fix WordPress.Security.EscapeOutput.OutputNotEscaped errors

[masteradhoc]

Fixes #775

What?

Fixes WordPress Coding Standards (PHPCS) violations related to unescaped output in class-two-factor-core.php by properly escaping all localized and dynamic output.

Why?

The Two-Factor plugin was triggering WordPress.Security.EscapeOutput.OutputNotEscaped errors when running PHPCS. Several localized strings and formatted values (_n(), number_format_i18n(), human_time_diff(), and __()) were output directly without context-appropriate escaping. This violates WordPress security and coding standards and may block releases or CI checks.

How?

implement the correct escape functions

Testing Instructions

1. trigger plugin check on newest version of two-factor
2. apply changes
3. see if the OutputNotEscaped errors still show up

Changelog Entry

Fixed – Properly escaped localized output to comply with WordPress security and coding standards.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: masteradhoc <masteradhoc@git.wordpress.org>
Co-authored-by: kasparsd <kasparsd@git.wordpress.org>
Co-authored-by: sjinks <volodymyrkolesnykov@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[kasparsd]

It appears that WP core isn't passing these wp_die() strings through esc_html__() and use __() instead.

Should we keep it consistent with core?

[masteradhoc]

It appears that WP core isn't passing these wp_die() strings through esc_html__() and use __() instead.

Should we keep it consistent with core?

We use this a few times throughout the plugin. Shall we adjust all of this?

Then we'll probably have to add this as well ahead so we dont get the issues like #775 anymore.
// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped

[kasparsd]

@masteradhoc After reviewing the core implementation of _default_wp_die_handler() I feel like it is better to escape it and diverge from the core approach which appears to be trusting the translation strings.