Theme review team weekly notes The logs are…

Welcome to the Themes team!

We are a group of volunteers who review and approve themes submitted to be included in the official WordPress Theme directory.

We do license, security, and code quality reviews.

We help build and maintain default themes.

The primary focus of the team is to help theme authors transition to blockBlock Block is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience.-based themes.

If this sounds interesting, read more about the team here. Check out our guide for new reviewers and the frequently asked questions.

Handbooks and review requirements

The team maintains the official Theme Review Requirements, the Theme Unit Test Data, and helps the documentation team with the Theme Developer Handbook.

Coding standards and plugins

We maintain the WPThemeReview Standard for PHP_CodeSniffer, the Theme Sniffer plugin and Theme Check

Code Packages

We have code packages for themes available for use on Github and Packagist

Communication

Meet us in the #themereview SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/. channel.

Meetings:

Twice monthly at Tuesday @ 15:00 UTC.

#themereview

Theme review team weekly notes

The logs are here:
https://wordpress.slack.com/archives/themereview/p1421776726000809

We are not going to be putting the handbook on GithubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged be the repository owner. https://github.com/. We are going to use the workflows already in place and used by other teams. However, so we can keep the handbook fresh and check in with it, we are going to cover a new section each week for a few months. This will also enable in the weekly meeting people to get more familiar and discuss it.

We will also have a page up for suggestions. People can then add their thoughts to that for changes and updates. This should help us collate ideas.

From now on, at the end of each weekly meeting we will also give time every week for change requests and updates. This gives us all a chance to highlight issues, areas of weakness and areas that can be improved. Bring your best ideas and suggestions.

Emil Uzelac 2:20 am on January 21, 2015

Thanks Tammie 🙂

I am glad that we are not going with the GitHubGitHub GitHub is a website that offers online implementation of git repositories that can easily be shared, copied and modified by other developers. Public repositories are free to host, private repositories require a paid subscription. GitHub introduced the concept of the ‘pull request’ where code changes done in branches by contributors can be reviewed and discussed before being merged be the repository owner. https://github.com/ for the handbook.

Great meeting, short and to the point!
Ulrich 12:32 am on January 25, 2015

We should talk about this in the next meeting https://github.com/Otto42/theme-check/pull/42
Justin Tadlock 6:15 pm on January 25, 2015
Next meeting item of discussion: Custom CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site. theme options.

This has come up in a few recent tickets. Themes are allowing end users to enter arbitrary custom CSS via a textarea in their theme options. It might be time to consider putting this under the “pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party territory” categoryCategory The 'category' taxonomy lets you group posts / content together that share a common bond. Categories are pre-defined and broad ranging.. There are 3 major issues I see:
- Handling permissions (using the correct capability).
- Sanitizing before saving to database.
- Handling the output.
There may be cases where this makes sense in a theme, but for general purposes, I’d say we need to leave this to plugin authors with the skillset to make this safe and work correctly. It should be up for discussion anyway.

Some relevant links:
- https://themes.trac.wordpress.org/ticket/22382#comment:25
- https://wordpress.slack.com/archives/themereview/p1419229888003545
- usability.idealist 8:41 pm on January 26, 2015
  
  A note on this: These are regular issues with ANY kind of option, most of which are already dealt with (using the Settings APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways.).
  
  So the actual ONLY issue is a missing CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site. sanitizer (the only existing one is used for INLINE css, which might be found inside tags of regular posts, but certainly not stand-alone fields).
  
  I’ve been dealing with this the last few days. One option is using the current version of CSSTidy, which might be a bit of overkill, but then, it’s only being used inside the admin section of your theme, so it shouldn’t too much harm.
  
  Example approach: http://wordpress.stackexchange.com/questions/53970/sanitize-user-entered-css/165496#165496
  Current (!) version of CSSTidy: https://github.com/Cerdic/CSSTidy
  
  The second one is my current approach: Stripping out anything that is NOT CSS. So, nasty stuff like dropping JS code into it, etc. is already being avoided.
  
  Third option would be writing your very own, which I tried, but abadoned pretty soon.
  
  cu, w0lf.
  - Justin Tadlock 10:11 pm on January 26, 2015
    
    Permissions, sanitizing, and escaping are definitely issues with any kind of option. However, CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site. blocks present their own issues, as I’m sure you’re aware. Using CSSTidy or a custom script might be a good solution, but this is code that one of the reviewers on the review team will have to review for any theme using it. Not many have the necessary skills to review such code.
    
    There’s also the issue of whether such a setting belongs in a theme at all. I’m sure we’ll cover these points tomorrow in the meeting.
    - usability.idealist 10:21 am on January 27, 2015
      
      There is an existing implementation right there in Jetpack (a module called “Custom CSSCSS CSS is an acronym for cascading style sheets. This is what controls the design or look and feel of a site.”). Thou it’s using the old, outdated 1.3 version.
      
      Handling is found over here: https://plugins.svn.wordpress.org/jetpack/tags/3.3/modules/custom-css/custom-css.php
      
      cu, w0lf.
      - George Stephanis 2:51 pm on January 27, 2015
        
        Good call, I’ll try and get our implementation bumped up to release shortly.
smartcat 4:28 pm on January 27, 2015

Is there a process outlined in theme review regarding how long a reviewer has to review a theme ? reason I ask is because I have a theme that was assigned to a reviewer who has been idle for a month and I fear that it will just sit there permanently https://themes.trac.wordpress.org/ticket/21699
Tammie 4:29 pm on January 27, 2015

@smartcat, they should respond within 7 days. We triage all tickets each week as best we can by hand. You can always bring up a ticket in SlackSlack Slack is a Collaborative Group Chat Platform https://slack.com/. The WordPress community has its own Slack Channel at https://make.wordpress.org/chat/. at #themereview. That’s a better place than on our update lists if you want to get eyeballs on it.