Trac Watcher: Escape admin output, tighten the props capability, and add tests

[obenland]

An escaping and tidy-up pass over the Trac Watcher admin screens, plus the test coverage the plugin was missing.

Escape output in the list table and reports

The props and message columns, and most of the reports, interpolated stored prop names, display names and profile URLs into HTML unescaped — in several cases alongside a sibling esc_attr() on the same value in the same sprintf().

The message column needed a little care rather than a blanket wrap: format_trac_markup() has already run the message through esc_html() by the time the props loop runs, so the prop is now escaped before it is matched against the message and before it is inserted. For ordinary alphanumeric prop names esc_html() is a no-op, so matching and highlighting are unchanged; names containing markup never matched before either.

Prop names also now go through sanitize_text_field() on save. That only helps new rows, so the output escaping is doing the real work.

Require edit_others_posts to alter props records

The save and reparse handlers, and the edit affordances in the props column, checked publish_posts. On the make sites o2 Posting Access grants that to every logged-in account that isn't a member of the blog, so it wasn't gating much. Editing props rewrites attribution on someone else's commit, which feeds the release credits and profile badges.

Viewing the screen still only needs edit_posts.

Before this deploys: anyone doing props wrangling without Editor on the make site loses write access unless the capability is granted to them first. The previous check was broad enough that the working set was never expressed as a role, so it isn't derivable from the repo.

Fix several PHP warnings

• create_tables() used $wpdb without importing it, so activation fatalled outright.
• import_revisions() passed shell_exec()'s return straight to simplexml_load_string(), which is null whenever the command can't run.
• The props cloud read $r->id and never set a slug, both of which wp_generate_tag_cloud() expects.
• The typos report rendered $c->display_name without selecting the column — the WHERE clause already referenced it.

Add a PHPUnit suite

Follows the layout the o2 Posting Access suite uses and runs off the same make wp-env config. Covers both branches that interpolate a stored prop name, that an ordinary prop is still matched and highlighted after the escaping change, that names are stripped on all three write paths, and that the edit affordances track the capability the handler enforces.

The handler's rejection paths call die() rather than wp_die(), so a refused request would take the runner down with it; what the capability gates is asserted from the rendering side instead.

environments/make/.wp-env.test.json picks up the plugin and defines WP_CORE_LATEST_RELEASE, which the reports page reads unguarded when choosing its default version filter.

Testing

• 13 tests, 23 assertions, green.
• Mutation-checked rather than just run: reverting each change individually fails the suite — props column escaping (3 failures), the message-column escaping order (2), sanitize_text_field() (3), and the capability (1). Three tests carry explicit guards against passing vacuously.
• Existing o2 Posting Access suite still passes (32 tests) against the shared config.
• Manually exercised on wp-env across all seven report views and all four props screens: no PHP notices, an unresolved prop containing markup renders inert, and an Author-role account can view the screen but sees no edit affordances and gets -1 from a direct POST.
• phpcs on the touched files drops from 160 to 118 pre-existing violations; nothing new introduced.

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props obenland.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.