGeorgiev commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

lgadzhev commented Mar 23, 2026

Uh oh!

PGeorgiev commented Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

PGeorgiev commented Mar 23, 2026 •

edited

Loading