Harden interactive task handlers

[ilicfilip]

Hardening pass across the interactive task handlers, following an external code review of the plugin. Some of the reviewed items were re-scoped after verifying them against the code; the detailed analysis lives in our internal tracker.

Changes

Consistent capability checks on AIOSEO interactive tasks
Five AIOSEO handlers were verifying the plugin was active and the nonce was valid, but not the user's capability. They now call the shared verify_aioseo_ajax_security() helper, which covers all three. Every other settings-changing interactive handler already required manage_options, so this brings the AIOSEO ones in line with the existing convention rather than introducing a new policy.

Capability guard on the email-sending task's script enqueue
Email_Sending::enqueue_scripts() overrode its parent without carrying over the parent's capability guard. It now checks $this->capability_required() — the provider's own declared capability rather than a hardcoded literal, so it stays correct if a subclass overrides CAPABILITY.

Term task handlers bound to the term the task suggested
Remove_Terms_Without_Posts and Update_Term_Description acted on whatever term_id/taxonomy the request supplied. They now require that a task from the same provider actually targets that term, reject non-public taxonomies, and (for deletion) re-check the post count at submit time.

The constraints already existed when generating the tasks — maybe_remove_irrelevant_tasks() skips non-public taxonomies and drops tasks once a term exceeds MIN_POSTS — they just weren't applied when acting on the request. The count re-check also closes a genuine race: a term can gain posts between the task being created and the user clicking through.

Binding rather than raising the required capability keeps the feature working for its intended audience. These tasks are meant for Editors, and the JS already submits the task's own target_term_id/target_taxonomy, so the legitimate flow is unchanged.

esc_url() for hrefs
Switched esc_attr() to esc_url() on three links. esc_url is the correct escaper for an href, since esc_attr does not validate the URL scheme.

Media previews built via DOM instead of HTML strings
The site icon and Yoast organization logo pickers assembled their preview <img> by string concatenation and assigned it to innerHTML. They now use createElement with property assignment, so attachment metadata is never parsed as markup. Same reasoning as the existing textContent usage in updateTaskTitle().

Testing

tests/phpunit/test-class-term-task-binding.php adds 6 tests for the term task binding, covering both the rejected and the permitted paths — the latter so the binding can't silently break the feature.

These were validated by temporarily removing the new guards and confirming the four negative tests fail while both positive tests still pass, i.e. they exercise the behaviour rather than passing vacuously.

The media preview change was verified with jsdom: attachment metadata containing quote characters round-trips as an attribute value and never becomes markup.

Verified: PHPCS clean · PHPStan clean · JS/CSS lint clean · PHPUnit 404 tests / 1216 assertions passing.

Note for local runs: PHPStan needs --memory-limit=2G; the 512M default OOMs on this codebase, unrelated to these changes.

🤖 Generated with Claude Code

[github-actions]

Test on Playground
Test this pull request on the Playground
or download the zip

[github-actions]

✅ Code Coverage Report

Metric	Value
Total Coverage	32.19% 📉
Base Coverage	31.62%
Difference	📈 0.57%

⚠️ Coverage below recommended 40% threshold

🎉 Great job maintaining/improving code coverage!

📊 File-level Coverage Changes (2 files)

📈 Coverage Improved

Class	Before	After	Change
Progress_Planner\Suggested_Tasks\Providers\Remove_Terms_Without_Posts	4.93%	21.43%	+16.50%
Progress_Planner\Suggested_Tasks\Providers\Update_Term_Description	5.30%	21.12%	+15.82%

ℹ️ About this report

• All tests run in a single job with Xdebug coverage
• Security tests excluded from coverage to prevent output issues
• Coverage calculated from line coverage percentages