fix phpcs

includes/collection/class-follow-requests.php

@@ -39,14 +39,16 @@ class Follow_Requests {
 				 WHERE follow_request.post_type = 'ap_follow_request'
 				 AND meta.meta_key = 'activitypub_user_id'
 				 AND meta.meta_value = %s
-				 ORDER BY {$orderby} {$order}
+				 ORDER BY %s %s
 				 LIMIT %d OFFSET %d",
+				$orderby,
+				$order,
 				$user_id,
 				$per_page,
 				0
 			)
 		);
-		$total_items = $wpdb->get_var("SELECT FOUND_ROWS()");
+		$total_items = $wpdb->get_var( 'SELECT FOUND_ROWS()' );
 
 		return compact( 'follow_requests', 'total_items' );
 	}

includes/handler/class-follow.php

@@ -63,7 +63,6 @@ class Follow {
 		if ( ! $user->get_manually_approves_followers() ) {
 			$follow_request->approve();
 		}
-	
 	}
 
 	/**

includes/model/class-follow-request.php

@@ -105,7 +105,7 @@ class Follow_Request extends Base_Object {
 		}
 		$post = get_post( $id );
 
-		$follow_request = new static;
+		$follow_request = new static();
 		$follow_request->set_id( $post->guid );
 		$follow_request->set__id( $post->ID );
 		$follow_request->set_type( 'Follow' );
@@ -133,12 +133,11 @@ class Follow_Request extends Base_Object {
 			'post_status'  => 'pending',
 			'post_parent'  => $follower_id,
 			'meta_input'   => $meta_input,
-			'mime_type'    => 'text/plain'
+			'mime_type'    => 'text/plain',
 		);
 
 		$post_id = wp_insert_post( $args );
 
-
 		return self::from_wp_id( $post_id );
 	}
 

includes/table/class-follow-requests.php

@@ -179,21 +179,30 @@ class Follow_Requests extends WP_List_Table {
 	}
 
 	public function ajax_response() {
-		$follow_action = $_REQUEST['follow_action'];
+		global $_REQUEST;
-		$id = $_REQUEST['follow_request'];
+		$follow_action = isset( $_REQUEST['follow_action'] ) ? sanitize_title( wp_unslash( $_REQUEST['follow_action'] ) ) : null;
-		wp_verify_nonce( $_REQUEST['_wpnonce'], "activitypub_{$follow_action}_follow_request" );
+		$follow_request_id = isset( $_REQUEST['follow_request'] ) ? (int) $_REQUEST['follow_request'] : null;
-		$follow_request = Follow_Request::from_wp_id( $id );
+		$wp_nonce   = isset( $_REQUEST['_wpnonce'] ) ? (int) $_REQUEST['_wpnonce'] : null;
+		if ( ! $follow_action || ! $follow_request_id || ! $wp_nonce ) {
+			return;
+		}
+		wp_verify_nonce( $wp_nonce, "activitypub_{$follow_action}_follow_request" );
+		$follow_request = Follow_Request::from_wp_id( $follow_request_id );
+
 		if ( $follow_request->can_handle_follow_request() ) {
 			switch ( $follow_action ) {
 				case 'approve':
 					$follow_request->approve();
 					wp_die( 'approved' );
+					break;
 				case 'reject':
 					$follow_request->reject();
 					wp_die( 'rejected' );
+					break;
 				case 'delete':
 					$follow_request->delete();
 					wp_die( 'deleted' );
+					break;
 			}
 		}
 		return;
@@ -214,10 +223,24 @@ class Follow_Requests extends WP_List_Table {
 		} else {
 			$type = 'hidden';
 		}
+		switch ( $follow_action ) {
+			case 'approve':
+				$follow_action_text = __( 'Approve', 'activitypub' );
+				break;
+			case 'delete':
+				$follow_action_text = __( 'Delete', 'activitypub' );
+				break;
+			case 'reject':
+				$follow_action_text = __( 'Reject', 'activitypub' );
+				break;
+			default:
+				return;
+		}
+
 		printf(
 			'<input type="%s" class="button" value="%s" data-action="%s">',
 			esc_attr( $type ),
-			esc_attr__( ucfirst( $follow_action ), 'activitypub' ),
+			esc_attr( $follow_action_text ),
 			esc_url( $url )
 		);
 	}