quality-debt: views/ui/template-switching-current.php — PR #1110 review feedback (high)

[superdav42]

Unactioned Review Feedback

Source PR: #1110
File: views/ui/template-switching-current.php
Reviewers: coderabbit
Findings: 1
Max severity: high

---

HIGH: coderabbit (coderabbitai[bot])

File: views/ui/template-switching-current.php:40
⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Use esc_url() for the image source.

Line [38] escapes a URL with esc_attr(). For src, use esc_url() so protocol/value sanitization is context-correct.

Proposed fix

-					src="<?php echo esc_attr($current_template->get_featured_image('wu-thumb-medium')); ?>"
+					src="<?php echo esc_url($current_template->get_featured_image('wu-thumb-medium')); ?>"

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

				<img
					class="wu-rounded wu-border-solid wu-border wu-border-gray-300 wu-bg-white"
					style="width: 120px; height: 80px; object-fit: cover;"
					src="<?php echo esc_url($current_template->get_featured_image('wu-thumb-medium')); ?>"
					alt="<?php echo esc_attr($current_template->get_title()); ?>"
				/>

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@views/ui/template-switching-current.php` around lines 35 - 40, The image src
is being escaped with esc_attr() which is for attributes; replace
esc_attr($current_template->get_featured_image('wu-thumb-medium')) with esc_url(
$current_template->get_featured_image('wu-thumb-medium') ) so the URL is
properly sanitized for an src context (keep esc_attr for the alt using
$current_template->get_title()). Locate the img tag using
current_template->get_featured_image and update only the src escaping to
esc_url.

View comment

---

---

Auto-generated by quality-feedback-helper.sh scan-merged. Review each finding and either fix the code or dismiss with a reason.

---

aidevops.sh v3.14.75 automated scan.

[superdav42]

DISPATCH_CLAIM nonce=7f31557c66597bc098cfb943e4629672 runner=superdav42 ts=2026-05-06T11:03:35Z max_age_s=1800 version=3.14.75 opencode_version=1.14.33

[superdav42]

DISPATCH_CLAIM nonce=d7d8340a431481193f52fdac9ed053ff runner=superdav42 ts=2026-05-06T11:04:02Z max_age_s=1800 version=3.14.75 opencode_version=1.14.33

[superdav42]

DISPATCH_CLAIM nonce=0d3d5fafae1031f35b6686544e5e8e75 runner=superdav42 ts=2026-05-06T11:11:45Z max_age_s=1800 version=3.14.75 opencode_version=1.14.33

[superdav42]

DISPATCH_CLAIM nonce=8888b3cf8b7d91c8790619ecc4fe65a1 runner=superdav42 ts=2026-05-06T11:12:46Z max_age_s=1800 version=3.14.75 opencode_version=1.14.33

[superdav42]

DISPATCH_CLAIM nonce=62606e531202178750e2b196725de665 runner=superdav42 ts=2026-05-06T11:15:52Z max_age_s=1800 version=3.14.75 opencode_version=1.14.33

[superdav42]

DISPATCH_CLAIM nonce=aa3346229acb2d5202e429e773967838 runner=superdav42 ts=2026-05-06T11:17:25Z max_age_s=1800 version=3.14.75 opencode_version=1.14.33

[superdav42]

DISPATCH_CLAIM nonce=b58ed4d700eb720cb69f7a27e7290bff runner=superdav42 ts=2026-05-06T11:21:33Z max_age_s=1800 version=3.14.75 opencode_version=1.14.33

[superdav42]

DISPATCH_CLAIM nonce=5abdaf12d037ba9c79cd8fc648990706 runner=superdav42 ts=2026-05-06T11:24:06Z max_age_s=1800 version=3.14.75 opencode_version=1.14.33

[superdav42]

DISPATCH_CLAIM nonce=bab5fac049d3e56a576f4f8dedb954d4 runner=superdav42 ts=2026-05-06T11:28:05Z max_age_s=1800 version=3.14.75 opencode_version=1.14.33

[superdav42]

DISPATCH_CLAIM nonce=129b24980b1fabed5e45967994877cd6 runner=superdav42 ts=2026-05-06T11:31:56Z max_age_s=1800 version=3.14.75 opencode_version=1.14.33