CodeRabbit

The import statement for 'scss/collapse' has been added. Ensure that the file 'collapse.scss' exists in the 'scss' directory and it doesn't contain any syntax errors or undefined variables/mixins. If there are dependencies between SCSS files, make sure they are imported in the correct order.

+ @import 'scss/collapse';

CodeRabbit

The CSS changes for responsive design look good. However, there are comments indicating that there should be styles applied to .single-tour-operator within the @media (max-width: 768px) query, but no styles are present. If these styles are not needed, consider removing the comments to avoid confusion.

-    /* Styling for the toggle button */
-    /* Styling for the SVG icons */
-    /* Collapsed state for the second wp-block-group */

If they are needed, please add the appropriate styles.

CodeRabbit

The commented-out code has been removed, which is a good practice for maintaining clean and readable code. However, please ensure that this removal does not affect any functionality or dependencies in the code.

- 	});*/
+ 	

CodeRabbit

The closing brackets and parentheses have been uncommented. This seems to be a correction of the previous state where it was mistakenly commented out. Please ensure that this change aligns with the intended structure of your JavaScript code.

-	});*/
+	});

CodeRabbit

The @phpcs:ignore directive is used to ignore the nonce verification check. However, it's important to note that ignoring this check can lead to potential security vulnerabilities as nonces are used in WordPress to prevent CSRF attacks. It would be better to verify the nonce before using the $_GET['post'] value.

- // @phpcs:ignore WordPress.Security.NonceVerification.Recommended
- if ( isset( $_GET['post'] ) && in_array( get_post_type( $_GET['post'] ), array( 'team', 'special', 'review', 'destination', 'accommodation', 'tour' ) ) ) {
+ if ( isset( $_GET['post'] ) && wp_verify_nonce($_REQUEST['_wpnonce'], 'my-nonce-action') && in_array( get_post_type( $_GET['post'] ), array( 'team', 'special', 'review', 'destination', 'accommodation', 'tour' ) ) ) {

CodeRabbit

Again, ignoring nonce verification checks can lead to potential security vulnerabilities. It's recommended to verify the nonce before using the $_POST['tagline'] value.

- // @phpcs:ignore WordPress.Security.NonceVerification.Recommended
- if ( isset( $_POST['tagline'] ) && ! empty( $_POST['tagline'] ) ) {
+ if ( isset( $_POST['tagline'] ) && wp_verify_nonce($_REQUEST['_wpnonce'], 'my-nonce-action') && ! empty( $_POST['tagline'] ) ) {

Please replace 'my-nonce-action' with the appropriate nonce action for your application.

CodeRabbit

There seems to be a misunderstanding in the use of $_GET and $_SERVER superglobals. The HTTP_USER_AGENT is not typically found in the $_GET array, but rather in the $_SERVER array. Also, it's important to validate and sanitize all user inputs, including those from $_SERVER['HTTP_USER_AGENT']. Here's how you can correct this:

- if ( isset( $_GET['debug_bot'] ) ) {
-     // @phpcs:ignore WordPress.Security.NonceVerification.Recommended
-     $user_agent = sanitize_text_field( wp_unslash( $_GET['debug_bot'] ) );
-     // @phpcs:ignore WordPress.Security.NonceVerification.Recommended
- } else if ( isset( $_GET['HTTP_USER_AGENT'] ) ) {
-     // @phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotValidated
-     $user_agent = sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) );
+ if ( isset( $_GET['debug_bot'] ) ) {
+     $user_agent = sanitize_text_field( wp_unslash( $_GET['debug_bot'] ) );
+ } else if ( isset( $_SERVER['HTTP_USER_AGENT'] ) ) {
+     $user_agent = sanitize_text_field( wp_unslash( $_SERVER['HTTP_USER_AGENT'] ) );
  }

Please note that ignoring PHPCS warnings related to nonce verification and input sanitization might lead to security vulnerabilities. It would be better to address these issues directly instead of suppressing the warnings.

CodeRabbit

The use of wpdb->prepare here is incorrect. The %s placeholder in the SQL query expects a string, but you're passing an array ($ids). This could lead to unexpected results or SQL errors. You should create a list of placeholders that matches the number of elements in $ids, and then use call_user_func_array to pass the parameters to wpdb->prepare.

Here's how you can do it:

- $ids = wp_unslash( sanitize_post_field( 'id', $ids, 0, 'db' ) );
+ $ids = array_map('intval', explode(',', wp_unslash( sanitize_text_field( $_POST['ids'] ) )));

- $query = "SELECT COUNT(ID)
-           FROM $wpdb->posts
-           WHERE 1=1
-           AND ID IN (%s)
-           AND post_status IN ('draft', 'publish')";
+ $placeholders = implode(', ', array_fill(0, count($ids), '%d'));
+ $query = $wpdb->prepare("SELECT COUNT(ID)
+           FROM $wpdb->posts
+           WHERE 1=1
+           AND ID IN ($placeholders)
+           AND post_status IN ('draft', 'publish')", ...$ids);

This way, each ID will be properly escaped, and the query will work as expected.

CodeRabbit

Note: This review was outside of the patch, so it was mapped to the patch with the greatest overlap. Original lines [98-111]

While it's good that you've added PHPCS ignore comments around the direct database query, it would be better to use WordPress's built-in functions for querying the database. This will make your code more maintainable and less prone to SQL injection attacks. Here's how you could rewrite this using get_posts:

- // phpcs:disable WordPress.DB -- Start ignoring
- $children = $wpdb->get_results(
- 	$wpdb->prepare(
- 		"SELECT ID
- 		FROM $wpdb->posts
- 		WHERE post_type = %s
- 		AND post_status = 'publish'
- 		AND post_parent = %d
- 		ORDER BY post_title ASC
- 		LIMIT 100",
- 		$post_type,
- 		$post_id
- 	)
- );
- // phpcs:enable -- Stop ignoring
+ $args = array(
+     'post_type' => $post_type,
+     'post_status' => 'publish',
+     'post_parent' => $post_id,
+     'orderby' => 'title',
+     'order' => 'ASC',
+     'numberposts' => 100,
+ );
+ $children = get_posts($args);

This way, you're leveraging WordPress's built-in functionality and reducing the risk of SQL injection.

CodeRabbit

The use of @phpcs:ignore is generally discouraged as it can lead to overlooking potential security issues. In this case, the $_GET['activate-multi'] parameter is not being sanitized before use which could lead to a potential security vulnerability. It would be better to sanitize the input using filter_input(INPUT_GET, 'activate-multi').

- // @phpcs:ignore WordPress.Security.NonceVerification.Recommended
- if ( ! is_network_admin() && ! isset( $_GET['activate-multi'] ) ) {
+ if ( ! is_network_admin() && ! isset( filter_input(INPUT_GET, 'activate-multi') ) ) {
    set_transient( '_tour_operators_flush_rewrite_rules', 1, 30 );
 }
- // @phpcs:ignore WordPress.Security.NonceVerification.Recommended
- if ( ! is_network_admin() && ! isset( $_GET['activate-multi'] ) ) {
+ if ( ! is_network_admin() && ! isset( filter_input(INPUT_GET, 'activate-multi') ) ) {
    set_transient( '_tour_operators_welcome_redirect', 1, 30 );
 }