Changeset 3649865

Timestamp:

08/16/2026 03:05:48 PM (2 months ago)

Author:

geralddrissner

Message:

Update to version 3.0.1 from GitHub

Location:

ai-image-disclosure-labels

Files:

• tags/3.0.1 (copied) (copied from ai-image-disclosure-labels/trunk )
• tags/3.0.1/RELEASE_AUDIT_3.0.0.md (deleted)
• tags/3.0.1/RELEASE_NOTES_3.0.0.md (deleted)
• tags/3.0.1/ai-image-disclosure-labels.php (modified) (2 diffs)
• tags/3.0.1/includes/class-gdaiidl-ai-analysis.php (modified) (18 diffs)
• tags/3.0.1/includes/class-gdaiidl-plugin.php (modified) (1 diff)
• tags/3.0.1/readme.txt (modified) (5 diffs)
• trunk/RELEASE_AUDIT_3.0.0.md (deleted)
• trunk/RELEASE_NOTES_3.0.0.md (deleted)
• trunk/ai-image-disclosure-labels.php (modified) (2 diffs)
• trunk/includes/class-gdaiidl-ai-analysis.php (modified) (18 diffs)
• trunk/includes/class-gdaiidl-plugin.php (modified) (1 diff)
• trunk/readme.txt (modified) (5 diffs)

ai-image-disclosure-labels/tags/3.0.1/ai-image-disclosure-labels.php

@@ -4 +4 @@
  * Plugin URI:        https://github.com/gerald-drissner/ai-image-disclosure-labels
  * Description:       Adds visible AI disclosure labels for images and videos, Media Library classification, optional machine-readable source data, and optional AI-assisted image analysis.
- * Version:           3.0.0
+ * Version:           3.0.1
  * Requires at least: 6.7
  * Requires PHP:      7.4
@@ -16 +16 @@
 defined( 'ABSPATH' ) || exit;
 
-define( 'GDAIIDL_VERSION', '3.0.0' );
+define( 'GDAIIDL_VERSION', '3.0.1' );
 define( 'GDAIIDL_FILE', __FILE__ );
 define( 'GDAIIDL_DIR', plugin_dir_path( __FILE__ ) );

ai-image-disclosure-labels/tags/3.0.1/includes/class-gdaiidl-ai-analysis.php

@@ -557 +557 @@
                                 <div>
                                         <p><?php esc_html_e( 'AI analysis is optional and off by default. When it runs, a temporary resized image and a short prompt leave your WordPress server and are processed by the provider you selected. Images can contain personal or confidential information, so review the provider’s current terms, privacy/data-use rules and regional requirements before enabling analysis.', 'ai-image-disclosure-labels' ); ?></p>
-                                        <ul>
-                                                <li><a href="https://openai.com/policies/" target="_blank" rel="noopener noreferrer">OpenAI terms &amp; policies</a></li>
-                                                <li><a href="https://ai.google.dev/gemini-api/terms" target="_blank" rel="noopener noreferrer">Google Gemini API terms</a></li>
-                                                <li><a href="https://privacy.anthropic.com/" target="_blank" rel="noopener noreferrer">Anthropic privacy &amp; commercial policy center</a></li>
-                                                <li><a href="https://www.cloudflare.com/policies/" target="_blank" rel="noopener noreferrer">Cloudflare policies</a></li>
-                                        </ul>
-                                        <p class="description"><?php esc_html_e( 'For an OpenAI-compatible or custom endpoint, you are responsible for reviewing and documenting that service’s own terms and privacy policy.', 'ai-image-disclosure-labels' ); ?></p>
+                                        <p class="description"><?php esc_html_e( 'The WordPress.org readme lists the current service, terms and privacy-policy links for the built-in providers. For an OpenAI-compatible or custom endpoint, you are responsible for reviewing and documenting that service’s own terms and privacy policy.', 'ai-image-disclosure-labels' ); ?></p>
                                 </div>
                         </details>
@@ -604 +598 @@
                                                 <li><?php esc_html_e( 'Optionally support action="models" for dynamic model/policy discovery and return usage or cost_usd when your router knows the real request cost.', 'ai-image-disclosure-labels' ); ?></li>
                                         </ol>
-                                        <p class="description"><a href="https://developers.cloudflare.com/workers-ai/configuration/bindings/" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Cloudflare: Workers AI bindings', 'ai-image-disclosure-labels' ); ?></a> · <a href="https://developers.cloudflare.com/workers/get-started/dashboard/" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Cloudflare: create a Worker in the dashboard', 'ai-image-disclosure-labels' ); ?></a></p>
+                                        <p class="description"><?php esc_html_e( 'Cloudflare’s current Workers AI and Worker setup documentation is listed in the WordPress.org readme together with the other external-service information.', 'ai-image-disclosure-labels' ); ?></p>
                                         <p><?php esc_html_e( 'For analysis, the plugin POSTs JSON containing action="analyze", the configured model/policy, a short classification prompt and a resized base64 image. Return the fields below. resolved_model, usage, cost_usd, pricing, evidence and verified_provenance are optional.', 'ai-image-disclosure-labels' ); ?></p>
                                         <pre class="gdaiidl-ai-contract">{
@@ -704 +698 @@
                                 <input type="password" name="<?php echo esc_attr( self::SECRET_OPTION . '[' . $key . ']' ); ?>" value="" autocomplete="new-password" placeholder="<?php echo esc_attr( $from_const ? __( 'Supplied by wp-config.php', 'ai-image-disclosure-labels' ) : ( $stored ? __( 'Saved – leave blank to keep', 'ai-image-disclosure-labels' ) : __( 'Paste secret here', 'ai-image-disclosure-labels' ) ) ); ?>" <?php disabled( $from_const ); ?>>
                                 <?php if ( $stored && ! $from_const ) : ?><small><label><input type="checkbox" name="<?php echo esc_attr( self::SECRET_OPTION . '[clear_' . $key . ']' ); ?>" value="1"> <?php esc_html_e( 'Remove saved key on Save Changes', 'ai-image-disclosure-labels' ); ?></label></small><?php endif; ?>
-                                <?php if ( $from_const ) : ?><small><?php echo esc_html( sprintf( __( 'Using constant %s.', 'ai-image-disclosure-labels' ), $constant ) ); ?></small><?php endif; ?>
+                                <?php if ( $from_const ) : ?>
+                                        <small>
+                                                <?php
+                                                /* translators: %s: wp-config.php constant name. */
+                                                echo esc_html( sprintf( __( 'Using constant %s.', 'ai-image-disclosure-labels' ), $constant ) );
+                                                ?>
+                                        </small>
+                                <?php endif; ?>
                         </label>
                 </div>
@@ -994 +995 @@
                 $count = absint( wp_unslash( $_GET['gdaiidl_analysis_processed'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
                 $job = isset( $_GET['gdaiidl_analysis_job'] ) ? sanitize_key( wp_unslash( $_GET['gdaiidl_analysis_job'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-                $message = $job ? sprintf( __( 'AI analysis queued for %d selected image(s). It will run in background batches.', 'ai-image-disclosure-labels' ), $count ) : sprintf( __( '%d selected image(s) processed.', 'ai-image-disclosure-labels' ), $count );
+                if ( $job ) {
+                        /* translators: %d: number of selected images queued for analysis. */
+                        $message = sprintf( __( 'AI analysis queued for %d selected image(s). It will run in background batches.', 'ai-image-disclosure-labels' ), $count );
+                } else {
+                        /* translators: %d: number of selected images processed. */
+                        $message = sprintf( __( '%d selected image(s) processed.', 'ai-image-disclosure-labels' ), $count );
+                }
                 echo '<div class="notice notice-success is-dismissible"><p>' . esc_html( $message ) . '</p></div>';
         }
@@ -1021 +1028 @@
          */
         public function ajax_fetch_models() {
-                $this->check_ajax_admin();
+                $request = $this->ajax_request();
                 $context = array(
-                        'provider'                   => isset( $_POST['provider'] ) ? sanitize_key( wp_unslash( $_POST['provider'] ) ) : '',
-                        'cloudflare_account_id'      => isset( $_POST['cloudflare_account_id'] ) ? sanitize_text_field( wp_unslash( $_POST['cloudflare_account_id'] ) ) : '',
-                        'custom_endpoint'            => isset( $_POST['custom_endpoint'] ) ? $this->sanitize_https_endpoint( wp_unslash( $_POST['custom_endpoint'] ) ) : '',
-                        'compatible_models_endpoint' => isset( $_POST['compatible_models_endpoint'] ) ? $this->sanitize_https_endpoint( wp_unslash( $_POST['compatible_models_endpoint'] ) ) : '',
+                        'provider'                   => $request['provider'],
+                        'cloudflare_account_id'      => $request['cloudflare_account_id'],
+                        'custom_endpoint'            => $request['custom_endpoint'],
+                        'compatible_models_endpoint' => $request['compatible_models_endpoint'],
                 );
                 $result = $this->fetch_models( $context, true );
@@ -1043 +1050 @@
          */
         public function ajax_test_model() {
-                $this->check_ajax_admin();
-                $provider = isset( $_POST['provider'] ) ? sanitize_key( wp_unslash( $_POST['provider'] ) ) : '';
-                $model    = isset( $_POST['model'] ) ? substr( sanitize_text_field( wp_unslash( $_POST['model'] ) ), 0, 220 ) : '';
+                $request  = $this->ajax_request();
+                $provider = $request['provider'];
+                $model    = $request['model'];
                 $providers = $this->providers();
                 if ( ! isset( $providers[ $provider ] ) || ( 'wordpress_ai_client' !== $provider && '' === trim( $model ) ) ) {
@@ -1055 +1062 @@
                                 'provider'                   => $provider,
                                 'model'                      => $model,
-                                'cloudflare_account_id'      => isset( $_POST['cloudflare_account_id'] ) ? substr( sanitize_text_field( wp_unslash( $_POST['cloudflare_account_id'] ) ), 0, 120 ) : '',
-                                'custom_endpoint'            => isset( $_POST['custom_endpoint'] ) ? $this->sanitize_https_endpoint( wp_unslash( $_POST['custom_endpoint'] ) ) : '',
-                                'compatible_endpoint'        => isset( $_POST['compatible_endpoint'] ) ? $this->sanitize_https_endpoint( wp_unslash( $_POST['compatible_endpoint'] ) ) : '',
-                                'compatible_models_endpoint' => isset( $_POST['compatible_models_endpoint'] ) ? $this->sanitize_https_endpoint( wp_unslash( $_POST['compatible_models_endpoint'] ) ) : '',
+                                'cloudflare_account_id'      => $request['cloudflare_account_id'],
+                                'custom_endpoint'            => $request['custom_endpoint'],
+                                'compatible_endpoint'        => $request['compatible_endpoint'],
+                                'compatible_models_endpoint' => $request['compatible_models_endpoint'],
                         ),
                         $this->settings()
@@ -1122 +1129 @@
         /** AJAX prepare job. */
         public function ajax_prepare_job() {
-                $this->check_ajax_admin();
-                $scope = isset( $_POST['scope'] ) ? sanitize_key( wp_unslash( $_POST['scope'] ) ) : '';
+                $request = $this->ajax_request();
+                $scope = $request['scope'];
                 if ( ! in_array( $scope, array( 'all', 'unclassified' ), true ) ) {
                         wp_send_json_error( array( 'message' => __( 'Invalid analysis scope.', 'ai-image-disclosure-labels' ) ), 400 );
@@ -1139 +1146 @@
         /** AJAX start job. */
         public function ajax_start_job() {
-                $this->check_ajax_admin();
-                $scope = isset( $_POST['scope'] ) ? sanitize_key( wp_unslash( $_POST['scope'] ) ) : '';
+                $request = $this->ajax_request();
+                $scope = $request['scope'];
                 if ( ! in_array( $scope, array( 'all', 'unclassified' ), true ) || ! $this->is_configured() ) {
                         wp_send_json_error( array( 'message' => __( 'Analysis is not fully configured.', 'ai-image-disclosure-labels' ) ), 400 );
@@ -1153 +1160 @@
         /** AJAX status. */
         public function ajax_job_status() {
-                $this->check_ajax_admin();
-                $job_id = isset( $_POST['job_id'] ) ? sanitize_key( wp_unslash( $_POST['job_id'] ) ) : '';
+                $request = $this->ajax_request();
+                $job_id = $request['job_id'];
                 wp_send_json_success( array( 'html' => $this->job_status_html( $job_id ), 'job' => $this->get_job( $job_id ) ) );
         }
@@ -1160 +1167 @@
         /** AJAX cancel. */
         public function ajax_cancel_job() {
-                $this->check_ajax_admin();
-                $job_id = isset( $_POST['job_id'] ) ? sanitize_key( wp_unslash( $_POST['job_id'] ) ) : '';
+                $request = $this->ajax_request();
+                $job_id = $request['job_id'];
                 $jobs = $this->jobs();
                 if ( isset( $jobs[ $job_id ] ) && in_array( $jobs[ $job_id ]['status'], array( 'queued', 'running' ), true ) ) {
@@ -1172 +1179 @@
 
         /**
-         * Check AJAX auth.
-         *
-         * @return void
-         */
-        private function check_ajax_admin() {
+         * Authenticate and sanitize an AI-admin AJAX request.
+         *
+         * Keeping nonce verification and input access in the same method makes the
+         * security boundary explicit to both reviewers and static analysis.
+         *
+         * @return array<string,string> Sanitized request values.
+         */
+        private function ajax_request() {
                 check_ajax_referer( 'gdaiidl_ai_admin', 'nonce' );
+
                 if ( ! current_user_can( $this->analysis_capability() ) ) {
                         wp_send_json_error( array( 'message' => __( 'You do not have permission to manage AI analysis.', 'ai-image-disclosure-labels' ) ), 403 );
                 }
+
+                $custom_endpoint = isset( $_POST['custom_endpoint'] )
+                        ? esc_url_raw( wp_unslash( $_POST['custom_endpoint'] ), array( 'https' ) )
+                        : '';
+                $compatible_endpoint = isset( $_POST['compatible_endpoint'] )
+                        ? esc_url_raw( wp_unslash( $_POST['compatible_endpoint'] ), array( 'https' ) )
+                        : '';
+                $compatible_models_endpoint = isset( $_POST['compatible_models_endpoint'] )
+                        ? esc_url_raw( wp_unslash( $_POST['compatible_models_endpoint'] ), array( 'https' ) )
+                        : '';
+
+                return array(
+                        'provider'                   => isset( $_POST['provider'] ) ? sanitize_key( wp_unslash( $_POST['provider'] ) ) : '',
+                        'model'                      => isset( $_POST['model'] ) ? substr( sanitize_text_field( wp_unslash( $_POST['model'] ) ), 0, 220 ) : '',
+                        'cloudflare_account_id'      => isset( $_POST['cloudflare_account_id'] ) ? substr( sanitize_text_field( wp_unslash( $_POST['cloudflare_account_id'] ) ), 0, 120 ) : '',
+                        'custom_endpoint'            => $this->sanitize_https_endpoint( $custom_endpoint ),
+                        'compatible_endpoint'        => $this->sanitize_https_endpoint( $compatible_endpoint ),
+                        'compatible_models_endpoint' => $this->sanitize_https_endpoint( $compatible_models_endpoint ),
+                        'scope'                      => isset( $_POST['scope'] ) ? sanitize_key( wp_unslash( $_POST['scope'] ) ) : '',
+                        'job_id'                     => isset( $_POST['job_id'] ) ? sanitize_key( wp_unslash( $_POST['job_id'] ) ) : '',
+                );
         }
 
@@ -1445 +1477 @@
         private function count_scope_images( $scope ) {
                 global $wpdb;
+                $image_mime_like = $wpdb->esc_like( 'image/' ) . '%';
+
                 if ( 'unclassified' === $scope ) {
-                        $sql = "SELECT COUNT(DISTINCT p.ID) FROM {$wpdb->posts} p LEFT JOIN {$wpdb->postmeta} pm ON (p.ID = pm.post_id AND pm.meta_key = %s) WHERE p.post_type = 'attachment' AND p.post_status <> 'trash' AND p.post_mime_type LIKE 'image/%%' AND (pm.meta_id IS NULL OR pm.meta_value = '' OR pm.meta_value NOT IN ('no-ai','generated','modified','edited','enhanced'))";
-                        return (int) $wpdb->get_var( $wpdb->prepare( $sql, GDAIIDL_Plugin::META_MEDIA_SOURCE_TYPE ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
-                }
-                $sql = "SELECT COUNT(ID) FROM {$wpdb->posts} WHERE post_type = 'attachment' AND post_status <> 'trash' AND post_mime_type LIKE 'image/%%'";
-                return (int) $wpdb->get_var( $sql ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
+                        $query = $wpdb->prepare(
+                                "SELECT COUNT(DISTINCT p.ID)
+                                FROM %i p
+                                LEFT JOIN %i pm ON (p.ID = pm.post_id AND pm.meta_key = %s)
+                                WHERE p.post_type = 'attachment'
+                                AND p.post_status <> 'trash'
+                                AND p.post_mime_type LIKE %s
+                                AND (pm.meta_id IS NULL OR pm.meta_value = '' OR pm.meta_value NOT IN ('no-ai','generated','modified','edited','enhanced'))",
+                                $wpdb->posts,
+                                $wpdb->postmeta,
+                                GDAIIDL_Plugin::META_MEDIA_SOURCE_TYPE,
+                                $image_mime_like
+                        );
+                        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared -- Query was prepared immediately above; admin-only background-job count is intentionally uncached.
+                        return (int) $wpdb->get_var( $query );
+                }
+
+                $query = $wpdb->prepare(
+                        "SELECT COUNT(ID)
+                        FROM %i
+                        WHERE post_type = 'attachment'
+                        AND post_status <> 'trash'
+                        AND post_mime_type LIKE %s",
+                        $wpdb->posts,
+                        'image/%'
+                );
+                // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared -- Query was prepared immediately above; admin-only background-job count is intentionally uncached.
+                return (int) $wpdb->get_var( $query );
         }
 
@@ -1463 +1520 @@
         private function query_scope_ids_after( $scope, $after_id, $limit ) {
                 global $wpdb;
-                $limit = max( 1, min( 50, (int) $limit ) );
-                $after_id = max( 0, (int) $after_id );
+                $limit           = max( 1, min( 50, (int) $limit ) );
+                $after_id        = max( 0, (int) $after_id );
+                $image_mime_like = $wpdb->esc_like( 'image/' ) . '%';
+
                 if ( 'unclassified' === $scope ) {
-                        $sql = "SELECT DISTINCT p.ID FROM {$wpdb->posts} p LEFT JOIN {$wpdb->postmeta} pm ON (p.ID = pm.post_id AND pm.meta_key = %s) WHERE p.post_type = 'attachment' AND p.post_status <> 'trash' AND p.post_mime_type LIKE 'image/%%' AND p.ID > %d AND (pm.meta_id IS NULL OR pm.meta_value = '' OR pm.meta_value NOT IN ('no-ai','generated','modified','edited','enhanced')) ORDER BY p.ID ASC LIMIT %d";
-                        $prepared = $wpdb->prepare( $sql, GDAIIDL_Plugin::META_MEDIA_SOURCE_TYPE, $after_id, $limit );
+                        $prepared = $wpdb->prepare(
+                                "SELECT DISTINCT p.ID
+                                FROM %i p
+                                LEFT JOIN %i pm ON (p.ID = pm.post_id AND pm.meta_key = %s)
+                                WHERE p.post_type = 'attachment'
+                                AND p.post_status <> 'trash'
+                                AND p.post_mime_type LIKE %s
+                                AND p.ID > %d
+                                AND (pm.meta_id IS NULL OR pm.meta_value = '' OR pm.meta_value NOT IN ('no-ai','generated','modified','edited','enhanced'))
+                                ORDER BY p.ID ASC
+                                LIMIT %d",
+                                $wpdb->posts,
+                                $wpdb->postmeta,
+                                GDAIIDL_Plugin::META_MEDIA_SOURCE_TYPE,
+                                $image_mime_like,
+                                $after_id,
+                                $limit
+                        );
                 } else {
-                        $sql = "SELECT ID FROM {$wpdb->posts} WHERE post_type = 'attachment' AND post_status <> 'trash' AND post_mime_type LIKE 'image/%%' AND ID > %d ORDER BY ID ASC LIMIT %d";
-                        $prepared = $wpdb->prepare( $sql, $after_id, $limit );
-                }
-                return array_map( 'absint', (array) $wpdb->get_col( $prepared ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
+                        $prepared = $wpdb->prepare(
+                                "SELECT ID
+                                FROM %i
+                                WHERE post_type = 'attachment'
+                                AND post_status <> 'trash'
+                                AND post_mime_type LIKE %s
+                                AND ID > %d
+                                ORDER BY ID ASC
+                                LIMIT %d",
+                                $wpdb->posts,
+                                $image_mime_like,
+                                $after_id,
+                                $limit
+                        );
+                }
+
+                // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared -- Query was prepared immediately above; cursor-based background-job query is intentionally uncached.
+                return array_map( 'absint', (array) $wpdb->get_col( $prepared ) );
         }
 
@@ -1571 +1660 @@
                 $saved = $editor->save( $tmp, 'image/jpeg' );
                 if ( is_wp_error( $saved ) || empty( $saved['path'] ) || ! is_readable( $saved['path'] ) ) {
-                        @unlink( $tmp ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                        wp_delete_file( $tmp );
                         return is_wp_error( $saved ) ? $saved : new WP_Error( 'gdaiidl_temp_failed', __( 'Could not write the temporary analysis image.', 'ai-image-disclosure-labels' ) );
                 }
@@ -1577 +1666 @@
                 $temp_size = @filesize( $saved['path'] ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- temporary file can disappear; handled below.
                 if ( false === $temp_size || $temp_size <= 0 || $temp_size > $max_bytes ) {
-                        @unlink( $saved['path'] ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                        wp_delete_file( $saved['path'] );
                         if ( $saved['path'] !== $tmp && file_exists( $tmp ) ) {
-                                @unlink( $tmp ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                                wp_delete_file( $tmp );
                         }
                         return new WP_Error( 'gdaiidl_temp_size', __( 'The temporary analysis image is unexpectedly large or unreadable.', 'ai-image-disclosure-labels' ) );
                 }
                 $data = file_get_contents( $saved['path'] ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- bounded temporary file.
-                @unlink( $saved['path'] ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                wp_delete_file( $saved['path'] );
                 if ( $saved['path'] !== $tmp && file_exists( $tmp ) ) {
-                        @unlink( $tmp ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                        wp_delete_file( $tmp );
                 }
                 if ( false === $data || '' === $data || strlen( $data ) > $max_bytes ) {
@@ -1651 +1740 @@
                 }
                 foreach ( $candidates as $candidate ) {
-                        if ( is_string( $candidate ) && '' !== trim( $candidate ) ) { return sprintf( __( 'Provider error %1$d: %2$s', 'ai-image-disclosure-labels' ), $code, sanitize_text_field( $candidate ) ); }
+                        if ( is_string( $candidate ) && '' !== trim( $candidate ) ) {
+                                /* translators: 1: HTTP/status code, 2: provider error message. */
+                                return sprintf( __( 'Provider error %1$d: %2$s', 'ai-image-disclosure-labels' ), $code, sanitize_text_field( $candidate ) );
+                        }
                 }
                 $raw = trim( wp_strip_all_tags( (string) $raw ) );
-                return sprintf( __( 'Provider returned HTTP %d.%s', 'ai-image-disclosure-labels' ), $code, '' !== $raw ? ' ' . substr( $raw, 0, 300 ) : '' );
+                /* translators: 1: HTTP status code, 2: optional provider response excerpt including its leading space. */
+                return sprintf( __( 'Provider returned HTTP %1$d.%2$s', 'ai-image-disclosure-labels' ), $code, '' !== $raw ? ' ' . substr( $raw, 0, 300 ) : '' );
         }
 
@@ -2417 +2510 @@
                 $status_labels = array( 'queued' => __( 'Queued', 'ai-image-disclosure-labels' ), 'running' => __( 'Running', 'ai-image-disclosure-labels' ), 'completed' => __( 'Completed', 'ai-image-disclosure-labels' ), 'cancelled' => __( 'Cancelled', 'ai-image-disclosure-labels' ), 'stopped_cost' => __( 'Stopped at cost limit', 'ai-image-disclosure-labels' ), 'stopped_config' => __( 'Stopped because settings changed', 'ai-image-disclosure-labels' ) );
                 $status = isset( $status_labels[ $job['status'] ] ) ? $status_labels[ $job['status'] ] : $job['status'];
-                $html = '<div class="gdaiidl-ai-job" data-job-id="' . esc_attr( $job_id ) . '"><p><strong>' . esc_html( $status ) . '</strong> · ' . esc_html( sprintf( __( '%1$d / %2$d images (%3$d%%)', 'ai-image-disclosure-labels' ), $processed, (int) $job['total'], $percent ) ) . '</p>';
+                /* translators: 1: processed image count, 2: total image count, 3: completion percentage. */
+                $progress_text = sprintf( __( '%1$d / %2$d images (%3$d%%)', 'ai-image-disclosure-labels' ), $processed, (int) $job['total'], $percent );
+                /* translators: 1: AI-generated count, 2: AI-modified count, 3: likely non-AI count, 4: uncertain count, 5: failed count. */
+                $result_text = sprintf( __( 'Generated: %1$d · Modified: %2$d · Likely non-AI: %3$d · Uncertain: %4$d · Failed: %5$d', 'ai-image-disclosure-labels' ), (int) $job['generated'], (int) $job['modified'], (int) $job['non_ai'], (int) $job['uncertain'], (int) $job['failed'] );
+                /* translators: 1: known or estimated US-dollar cost, 2: number of requests for which cost was unavailable. */
+                $cost_text = sprintf( __( 'Known/estimated cost recorded by the plugin: $%1$.6f · Requests with unknown cost: %2$d', 'ai-image-disclosure-labels' ), (float) $job['known_cost'], (int) $job['unknown_cost_count'] );
+
+                $html = '<div class="gdaiidl-ai-job" data-job-id="' . esc_attr( $job_id ) . '"><p><strong>' . esc_html( $status ) . '</strong> · ' . esc_html( $progress_text ) . '</p>';
                 $html .= '<div class="gdaiidl-ai-progress"><span style="width:' . esc_attr( $percent ) . '%"></span></div>';
-                $html .= '<p class="description">' . esc_html( sprintf( __( 'Generated: %1$d · Modified: %2$d · Likely non-AI: %3$d · Uncertain: %4$d · Failed: %5$d', 'ai-image-disclosure-labels' ), (int) $job['generated'], (int) $job['modified'], (int) $job['non_ai'], (int) $job['uncertain'], (int) $job['failed'] ) ) . '</p>';
-                $html .= '<p class="description">' . esc_html( sprintf( __( 'Known/estimated cost recorded by the plugin: $%1$.6f · Requests with unknown cost: %2$d', 'ai-image-disclosure-labels' ), (float) $job['known_cost'], (int) $job['unknown_cost_count'] ) ) . '</p>';
+                $html .= '<p class="description">' . esc_html( $result_text ) . '</p>';
+                $html .= '<p class="description">' . esc_html( $cost_text ) . '</p>';
                 if ( ! empty( $job['last_error'] ) ) { $html .= '<p class="description gdaiidl-ai-error">' . esc_html( $job['last_error'] ) . '</p>'; }
                 if ( in_array( $job['status'], array( 'queued', 'running' ), true ) ) { $html .= '<p><button type="button" class="button-link-delete gdaiidl-ai-cancel-job" data-job-id="' . esc_attr( $job_id ) . '">' . esc_html__( 'Cancel job', 'ai-image-disclosure-labels' ) . '</button></p>'; }

ai-image-disclosure-labels/tags/3.0.1/includes/class-gdaiidl-plugin.php

@@ -1028 +1028 @@
 
                 $settings = $this->settings();
-                $clauses  = array();
-                $values   = array();
-
-                if ( ! empty( $settings['enable_images'] ) ) {
-                        $clauses[] = '%i.post_mime_type LIKE %s';
-                        $values[]  = $wpdb->posts;
-                        $values[]  = $wpdb->esc_like( 'image/' ) . '%';
-                }
-
-                if ( ! empty( $settings['enable_videos'] ) ) {
-                        $clauses[] = '%i.post_mime_type LIKE %s';
-                        $values[]  = $wpdb->posts;
-                        $values[]  = $wpdb->esc_like( 'video/' ) . '%';
-                }
-
-                if ( empty( $clauses ) ) {
+                $images_enabled = ! empty( $settings['enable_images'] );
+                $videos_enabled = ! empty( $settings['enable_videos'] );
+
+                if ( ! $images_enabled && ! $videos_enabled ) {
                         return $where . ' AND 1=0';
                 }
 
-                return $where . $wpdb->prepare( ' AND ( ' . implode( ' OR ', $clauses ) . ' )', ...$values );
+                if ( $images_enabled && $videos_enabled ) {
+                        return $where . $wpdb->prepare(
+                                ' AND ( %i.post_mime_type LIKE %s OR %i.post_mime_type LIKE %s )',
+                                $wpdb->posts,
+                                $wpdb->esc_like( 'image/' ) . '%',
+                                $wpdb->posts,
+                                $wpdb->esc_like( 'video/' ) . '%'
+                        );
+                }
+
+                return $where . $wpdb->prepare(
+                        ' AND %i.post_mime_type LIKE %s',
+                        $wpdb->posts,
+                        $wpdb->esc_like( $images_enabled ? 'image/' : 'video/' ) . '%'
+                );
         }
 

ai-image-disclosure-labels/tags/3.0.1/readme.txt

@@ -6 +6 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 3.0.0
+Stable tag: 3.0.1
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -33 +33 @@
 * Media Library list tools: an AI status column, status filter and grouped bulk actions make it possible to classify many images and videos without opening them individually.
 * Optional automatic visible disclosures for AI-classified Media Library images and videos; this remains off by default.
-* Optional AI-assisted image analysis through the WordPress 7.0+ AI Client / configured Connectors when available, or directly through OpenAI, Google Gemini, Anthropic Claude, Cloudflare Workers AI, an OpenAI-compatible HTTPS endpoint, or a custom HTTPS analysis endpoint. Automated analysis remains image-only in 3.0.0; videos are classified manually.
+* Optional AI-assisted image analysis through the WordPress 7.0+ AI Client / configured Connectors when available, or directly through OpenAI, Google Gemini, Anthropic Claude, Cloudflare Workers AI, an OpenAI-compatible HTTPS endpoint, or a custom HTTPS analysis endpoint. Automated analysis remains image-only in the 3.0.x series; videos are classified manually.
 * Dynamic model discovery where the provider exposes a Models API or, in WordPress AI Client mode, through the configured AI provider registry; model names are never hard-coded and manual model/policy names remain supported.
 * Provider-independent custom HTTPS endpoint contract for Cloudflare Workers, AI Gateway, dedicated detectors and other future services.
@@ -133 +133 @@
 = Can the plugin automatically detect AI-generated images? =
 
-Version 3.0.0 can optionally ask a configured external vision-capable AI service to assess an image and store a suggestion such as "likely AI-generated", "likely AI-modified", "likely non-AI" or "uncertain". This is probabilistic analysis, not forensic proof. General vision models can be wrong; an absent watermark or a "likely non-AI" answer does not prove that no AI was used.
+Version 3.0.x can optionally ask a configured external vision-capable AI service to assess an image and store a suggestion such as "likely AI-generated", "likely AI-modified", "likely non-AI" or "uncertain". This is probabilistic analysis, not forensic proof. General vision models can be wrong; an absent watermark or a "likely non-AI" answer does not prove that no AI was used.
 The built-in direct-provider adapters perform visual analysis; they do not claim to cryptographically verify C2PA, SynthID or proprietary provider watermarks. If you operate a custom endpoint that performs genuine provenance/watermark verification, it can return `verified_provenance=true` and evidence labels. Automatic application of that stronger signal is a separate opt-in setting.
 
@@ -158 +158 @@
 = How are AI videos labelled? =
 
-For the core WordPress Video block, enable the AI disclosure in the block sidebar or classify the uploaded video in the Media Library and enable automatic Media Library labels. The disclosure appears immediately below the video, outside the playback surface. This avoids covering native controls and works with captions because it is inserted before the figure caption. Optional machine-readable output uses a Schema.org `VideoObject`. AI-assisted frame/video analysis is not included in 3.0.0.
+For the core WordPress Video block, enable the AI disclosure in the block sidebar or classify the uploaded video in the Media Library and enable automatic Media Library labels. The disclosure appears immediately below the video, outside the playback surface. This avoids covering native controls and works with captions because it is inserted before the figure caption. Optional machine-readable output uses a Schema.org `VideoObject`. AI-assisted frame/video analysis is not included in the 3.0.x series.
 
 = Does AI analysis send my images to another service? =
@@ -219 +219 @@
 
 == Changelog ==
+
+= 3.0.1 =
+* Release-hardening update following the official WordPress Plugin Check run for 3.0.0.
+* Consolidated AI-admin AJAX input handling so nonce verification, capability checks and sanitization are explicit in the same request boundary.
+* Replaced temporary-file `unlink()` calls with WordPress `wp_delete_file()`.
+* Reworked the Media Library MIME SQL filter to use fixed prepared query shapes instead of dynamically assembled placeholders.
+* Hardened background-job SQL preparation and documented the narrow, admin-only direct-query exceptions used for cursor-based library scans.
+* Added missing translator comments and ordered placeholders in translatable strings.
+* Removed remote documentation links from PHP-rendered admin markup; provider terms/privacy/service links remain clearly documented in `readme.txt`.
+* Updated the distribution ignore rules so GitHub-only release notes and audit documents are never included in the WordPress.org production ZIP.
 
 = 3.0.0 =

ai-image-disclosure-labels/trunk/ai-image-disclosure-labels.php

@@ -4 +4 @@
  * Plugin URI:        https://github.com/gerald-drissner/ai-image-disclosure-labels
  * Description:       Adds visible AI disclosure labels for images and videos, Media Library classification, optional machine-readable source data, and optional AI-assisted image analysis.
- * Version:           3.0.0
+ * Version:           3.0.1
  * Requires at least: 6.7
  * Requires PHP:      7.4
@@ -16 +16 @@
 defined( 'ABSPATH' ) || exit;
 
-define( 'GDAIIDL_VERSION', '3.0.0' );
+define( 'GDAIIDL_VERSION', '3.0.1' );
 define( 'GDAIIDL_FILE', __FILE__ );
 define( 'GDAIIDL_DIR', plugin_dir_path( __FILE__ ) );

ai-image-disclosure-labels/trunk/includes/class-gdaiidl-ai-analysis.php

@@ -557 +557 @@
                                 <div>
                                         <p><?php esc_html_e( 'AI analysis is optional and off by default. When it runs, a temporary resized image and a short prompt leave your WordPress server and are processed by the provider you selected. Images can contain personal or confidential information, so review the provider’s current terms, privacy/data-use rules and regional requirements before enabling analysis.', 'ai-image-disclosure-labels' ); ?></p>
-                                        <ul>
-                                                <li><a href="https://openai.com/policies/" target="_blank" rel="noopener noreferrer">OpenAI terms &amp; policies</a></li>
-                                                <li><a href="https://ai.google.dev/gemini-api/terms" target="_blank" rel="noopener noreferrer">Google Gemini API terms</a></li>
-                                                <li><a href="https://privacy.anthropic.com/" target="_blank" rel="noopener noreferrer">Anthropic privacy &amp; commercial policy center</a></li>
-                                                <li><a href="https://www.cloudflare.com/policies/" target="_blank" rel="noopener noreferrer">Cloudflare policies</a></li>
-                                        </ul>
-                                        <p class="description"><?php esc_html_e( 'For an OpenAI-compatible or custom endpoint, you are responsible for reviewing and documenting that service’s own terms and privacy policy.', 'ai-image-disclosure-labels' ); ?></p>
+                                        <p class="description"><?php esc_html_e( 'The WordPress.org readme lists the current service, terms and privacy-policy links for the built-in providers. For an OpenAI-compatible or custom endpoint, you are responsible for reviewing and documenting that service’s own terms and privacy policy.', 'ai-image-disclosure-labels' ); ?></p>
                                 </div>
                         </details>
@@ -604 +598 @@
                                                 <li><?php esc_html_e( 'Optionally support action="models" for dynamic model/policy discovery and return usage or cost_usd when your router knows the real request cost.', 'ai-image-disclosure-labels' ); ?></li>
                                         </ol>
-                                        <p class="description"><a href="https://developers.cloudflare.com/workers-ai/configuration/bindings/" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Cloudflare: Workers AI bindings', 'ai-image-disclosure-labels' ); ?></a> · <a href="https://developers.cloudflare.com/workers/get-started/dashboard/" target="_blank" rel="noopener noreferrer"><?php esc_html_e( 'Cloudflare: create a Worker in the dashboard', 'ai-image-disclosure-labels' ); ?></a></p>
+                                        <p class="description"><?php esc_html_e( 'Cloudflare’s current Workers AI and Worker setup documentation is listed in the WordPress.org readme together with the other external-service information.', 'ai-image-disclosure-labels' ); ?></p>
                                         <p><?php esc_html_e( 'For analysis, the plugin POSTs JSON containing action="analyze", the configured model/policy, a short classification prompt and a resized base64 image. Return the fields below. resolved_model, usage, cost_usd, pricing, evidence and verified_provenance are optional.', 'ai-image-disclosure-labels' ); ?></p>
                                         <pre class="gdaiidl-ai-contract">{
@@ -704 +698 @@
                                 <input type="password" name="<?php echo esc_attr( self::SECRET_OPTION . '[' . $key . ']' ); ?>" value="" autocomplete="new-password" placeholder="<?php echo esc_attr( $from_const ? __( 'Supplied by wp-config.php', 'ai-image-disclosure-labels' ) : ( $stored ? __( 'Saved – leave blank to keep', 'ai-image-disclosure-labels' ) : __( 'Paste secret here', 'ai-image-disclosure-labels' ) ) ); ?>" <?php disabled( $from_const ); ?>>
                                 <?php if ( $stored && ! $from_const ) : ?><small><label><input type="checkbox" name="<?php echo esc_attr( self::SECRET_OPTION . '[clear_' . $key . ']' ); ?>" value="1"> <?php esc_html_e( 'Remove saved key on Save Changes', 'ai-image-disclosure-labels' ); ?></label></small><?php endif; ?>
-                                <?php if ( $from_const ) : ?><small><?php echo esc_html( sprintf( __( 'Using constant %s.', 'ai-image-disclosure-labels' ), $constant ) ); ?></small><?php endif; ?>
+                                <?php if ( $from_const ) : ?>
+                                        <small>
+                                                <?php
+                                                /* translators: %s: wp-config.php constant name. */
+                                                echo esc_html( sprintf( __( 'Using constant %s.', 'ai-image-disclosure-labels' ), $constant ) );
+                                                ?>
+                                        </small>
+                                <?php endif; ?>
                         </label>
                 </div>
@@ -994 +995 @@
                 $count = absint( wp_unslash( $_GET['gdaiidl_analysis_processed'] ) ); // phpcs:ignore WordPress.Security.NonceVerification.Recommended
                 $job = isset( $_GET['gdaiidl_analysis_job'] ) ? sanitize_key( wp_unslash( $_GET['gdaiidl_analysis_job'] ) ) : ''; // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-                $message = $job ? sprintf( __( 'AI analysis queued for %d selected image(s). It will run in background batches.', 'ai-image-disclosure-labels' ), $count ) : sprintf( __( '%d selected image(s) processed.', 'ai-image-disclosure-labels' ), $count );
+                if ( $job ) {
+                        /* translators: %d: number of selected images queued for analysis. */
+                        $message = sprintf( __( 'AI analysis queued for %d selected image(s). It will run in background batches.', 'ai-image-disclosure-labels' ), $count );
+                } else {
+                        /* translators: %d: number of selected images processed. */
+                        $message = sprintf( __( '%d selected image(s) processed.', 'ai-image-disclosure-labels' ), $count );
+                }
                 echo '<div class="notice notice-success is-dismissible"><p>' . esc_html( $message ) . '</p></div>';
         }
@@ -1021 +1028 @@
          */
         public function ajax_fetch_models() {
-                $this->check_ajax_admin();
+                $request = $this->ajax_request();
                 $context = array(
-                        'provider'                   => isset( $_POST['provider'] ) ? sanitize_key( wp_unslash( $_POST['provider'] ) ) : '',
-                        'cloudflare_account_id'      => isset( $_POST['cloudflare_account_id'] ) ? sanitize_text_field( wp_unslash( $_POST['cloudflare_account_id'] ) ) : '',
-                        'custom_endpoint'            => isset( $_POST['custom_endpoint'] ) ? $this->sanitize_https_endpoint( wp_unslash( $_POST['custom_endpoint'] ) ) : '',
-                        'compatible_models_endpoint' => isset( $_POST['compatible_models_endpoint'] ) ? $this->sanitize_https_endpoint( wp_unslash( $_POST['compatible_models_endpoint'] ) ) : '',
+                        'provider'                   => $request['provider'],
+                        'cloudflare_account_id'      => $request['cloudflare_account_id'],
+                        'custom_endpoint'            => $request['custom_endpoint'],
+                        'compatible_models_endpoint' => $request['compatible_models_endpoint'],
                 );
                 $result = $this->fetch_models( $context, true );
@@ -1043 +1050 @@
          */
         public function ajax_test_model() {
-                $this->check_ajax_admin();
-                $provider = isset( $_POST['provider'] ) ? sanitize_key( wp_unslash( $_POST['provider'] ) ) : '';
-                $model    = isset( $_POST['model'] ) ? substr( sanitize_text_field( wp_unslash( $_POST['model'] ) ), 0, 220 ) : '';
+                $request  = $this->ajax_request();
+                $provider = $request['provider'];
+                $model    = $request['model'];
                 $providers = $this->providers();
                 if ( ! isset( $providers[ $provider ] ) || ( 'wordpress_ai_client' !== $provider && '' === trim( $model ) ) ) {
@@ -1055 +1062 @@
                                 'provider'                   => $provider,
                                 'model'                      => $model,
-                                'cloudflare_account_id'      => isset( $_POST['cloudflare_account_id'] ) ? substr( sanitize_text_field( wp_unslash( $_POST['cloudflare_account_id'] ) ), 0, 120 ) : '',
-                                'custom_endpoint'            => isset( $_POST['custom_endpoint'] ) ? $this->sanitize_https_endpoint( wp_unslash( $_POST['custom_endpoint'] ) ) : '',
-                                'compatible_endpoint'        => isset( $_POST['compatible_endpoint'] ) ? $this->sanitize_https_endpoint( wp_unslash( $_POST['compatible_endpoint'] ) ) : '',
-                                'compatible_models_endpoint' => isset( $_POST['compatible_models_endpoint'] ) ? $this->sanitize_https_endpoint( wp_unslash( $_POST['compatible_models_endpoint'] ) ) : '',
+                                'cloudflare_account_id'      => $request['cloudflare_account_id'],
+                                'custom_endpoint'            => $request['custom_endpoint'],
+                                'compatible_endpoint'        => $request['compatible_endpoint'],
+                                'compatible_models_endpoint' => $request['compatible_models_endpoint'],
                         ),
                         $this->settings()
@@ -1122 +1129 @@
         /** AJAX prepare job. */
         public function ajax_prepare_job() {
-                $this->check_ajax_admin();
-                $scope = isset( $_POST['scope'] ) ? sanitize_key( wp_unslash( $_POST['scope'] ) ) : '';
+                $request = $this->ajax_request();
+                $scope = $request['scope'];
                 if ( ! in_array( $scope, array( 'all', 'unclassified' ), true ) ) {
                         wp_send_json_error( array( 'message' => __( 'Invalid analysis scope.', 'ai-image-disclosure-labels' ) ), 400 );
@@ -1139 +1146 @@
         /** AJAX start job. */
         public function ajax_start_job() {
-                $this->check_ajax_admin();
-                $scope = isset( $_POST['scope'] ) ? sanitize_key( wp_unslash( $_POST['scope'] ) ) : '';
+                $request = $this->ajax_request();
+                $scope = $request['scope'];
                 if ( ! in_array( $scope, array( 'all', 'unclassified' ), true ) || ! $this->is_configured() ) {
                         wp_send_json_error( array( 'message' => __( 'Analysis is not fully configured.', 'ai-image-disclosure-labels' ) ), 400 );
@@ -1153 +1160 @@
         /** AJAX status. */
         public function ajax_job_status() {
-                $this->check_ajax_admin();
-                $job_id = isset( $_POST['job_id'] ) ? sanitize_key( wp_unslash( $_POST['job_id'] ) ) : '';
+                $request = $this->ajax_request();
+                $job_id = $request['job_id'];
                 wp_send_json_success( array( 'html' => $this->job_status_html( $job_id ), 'job' => $this->get_job( $job_id ) ) );
         }
@@ -1160 +1167 @@
         /** AJAX cancel. */
         public function ajax_cancel_job() {
-                $this->check_ajax_admin();
-                $job_id = isset( $_POST['job_id'] ) ? sanitize_key( wp_unslash( $_POST['job_id'] ) ) : '';
+                $request = $this->ajax_request();
+                $job_id = $request['job_id'];
                 $jobs = $this->jobs();
                 if ( isset( $jobs[ $job_id ] ) && in_array( $jobs[ $job_id ]['status'], array( 'queued', 'running' ), true ) ) {
@@ -1172 +1179 @@
 
         /**
-         * Check AJAX auth.
-         *
-         * @return void
-         */
-        private function check_ajax_admin() {
+         * Authenticate and sanitize an AI-admin AJAX request.
+         *
+         * Keeping nonce verification and input access in the same method makes the
+         * security boundary explicit to both reviewers and static analysis.
+         *
+         * @return array<string,string> Sanitized request values.
+         */
+        private function ajax_request() {
                 check_ajax_referer( 'gdaiidl_ai_admin', 'nonce' );
+
                 if ( ! current_user_can( $this->analysis_capability() ) ) {
                         wp_send_json_error( array( 'message' => __( 'You do not have permission to manage AI analysis.', 'ai-image-disclosure-labels' ) ), 403 );
                 }
+
+                $custom_endpoint = isset( $_POST['custom_endpoint'] )
+                        ? esc_url_raw( wp_unslash( $_POST['custom_endpoint'] ), array( 'https' ) )
+                        : '';
+                $compatible_endpoint = isset( $_POST['compatible_endpoint'] )
+                        ? esc_url_raw( wp_unslash( $_POST['compatible_endpoint'] ), array( 'https' ) )
+                        : '';
+                $compatible_models_endpoint = isset( $_POST['compatible_models_endpoint'] )
+                        ? esc_url_raw( wp_unslash( $_POST['compatible_models_endpoint'] ), array( 'https' ) )
+                        : '';
+
+                return array(
+                        'provider'                   => isset( $_POST['provider'] ) ? sanitize_key( wp_unslash( $_POST['provider'] ) ) : '',
+                        'model'                      => isset( $_POST['model'] ) ? substr( sanitize_text_field( wp_unslash( $_POST['model'] ) ), 0, 220 ) : '',
+                        'cloudflare_account_id'      => isset( $_POST['cloudflare_account_id'] ) ? substr( sanitize_text_field( wp_unslash( $_POST['cloudflare_account_id'] ) ), 0, 120 ) : '',
+                        'custom_endpoint'            => $this->sanitize_https_endpoint( $custom_endpoint ),
+                        'compatible_endpoint'        => $this->sanitize_https_endpoint( $compatible_endpoint ),
+                        'compatible_models_endpoint' => $this->sanitize_https_endpoint( $compatible_models_endpoint ),
+                        'scope'                      => isset( $_POST['scope'] ) ? sanitize_key( wp_unslash( $_POST['scope'] ) ) : '',
+                        'job_id'                     => isset( $_POST['job_id'] ) ? sanitize_key( wp_unslash( $_POST['job_id'] ) ) : '',
+                );
         }
 
@@ -1445 +1477 @@
         private function count_scope_images( $scope ) {
                 global $wpdb;
+                $image_mime_like = $wpdb->esc_like( 'image/' ) . '%';
+
                 if ( 'unclassified' === $scope ) {
-                        $sql = "SELECT COUNT(DISTINCT p.ID) FROM {$wpdb->posts} p LEFT JOIN {$wpdb->postmeta} pm ON (p.ID = pm.post_id AND pm.meta_key = %s) WHERE p.post_type = 'attachment' AND p.post_status <> 'trash' AND p.post_mime_type LIKE 'image/%%' AND (pm.meta_id IS NULL OR pm.meta_value = '' OR pm.meta_value NOT IN ('no-ai','generated','modified','edited','enhanced'))";
-                        return (int) $wpdb->get_var( $wpdb->prepare( $sql, GDAIIDL_Plugin::META_MEDIA_SOURCE_TYPE ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
-                }
-                $sql = "SELECT COUNT(ID) FROM {$wpdb->posts} WHERE post_type = 'attachment' AND post_status <> 'trash' AND post_mime_type LIKE 'image/%%'";
-                return (int) $wpdb->get_var( $sql ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
+                        $query = $wpdb->prepare(
+                                "SELECT COUNT(DISTINCT p.ID)
+                                FROM %i p
+                                LEFT JOIN %i pm ON (p.ID = pm.post_id AND pm.meta_key = %s)
+                                WHERE p.post_type = 'attachment'
+                                AND p.post_status <> 'trash'
+                                AND p.post_mime_type LIKE %s
+                                AND (pm.meta_id IS NULL OR pm.meta_value = '' OR pm.meta_value NOT IN ('no-ai','generated','modified','edited','enhanced'))",
+                                $wpdb->posts,
+                                $wpdb->postmeta,
+                                GDAIIDL_Plugin::META_MEDIA_SOURCE_TYPE,
+                                $image_mime_like
+                        );
+                        // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared -- Query was prepared immediately above; admin-only background-job count is intentionally uncached.
+                        return (int) $wpdb->get_var( $query );
+                }
+
+                $query = $wpdb->prepare(
+                        "SELECT COUNT(ID)
+                        FROM %i
+                        WHERE post_type = 'attachment'
+                        AND post_status <> 'trash'
+                        AND post_mime_type LIKE %s",
+                        $wpdb->posts,
+                        'image/%'
+                );
+                // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared -- Query was prepared immediately above; admin-only background-job count is intentionally uncached.
+                return (int) $wpdb->get_var( $query );
         }
 
@@ -1463 +1520 @@
         private function query_scope_ids_after( $scope, $after_id, $limit ) {
                 global $wpdb;
-                $limit = max( 1, min( 50, (int) $limit ) );
-                $after_id = max( 0, (int) $after_id );
+                $limit           = max( 1, min( 50, (int) $limit ) );
+                $after_id        = max( 0, (int) $after_id );
+                $image_mime_like = $wpdb->esc_like( 'image/' ) . '%';
+
                 if ( 'unclassified' === $scope ) {
-                        $sql = "SELECT DISTINCT p.ID FROM {$wpdb->posts} p LEFT JOIN {$wpdb->postmeta} pm ON (p.ID = pm.post_id AND pm.meta_key = %s) WHERE p.post_type = 'attachment' AND p.post_status <> 'trash' AND p.post_mime_type LIKE 'image/%%' AND p.ID > %d AND (pm.meta_id IS NULL OR pm.meta_value = '' OR pm.meta_value NOT IN ('no-ai','generated','modified','edited','enhanced')) ORDER BY p.ID ASC LIMIT %d";
-                        $prepared = $wpdb->prepare( $sql, GDAIIDL_Plugin::META_MEDIA_SOURCE_TYPE, $after_id, $limit );
+                        $prepared = $wpdb->prepare(
+                                "SELECT DISTINCT p.ID
+                                FROM %i p
+                                LEFT JOIN %i pm ON (p.ID = pm.post_id AND pm.meta_key = %s)
+                                WHERE p.post_type = 'attachment'
+                                AND p.post_status <> 'trash'
+                                AND p.post_mime_type LIKE %s
+                                AND p.ID > %d
+                                AND (pm.meta_id IS NULL OR pm.meta_value = '' OR pm.meta_value NOT IN ('no-ai','generated','modified','edited','enhanced'))
+                                ORDER BY p.ID ASC
+                                LIMIT %d",
+                                $wpdb->posts,
+                                $wpdb->postmeta,
+                                GDAIIDL_Plugin::META_MEDIA_SOURCE_TYPE,
+                                $image_mime_like,
+                                $after_id,
+                                $limit
+                        );
                 } else {
-                        $sql = "SELECT ID FROM {$wpdb->posts} WHERE post_type = 'attachment' AND post_status <> 'trash' AND post_mime_type LIKE 'image/%%' AND ID > %d ORDER BY ID ASC LIMIT %d";
-                        $prepared = $wpdb->prepare( $sql, $after_id, $limit );
-                }
-                return array_map( 'absint', (array) $wpdb->get_col( $prepared ) ); // phpcs:ignore WordPress.DB.PreparedSQL.NotPrepared
+                        $prepared = $wpdb->prepare(
+                                "SELECT ID
+                                FROM %i
+                                WHERE post_type = 'attachment'
+                                AND post_status <> 'trash'
+                                AND post_mime_type LIKE %s
+                                AND ID > %d
+                                ORDER BY ID ASC
+                                LIMIT %d",
+                                $wpdb->posts,
+                                $image_mime_like,
+                                $after_id,
+                                $limit
+                        );
+                }
+
+                // phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery,WordPress.DB.DirectDatabaseQuery.NoCaching,WordPress.DB.PreparedSQL.NotPrepared -- Query was prepared immediately above; cursor-based background-job query is intentionally uncached.
+                return array_map( 'absint', (array) $wpdb->get_col( $prepared ) );
         }
 
@@ -1571 +1660 @@
                 $saved = $editor->save( $tmp, 'image/jpeg' );
                 if ( is_wp_error( $saved ) || empty( $saved['path'] ) || ! is_readable( $saved['path'] ) ) {
-                        @unlink( $tmp ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                        wp_delete_file( $tmp );
                         return is_wp_error( $saved ) ? $saved : new WP_Error( 'gdaiidl_temp_failed', __( 'Could not write the temporary analysis image.', 'ai-image-disclosure-labels' ) );
                 }
@@ -1577 +1666 @@
                 $temp_size = @filesize( $saved['path'] ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged -- temporary file can disappear; handled below.
                 if ( false === $temp_size || $temp_size <= 0 || $temp_size > $max_bytes ) {
-                        @unlink( $saved['path'] ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                        wp_delete_file( $saved['path'] );
                         if ( $saved['path'] !== $tmp && file_exists( $tmp ) ) {
-                                @unlink( $tmp ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                                wp_delete_file( $tmp );
                         }
                         return new WP_Error( 'gdaiidl_temp_size', __( 'The temporary analysis image is unexpectedly large or unreadable.', 'ai-image-disclosure-labels' ) );
                 }
                 $data = file_get_contents( $saved['path'] ); // phpcs:ignore WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents -- bounded temporary file.
-                @unlink( $saved['path'] ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                wp_delete_file( $saved['path'] );
                 if ( $saved['path'] !== $tmp && file_exists( $tmp ) ) {
-                        @unlink( $tmp ); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
+                        wp_delete_file( $tmp );
                 }
                 if ( false === $data || '' === $data || strlen( $data ) > $max_bytes ) {
@@ -1651 +1740 @@
                 }
                 foreach ( $candidates as $candidate ) {
-                        if ( is_string( $candidate ) && '' !== trim( $candidate ) ) { return sprintf( __( 'Provider error %1$d: %2$s', 'ai-image-disclosure-labels' ), $code, sanitize_text_field( $candidate ) ); }
+                        if ( is_string( $candidate ) && '' !== trim( $candidate ) ) {
+                                /* translators: 1: HTTP/status code, 2: provider error message. */
+                                return sprintf( __( 'Provider error %1$d: %2$s', 'ai-image-disclosure-labels' ), $code, sanitize_text_field( $candidate ) );
+                        }
                 }
                 $raw = trim( wp_strip_all_tags( (string) $raw ) );
-                return sprintf( __( 'Provider returned HTTP %d.%s', 'ai-image-disclosure-labels' ), $code, '' !== $raw ? ' ' . substr( $raw, 0, 300 ) : '' );
+                /* translators: 1: HTTP status code, 2: optional provider response excerpt including its leading space. */
+                return sprintf( __( 'Provider returned HTTP %1$d.%2$s', 'ai-image-disclosure-labels' ), $code, '' !== $raw ? ' ' . substr( $raw, 0, 300 ) : '' );
         }
 
@@ -2417 +2510 @@
                 $status_labels = array( 'queued' => __( 'Queued', 'ai-image-disclosure-labels' ), 'running' => __( 'Running', 'ai-image-disclosure-labels' ), 'completed' => __( 'Completed', 'ai-image-disclosure-labels' ), 'cancelled' => __( 'Cancelled', 'ai-image-disclosure-labels' ), 'stopped_cost' => __( 'Stopped at cost limit', 'ai-image-disclosure-labels' ), 'stopped_config' => __( 'Stopped because settings changed', 'ai-image-disclosure-labels' ) );
                 $status = isset( $status_labels[ $job['status'] ] ) ? $status_labels[ $job['status'] ] : $job['status'];
-                $html = '<div class="gdaiidl-ai-job" data-job-id="' . esc_attr( $job_id ) . '"><p><strong>' . esc_html( $status ) . '</strong> · ' . esc_html( sprintf( __( '%1$d / %2$d images (%3$d%%)', 'ai-image-disclosure-labels' ), $processed, (int) $job['total'], $percent ) ) . '</p>';
+                /* translators: 1: processed image count, 2: total image count, 3: completion percentage. */
+                $progress_text = sprintf( __( '%1$d / %2$d images (%3$d%%)', 'ai-image-disclosure-labels' ), $processed, (int) $job['total'], $percent );
+                /* translators: 1: AI-generated count, 2: AI-modified count, 3: likely non-AI count, 4: uncertain count, 5: failed count. */
+                $result_text = sprintf( __( 'Generated: %1$d · Modified: %2$d · Likely non-AI: %3$d · Uncertain: %4$d · Failed: %5$d', 'ai-image-disclosure-labels' ), (int) $job['generated'], (int) $job['modified'], (int) $job['non_ai'], (int) $job['uncertain'], (int) $job['failed'] );
+                /* translators: 1: known or estimated US-dollar cost, 2: number of requests for which cost was unavailable. */
+                $cost_text = sprintf( __( 'Known/estimated cost recorded by the plugin: $%1$.6f · Requests with unknown cost: %2$d', 'ai-image-disclosure-labels' ), (float) $job['known_cost'], (int) $job['unknown_cost_count'] );
+
+                $html = '<div class="gdaiidl-ai-job" data-job-id="' . esc_attr( $job_id ) . '"><p><strong>' . esc_html( $status ) . '</strong> · ' . esc_html( $progress_text ) . '</p>';
                 $html .= '<div class="gdaiidl-ai-progress"><span style="width:' . esc_attr( $percent ) . '%"></span></div>';
-                $html .= '<p class="description">' . esc_html( sprintf( __( 'Generated: %1$d · Modified: %2$d · Likely non-AI: %3$d · Uncertain: %4$d · Failed: %5$d', 'ai-image-disclosure-labels' ), (int) $job['generated'], (int) $job['modified'], (int) $job['non_ai'], (int) $job['uncertain'], (int) $job['failed'] ) ) . '</p>';
-                $html .= '<p class="description">' . esc_html( sprintf( __( 'Known/estimated cost recorded by the plugin: $%1$.6f · Requests with unknown cost: %2$d', 'ai-image-disclosure-labels' ), (float) $job['known_cost'], (int) $job['unknown_cost_count'] ) ) . '</p>';
+                $html .= '<p class="description">' . esc_html( $result_text ) . '</p>';
+                $html .= '<p class="description">' . esc_html( $cost_text ) . '</p>';
                 if ( ! empty( $job['last_error'] ) ) { $html .= '<p class="description gdaiidl-ai-error">' . esc_html( $job['last_error'] ) . '</p>'; }
                 if ( in_array( $job['status'], array( 'queued', 'running' ), true ) ) { $html .= '<p><button type="button" class="button-link-delete gdaiidl-ai-cancel-job" data-job-id="' . esc_attr( $job_id ) . '">' . esc_html__( 'Cancel job', 'ai-image-disclosure-labels' ) . '</button></p>'; }

ai-image-disclosure-labels/trunk/includes/class-gdaiidl-plugin.php

@@ -1028 +1028 @@
 
                 $settings = $this->settings();
-                $clauses  = array();
-                $values   = array();
-
-                if ( ! empty( $settings['enable_images'] ) ) {
-                        $clauses[] = '%i.post_mime_type LIKE %s';
-                        $values[]  = $wpdb->posts;
-                        $values[]  = $wpdb->esc_like( 'image/' ) . '%';
-                }
-
-                if ( ! empty( $settings['enable_videos'] ) ) {
-                        $clauses[] = '%i.post_mime_type LIKE %s';
-                        $values[]  = $wpdb->posts;
-                        $values[]  = $wpdb->esc_like( 'video/' ) . '%';
-                }
-
-                if ( empty( $clauses ) ) {
+                $images_enabled = ! empty( $settings['enable_images'] );
+                $videos_enabled = ! empty( $settings['enable_videos'] );
+
+                if ( ! $images_enabled && ! $videos_enabled ) {
                         return $where . ' AND 1=0';
                 }
 
-                return $where . $wpdb->prepare( ' AND ( ' . implode( ' OR ', $clauses ) . ' )', ...$values );
+                if ( $images_enabled && $videos_enabled ) {
+                        return $where . $wpdb->prepare(
+                                ' AND ( %i.post_mime_type LIKE %s OR %i.post_mime_type LIKE %s )',
+                                $wpdb->posts,
+                                $wpdb->esc_like( 'image/' ) . '%',
+                                $wpdb->posts,
+                                $wpdb->esc_like( 'video/' ) . '%'
+                        );
+                }
+
+                return $where . $wpdb->prepare(
+                        ' AND %i.post_mime_type LIKE %s',
+                        $wpdb->posts,
+                        $wpdb->esc_like( $images_enabled ? 'image/' : 'video/' ) . '%'
+                );
         }
 

ai-image-disclosure-labels/trunk/readme.txt

@@ -6 +6 @@
 Tested up to: 7.1
 Requires PHP: 7.4
-Stable tag: 3.0.0
+Stable tag: 3.0.1
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/gpl-2.0.html
@@ -33 +33 @@
 * Media Library list tools: an AI status column, status filter and grouped bulk actions make it possible to classify many images and videos without opening them individually.
 * Optional automatic visible disclosures for AI-classified Media Library images and videos; this remains off by default.
-* Optional AI-assisted image analysis through the WordPress 7.0+ AI Client / configured Connectors when available, or directly through OpenAI, Google Gemini, Anthropic Claude, Cloudflare Workers AI, an OpenAI-compatible HTTPS endpoint, or a custom HTTPS analysis endpoint. Automated analysis remains image-only in 3.0.0; videos are classified manually.
+* Optional AI-assisted image analysis through the WordPress 7.0+ AI Client / configured Connectors when available, or directly through OpenAI, Google Gemini, Anthropic Claude, Cloudflare Workers AI, an OpenAI-compatible HTTPS endpoint, or a custom HTTPS analysis endpoint. Automated analysis remains image-only in the 3.0.x series; videos are classified manually.
 * Dynamic model discovery where the provider exposes a Models API or, in WordPress AI Client mode, through the configured AI provider registry; model names are never hard-coded and manual model/policy names remain supported.
 * Provider-independent custom HTTPS endpoint contract for Cloudflare Workers, AI Gateway, dedicated detectors and other future services.
@@ -133 +133 @@
 = Can the plugin automatically detect AI-generated images? =
 
-Version 3.0.0 can optionally ask a configured external vision-capable AI service to assess an image and store a suggestion such as "likely AI-generated", "likely AI-modified", "likely non-AI" or "uncertain". This is probabilistic analysis, not forensic proof. General vision models can be wrong; an absent watermark or a "likely non-AI" answer does not prove that no AI was used.
+Version 3.0.x can optionally ask a configured external vision-capable AI service to assess an image and store a suggestion such as "likely AI-generated", "likely AI-modified", "likely non-AI" or "uncertain". This is probabilistic analysis, not forensic proof. General vision models can be wrong; an absent watermark or a "likely non-AI" answer does not prove that no AI was used.
 The built-in direct-provider adapters perform visual analysis; they do not claim to cryptographically verify C2PA, SynthID or proprietary provider watermarks. If you operate a custom endpoint that performs genuine provenance/watermark verification, it can return `verified_provenance=true` and evidence labels. Automatic application of that stronger signal is a separate opt-in setting.
 
@@ -158 +158 @@
 = How are AI videos labelled? =
 
-For the core WordPress Video block, enable the AI disclosure in the block sidebar or classify the uploaded video in the Media Library and enable automatic Media Library labels. The disclosure appears immediately below the video, outside the playback surface. This avoids covering native controls and works with captions because it is inserted before the figure caption. Optional machine-readable output uses a Schema.org `VideoObject`. AI-assisted frame/video analysis is not included in 3.0.0.
+For the core WordPress Video block, enable the AI disclosure in the block sidebar or classify the uploaded video in the Media Library and enable automatic Media Library labels. The disclosure appears immediately below the video, outside the playback surface. This avoids covering native controls and works with captions because it is inserted before the figure caption. Optional machine-readable output uses a Schema.org `VideoObject`. AI-assisted frame/video analysis is not included in the 3.0.x series.
 
 = Does AI analysis send my images to another service? =
@@ -219 +219 @@
 
 == Changelog ==
+
+= 3.0.1 =
+* Release-hardening update following the official WordPress Plugin Check run for 3.0.0.
+* Consolidated AI-admin AJAX input handling so nonce verification, capability checks and sanitization are explicit in the same request boundary.
+* Replaced temporary-file `unlink()` calls with WordPress `wp_delete_file()`.
+* Reworked the Media Library MIME SQL filter to use fixed prepared query shapes instead of dynamically assembled placeholders.
+* Hardened background-job SQL preparation and documented the narrow, admin-only direct-query exceptions used for cursor-based library scans.
+* Added missing translator comments and ordered placeholders in translatable strings.
+* Removed remote documentation links from PHP-rendered admin markup; provider terms/privacy/service links remain clearly documented in `readme.txt`.
+* Updated the distribution ignore rules so GitHub-only release notes and audit documents are never included in the WordPress.org production ZIP.
 
 = 3.0.0 =