Enhance security checks and improve I18N handling

.ai/README.md

@@ -0,0 +1,27 @@
+# .ai/ — Agent Context Directory
+
+This directory stores documentation and context generated or maintained by AI agents (Claude Code, etc.) during development work.
+
+## Purpose
+
+- **Deep-dive architecture docs** — detail too verbose for `CLAUDE.md`
+- **Investigation notes** — written while exploring complex features
+- **Feature context** — background and rationale for non-obvious design decisions
+
+This is NOT a replacement for code comments, git history, or `docs/`. It supplements `CLAUDE.md` with detail that would otherwise bloat it.
+
+> **Agents:** When you discover context worth preserving, write it here — not into `CLAUDE.md`. Reference the file from `CLAUDE.md` with a one-line pointer.
+
+## Structure
+
+```text
+.ai/
+  README.md       # This file — directory overview
+  security/       # Vulnerability reports and fix guidance (excluded from git)
+```
+
+## Rules for Agents
+
+- **Write here, not in `CLAUDE.md`** — keep CLAUDE.md as a concise rules + pointers file
+- **One file per topic** — don't append unrelated notes to an existing file
+- **This directory is excluded from distribution zips** — `.distignore` covers `.ai/` recursively

.distignore

@@ -19,6 +19,7 @@ composer.lock
 Gruntfile.js
 package.json
 package-lock.json
+pnpm-lock.yaml
 prepros.config
 phpunit.xml
 phpunit.xml.dist
@@ -38,3 +39,6 @@ src
 assets/img/card
 *.map
 assets/scss
+.ai/
+.claude/
+CLAUDE.md

.gitignore

@@ -8,5 +8,7 @@ node_modules/
 vendor/
 .vscode/
 .idea
+.claude/worktrees/
 package-lock.json
 pnpm-lock.yaml
+.ai/security/

CLAUDE.md

@@ -0,0 +1,78 @@
+# Disable Comments — Plugin Development Guide
+
+WordPress plugin by WPDeveloper. Allows administrators to globally disable comments by post type, with multisite network support.
+
+- **WordPress.org:** <https://wordpress.org/plugins/disable-comments/>
+- **Current version:** 2.6.2
+- **Main class:** `Disable_Comments` (singleton) in `disable-comments.php`
+
+---
+
+## Project Structure
+
+```text
+disable-comments.php          Main plugin file (~2000 lines), single class
+includes/
+  cli.php                     WP-CLI command definitions
+  class-plugin-usage-tracker.php
+views/
+  settings.php                Main settings page shell
+  comments.php                Tools/delete page shell
+  partials/
+    _disable.php              Disable-comments form (main settings form)
+    _delete.php               Delete comments form
+    _sites.php                Multisite sub-site list
+    _menu.php / _footer.php / _sidebar.php
+assets/
+  js/disable-comments-settings-scripts.js   Settings page JS (role exclusion UI, AJAX calls)
+  js/disable-comments.js
+  css/ scss/
+tests/
+  test-plugin.php             PHPUnit tests (Brain/Monkey mocking)
+  bootstrap.php
+```
+
+---
+
+## Key AJAX Handlers
+
+All three AJAX handlers are registered in `__construct()` (~line 49):
+
+| Action | Handler | Line |
+| ------ | ------- | ---- |
+| `disable_comments_save_settings` | `disable_comments_settings()` | ~1217 |
+| `disable_comments_delete_comments` | `delete_comments_settings()` | ~1324 |
+| `get_sub_sites` | `get_sub_sites()` | ~1157 |
+
+**Nonce:** All handlers verify nonce `disable_comments_save_settings`. The nonce is created in `admin_enqueue_scripts()` (~line 799) and exposed to JS as `disableCommentsObj._nonce`.
+
+**POST data parsing:** `get_form_array_escaped()` (~line 1202) reads `$_POST['data']` as a URL-encoded string, parses with `wp_parse_args()`, and sanitizes all values with `map_deep(..., 'sanitize_text_field')`.
+
+**Network admin flag:** `$formArray['is_network_admin']` comes from POST data and controls network-wide operations — always verify server-side capability before acting on it.
+
+---
+
+## Development
+
+```bash
+npm install        # Install JS build deps
+npm run build      # Compile JS/CSS via Grunt + Babel
+npm run release    # Build + generate .pot + package release
+```
+
+```bash
+composer install              # Install PHP dev deps (Brain/Monkey for tests)
+./vendor/bin/phpunit          # Run tests
+```
+
+**Linting:** `phpcs.ruleset.xml` is configured for WordPress Coding Standards.
+
+---
+
+## Architecture Notes
+
+- **Singleton pattern:** Always access via `Disable_Comments::get_instance()`.
+- **CLI support:** `includes/cli.php` calls the same handler methods with `$_args` to bypass nonce (expected for WP-CLI context; nonce bypass is gated on `$this->is_CLI`).
+- **Multisite vs single-site:** Plugin behaviour branches heavily on `$this->networkactive` (set in constructor) and `$this->sitewide_settings`.
+- **Database queries:** Use `$wpdb->prepare()` throughout `delete_comments()`. Safe against SQL injection.
+- **Input sanitization:** `get_form_array_escaped()` uses `wp_parse_args()` + `map_deep(sanitize_text_field)`.

assets/js/disable-comments-settings-scripts.js

@@ -432,7 +432,10 @@ jQuery(document).ready(function ($) {
 						}).map(function(val, index){
 							return val.id;
 						});
-						var text = "<b>" + _selectedOptions.join("</b>, <b>") + "</b>";
+						var escapedOptions = _selectedOptions.map(function(label) {
+							return $('<span>').text(label).html();
+						});
+						var text = "<b>" + escapedOptions.join("</b>, <b>") + "</b>";
 						excludedRoles.html(sprintf(__("Comments are visible to %s and <b>Logged out users</b>.", "disable-comments"), text));
 						includedRoles.text(__("No comments will be visible to other roles.", "disable-comments"));
 					}
@@ -441,7 +444,10 @@ jQuery(document).ready(function ($) {
 					var selectedOptionsLabels = selectedOptions.map(function(val, index){
 						return val.text;
 					});
-					var text = "<b>" + selectedOptionsLabels.join("</b>, <b>") + "</b>";
+					var escapedLabels = selectedOptionsLabels.map(function(label) {
+						return $('<span>').text(label).html();
+					});
+					var text = "<b>" + escapedLabels.join("</b>, <b>") + "</b>";
 					excludedRoles.html(sprintf(__("Comments are visible to %s.", "disable-comments"), text));
 					includedRoles.text(__("Other roles and logged out users won't see any comments.", "disable-comments"));
 				}

disable-comments.php

@@ -116,11 +116,7 @@ function __construct() {
 	}
 
 	public function is_network_admin() {
-		$sanitized_referer = isset($_SERVER['HTTP_REFERER']) ? sanitize_text_field(wp_unslash($_SERVER['HTTP_REFERER'])) : '';
-		if (is_network_admin() || !empty($sanitized_referer) && defined('DOING_AJAX') && DOING_AJAX && is_multisite() && preg_match('#^' . network_admin_url() . '#i', $sanitized_referer)) {
-			return true;
-		}
-		return false;
+		return is_network_admin();
 	}
 	/**
 	 * Enable CLI
@@ -829,7 +825,7 @@ public function discussion_notice() {
 			}
 
 			// translators: %s: disabled post types.
-			echo '<div class="notice notice-warning"><p>' . sprintf(esc_html__('Note: The <em>Disable Comments</em> plugin is currently active, and comments are completely disabled on: %s. Many of the settings below will not be applicable for those post types.', 'disable-comments'), implode(esc_html__(', ', 'disable-comments'), $names_escaped)) . '</p></div>';
+			echo '<div class="notice notice-warning"><p>' . sprintf(__('Note: The <em>Disable Comments</em> plugin is currently active, and comments are completely disabled on: %s. Many of the settings below will not be applicable for those post types.', 'disable-comments'), implode(__(', ', 'disable-comments'), $names_escaped)) . '</p></div>';
 		}
 	}
 
@@ -1119,7 +1115,7 @@ public function get_roles($selected) {
 		foreach ($editable_roles as $role => $details) {
 			$roles[] = [
 				"id" => esc_attr($role),
-				"text" => translate_user_role($details['name']),
+				"text" => esc_html(translate_user_role($details['name'])),
 				"selected" => in_array($role, (array) $selected),
 			];
 		}
@@ -1162,6 +1158,10 @@ public function get_sub_sites() {
 			wp_send_json(['data' => [], 'totalNumber' => 0]);
 		}
 
+		if (!current_user_can('manage_network_plugins') && !current_user_can('manage_options')) {
+			wp_send_json(['data' => [], 'totalNumber' => 0]);
+		}
+
 		$_sub_sites = [];
 		$type = isset($_GET['type']) ? sanitize_text_field(wp_unslash($_GET['type'])) : 'disabled';
 		$search = isset($_GET['search']) ? sanitize_text_field(wp_unslash($_GET['search'])) : '';
@@ -1219,6 +1219,11 @@ public function disable_comments_settings($_args = array()) {
 		if (($this->is_CLI && !empty($_args)) || wp_verify_nonce($nonce, 'disable_comments_save_settings')) {
 
 			$formArray = $this->get_form_array_escaped($_args);
+			$is_network_action = !empty($formArray['is_network_admin']) && $formArray['is_network_admin'] == '1';
+			$required_cap = $is_network_action ? 'manage_network_plugins' : 'manage_options';
+			if (!$this->is_CLI && !current_user_can($required_cap)) {
+				wp_send_json_error(['message' => __('Insufficient permissions.', 'disable-comments')]);
+			}
 
 			$old_options = $this->options;
 			$this->options = [];
@@ -1256,12 +1261,12 @@ public function disable_comments_settings($_args = array()) {
 				$this->options['extra_post_types'] = array_diff($extra_post_types, array_keys($post_types)); // Make sure we don't double up builtins.
 			}
 
-			if (isset($formArray['sitewide_settings'])) {
+			if ($is_network_action && isset($formArray['sitewide_settings'])) {
 				update_site_option('disable_comments_sitewide_settings', $formArray['sitewide_settings']);
 			}
 
 			if (isset($formArray['disable_avatar'])) {
-				if ($this->is_network_admin()) {
+				if ($is_network_action && current_user_can('manage_network_plugins')) {
 					if ($formArray['disable_avatar'] == '0' || $formArray['disable_avatar'] == '1') {
 						$sites = get_sites([
 							'number' => 0,
@@ -1329,6 +1334,14 @@ public function delete_comments_settings($_args = array()) {
 		if (($this->is_CLI && !empty($_args)) || wp_verify_nonce($nonce, 'disable_comments_save_settings')) {
 			$formArray = $this->get_form_array_escaped($_args);
 
+			if (!$this->is_CLI) {
+				$is_network_action = !empty($formArray['is_network_admin']) && $formArray['is_network_admin'] == '1';
+				$required_cap = $is_network_action ? 'manage_network_plugins' : 'manage_options';
+				if (!current_user_can($required_cap)) {
+					wp_send_json_error(['message' => __('Insufficient permissions.', 'disable-comments')]);
+				}
+			}
+
 			if (!empty($formArray['is_network_admin']) && function_exists('get_sites') && class_exists('WP_Site_Query')) {
 				$sites = get_sites([
 					'number' => 0,
@@ -1337,6 +1350,9 @@ public function delete_comments_settings($_args = array()) {
 				foreach ($sites as $blog_id) {
 					// $formArray['disabled_sites'] ids don't include "site_" prefix.
 					if (!empty($formArray['disabled_sites']) && !empty($formArray['disabled_sites']["site_$blog_id"])) {
+						if (!is_super_admin() && !is_user_member_of_blog(get_current_user_id(), $blog_id)) {
+							continue; // Skip sites the user doesn't belong to
+						}
 						switch_to_blog($blog_id);
 						$log = $this->delete_comments($_args);
 						restore_current_blog();
@@ -1850,7 +1866,7 @@ public function add_site_health_info($debug_info) {
 			),
 			'disabled_post_type_count' => array(
 				'label' => __('Disabled Post Types Count', 'disable-comments'),
-				'value' => sprintf('%d of %d', count($data['disabled_post_types']), $data['total_post_types']),
+				'value' => sprintf(__('%1$d of %2$d', 'disable-comments'), count($data['disabled_post_types']), $data['total_post_types']),
 			),
 			'disabled_post_types' => array(
 				'label' => __('Disabled Post Types', 'disable-comments'),