Rock: Virtual Field (Lite)#2846
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds a new Pro field entry Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs). Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
 |
|
Overall Grade Focus Area: Security |
Security  Reliability  Complexity Hygiene |
Feedback
- No centralized input sanitization
- An unused sanitizer suggests validation was designed but not applied; the include path is built from unchecked data and reuses that gap. Consolidate sanitization/whitelisting into one entry point that every file/path input must pass.
- Dynamic file loading without a safe wrapper
- Includes are performed directly on variable data while helper logic sits idle, so risky patterns repeat. Encapsulate all include/load operations in a vetted helper that enforces canonical paths and a strict whitelist.
- Accumulated dead helpers obscure intent
- Private helpers left unused indicate feature drift: safety contracts live in abandoned code while unsafe code persists. Remove or reinstate those helpers and expose a small, well-documented API so intent survives maintenance.
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| PHP |  |
Mar 10, 2026 1:48p.m. | Review ↗ |
| JavaScript |  |
Mar 10, 2026 1:48p.m. | Review ↗ |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@classes/models/FrmField.php`:
- Around line 305-311: The 'virtual' field entry in FrmField.php has an
inconsistent leading slash in the 'learn-more' value which will produce a bad
URL when concatenated; update the 'virtual' => [...] array's 'learn-more' value
to remove the leading slash (change '/virtual' to 'virtual') so it matches other
entries and generates correct relative URLs for links.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #2846 +/- ##
============================================
+ Coverage 26.60% 26.68% +0.07%
- Complexity 8867 8883 +16
============================================
Files 145 145
Lines 29822 29939 +117
============================================
+ Hits 7934 7989 +55
- Misses 21888 21950 +62 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
🧹 Nitpick comments (1)
classes/helpers/FrmEntriesHelper.php (1)
452-467: Consider documenting the unsanitized return value now that the method is public.The implementation is intentionally unsanitized (callers are responsible for sanitizing, as both internal call-sites already do). While that contract was implicit and risk-free when the method was
private, promoting it topublicwidens the API surface to any external caller (e.g., the Pro plugin). Without a docblock note, a new caller could easily forget to sanitize.✏️ Suggested docblock update
/** * `@since` 4.02.04 * * `@param` int|string $field_id Field ID. * `@param` array $args Additional arguments. * - * `@return` mixed + * `@return` mixed Raw, unsanitized value from $_POST. Callers must sanitize before use. */ public static function get_posted_meta( $field_id, $args ) {🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@classes/helpers/FrmEntriesHelper.php` around lines 452 - 467, Update the public method get_posted_meta to document that it returns unsanitized input pulled directly from $_POST and that callers (including external users) are responsible for validation/sanitization; update the docblock above get_posted_meta to explicitly state the contract (e.g., mention that returned value may be raw/untrusted, callers must sanitize/validate), include `@param` tags for $field_id and $args if missing, and make sure `@return` describes the mixed raw data type and the `@since` tag remains accurate.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@classes/helpers/FrmEntriesHelper.php`:
- Around line 452-467: Update the public method get_posted_meta to document that
it returns unsanitized input pulled directly from $_POST and that callers
(including external users) are responsible for validation/sanitization; update
the docblock above get_posted_meta to explicitly state the contract (e.g.,
mention that returned value may be raw/untrusted, callers must
sanitize/validate), include `@param` tags for $field_id and $args if missing, and
make sure `@return` describes the mixed raw data type and the `@since` tag remains
accurate.
There was a problem hiding this comment.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In `@classes/models/FrmField.php`:
- Line 310: The 'learn-more' array value in FrmField.php includes an
inconsistent leading slash ('/virtual'); update the array entry for the
'learn-more' key to remove the leading slash so it matches the other entries
(i.e., change '/virtual' to 'virtual') in the same array inside the FrmField
class or method that defines these URL fragments.
… addon name support
…pgrade modal title prefix when needed
…or from upgrade modal styles
…for text restoration
…t to "require an update" for update modals
|
@Crabcyborg I've added the new Update Modal feature, and it works for the virtual field as shown in the GIF below:
|
Rock: Virtual Field (Lite)
2 participants
Pro PR
Handoff
https://linear.app/strategy11/document/handoff-0819be205304
Screen recording demo
https://share.cleanshot.com/NL9qnGkq
Summary by CodeRabbit
New Features
Performance
Chores