Merge pull request #67 from sectsect/bugfix/fix-action-warning

ci: resolve Plugin Check warning

Author: sectsect

functions/functions.php

@@ -310,3 +310,22 @@ function google_ss2db_save_spreadsheet( array $post_data ): array {
 		throw $e;
 	}
 }
+
+/**
+ * Cast mixed value to string.
+ *
+ * @param mixed $value Value to cast.
+ * @return string
+ * @throws InvalidArgumentException If the value cannot be cast to a string.
+ */
+function google_ss2db_cast_mixed_to_string( mixed $value ): string {
+	if ( is_null( $value ) ) {
+		throw new InvalidArgumentException( 'Value cannot be null' );
+	}
+
+	if ( is_scalar( $value ) ) {
+		return (string) $value;
+	}
+
+	throw new InvalidArgumentException( 'Value must be a scalar type' );
+}

includes/admin.php

@@ -14,6 +14,13 @@
 
 declare(strict_types=1);
 
+// Add a constant for the register_setting arguments at the top of the file.
+const GOOGLE_SS2DB_SETTING_ARGS = array(
+	'type'              => 'string',
+	'sanitize_callback' => 'google_ss2db_sanitize_dataformat',
+	'default'           => 'json',
+);
+
 /**
  * The core plugin class.
  *
@@ -84,13 +91,35 @@ function google_ss2db_admin_scripts(): void {
 	);
 }
 
+/**
+ * Sanitizes the data format option for the Google Spreadsheet to DB plugin.
+ *
+ * This callback ensures that only allowed values ('json' or 'json-unescp') are saved.
+ * If the input is empty or does not match one of the allowed values, an empty string is returned.
+ *
+ * @param mixed $value The value to sanitize.
+ * @return string Sanitized value; returns an empty string if the value is not allowed.
+ */
+function google_ss2db_sanitize_dataformat( mixed $value ): string {
+	$value   = sanitize_text_field( google_ss2db_cast_mixed_to_string( $value ) );
+	$allowed = array( 'json', 'json-unescp' );
+	if ( in_array( $value, $allowed, true ) ) {
+		return $value;
+	}
+	return '';
+}
+
 /**
  * Registers settings for the Google Spreadsheet to DB plugin within the WordPress settings API.
  *
  * @return void
  */
 function register_google_ss2db_settings(): void {
-	register_setting( 'google_ss2db-settings-group', 'google_ss2db_dataformat' );
+	register_setting(
+		'google_ss2db-settings-group',
+		'google_ss2db_dataformat',
+		GOOGLE_SS2DB_SETTING_ARGS
+	);
 }
 
 /**