45 lines
2.4 KiB
Markdown
45 lines
2.4 KiB
Markdown
# Woo Guard — Review Checklist
|
||
|
||
Structured walk for review mode. First sweep the security floor on the same files — output escaping, unslash-then-sanitize on request data, capability plus nonce on state changes, prepared queries — money code gets zero security slack (wp-guard covers the full WordPress layer when installed). Cite file:line.
|
||
|
||
## Contents
|
||
|
||
- Pass 1: HPOS and CRUD greps
|
||
- Pass 2: Checkout and money
|
||
- Pass 3: Runtime context
|
||
- Pass 4: Compatibility and packaging
|
||
- Reporting
|
||
|
||
## Pass 1: HPOS and CRUD greps (must fix)
|
||
|
||
Run the violation table in [hpos-and-crud.md](hpos-and-crud.md):
|
||
|
||
- `get_post_meta` / `update_post_meta` / `wp_update_post` touching order or product IDs
|
||
- `post_type => 'shop_order'` in any query; `$wpdb` joins on postmeta for order data
|
||
- Meta changes without a following `save()`
|
||
- Stock or order status set by meta/post-field writes instead of `wc_update_product_stock()` / `$order->update_status()`
|
||
- Unbounded `wc_get_orders()` / product queries (no `limit`)
|
||
|
||
## Pass 2: Checkout and money (must fix)
|
||
|
||
- Checkout rules enforced server-side (`woocommerce_checkout_process` or Store API schema)? JS-only validation is a finding.
|
||
- Which checkout does the code target — and does that match what it claims to support?
|
||
- Money: `wc_format_decimal()` on inputs, `wc_price()` on display, store rounding on totals; flag float arithmetic, `number_format()`, hardcoded symbols, float `==`.
|
||
- Webhook/gateway callbacks: signature verified before order access? Idempotent on retries?
|
||
|
||
## Pass 3: Runtime context (should fix)
|
||
|
||
- `WC()->cart` / `WC()->session` / `WC()->customer` reachable from REST, cron, CLI, or webhooks without guards?
|
||
- `woocommerce_*` hooks and `wc_*` functions verified to exist in the supported version range?
|
||
- WooCommerce-active checks before hooking (`class_exists` / feature checks)?
|
||
|
||
## Pass 4: Compatibility and packaging (should fix)
|
||
|
||
- `FeaturesUtil` declarations present and truthful (`custom_order_tables`, `cart_checkout_blocks`)?
|
||
- Template overrides shipped inside the plugin? (Always a finding — hooks or `woocommerce_locate_template`.)
|
||
- Background/batch work on Action Scheduler, idempotent handlers?
|
||
|
||
## Reporting
|
||
|
||
Use the SKILL.md format (What / Risk / Fix). Lead with Pass 1–2 findings and an overall verdict (merge / fix first / do not merge). Note explicitly when security-floor findings exist on the same files so the user sees the full bill at once.
|