<?xml version="1.0"?>
<ruleset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="WordPress VIP Minimum" xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/squizlabs/PHP_CodeSniffer/master/phpcs.xsd">
	<description>WordPress VIP Minimum Coding Standards</description>

	<!-- Link references are platform-specific. See
		https://wpvip.com/documentation/vip-go/understanding-codebase-differences/
		for the differences between the platforms -->

	<rule ref="Generic.PHP.Syntax"/>
	<rule ref="Generic.PHP.NoSilencedErrors">
		<properties>
			<property name="error" value="true"/>
		</properties>
	</rule>

	<rule ref="WordPressVIPMinimum.Security.Twig">
		<include-pattern>*.twig</include-pattern>
	</rule>

	<rule ref="WordPress.Security.EscapeOutput"/>
	<rule ref="WordPress.Security.NonceVerification"/>
	<rule ref="WordPress.Security.ValidatedSanitizedInput">
		<exclude name="WordPress.Security.ValidatedSanitizedInput.MissingUnslash"/>
	</rule>
	<rule ref="WordPress.Security.PluginMenuSlug"/>
	<rule ref="WordPress.PHP.IniSet"/>
	<rule ref="WordPress.WP.EnqueuedResources"/>
	<rule ref="WordPress.WP.PostsPerPage"/>
	<rule ref="WordPress.DateTime.RestrictedFunctions"/>
	<rule ref="WordPress.DB.PreparedSQL"/>
	<rule ref="WordPress.DB.DirectDatabaseQuery"/>
	<rule ref="WordPress.DB.SlowDBQuery"/>
	<rule ref="WordPress.WP.GlobalVariablesOverride"/>
	<rule ref="WordPress.PHP.StrictComparisons"/>
	<rule ref="WordPress.CodeAnalysis.AssignmentInCondition"/>
	<rule ref="WordPress.PHP.StrictInArray"/>
	<rule ref="WordPress.PHP.DontExtract"/>
	<rule ref="WordPress.WP.CronInterval">
		<properties>
			<!-- Set to 900 (15 minutes), which is the requirement for the VIP platform. -->
			<property name="min_interval" value="900"/>
		</properties>
	</rule>

	<rule ref="Generic.VersionControl.GitMergeConflict"/>
	<rule ref="Generic.NamingConventions.ConstructorName"/>
	<rule ref="Generic.PHP.DisallowShortOpenTag"/>
	<!-- Covers rule: Omitting the closing PHP tag at the end of a file is preferred. -->
	<rule ref="PSR2.Files.ClosingTag"/>
	<rule ref="Squiz.WhiteSpace.SuperfluousWhitespace">
		<exclude name="Squiz.WhiteSpace.SuperfluousWhitespace.EmptyLines"/>
		<exclude name="Squiz.WhiteSpace.SuperfluousWhitespace.EndLine"/>
		<include-pattern>*.php</include-pattern>
		<include-pattern>*.inc</include-pattern>
		<exclude-pattern>*.js</exclude-pattern>
		<exclude-pattern>*.css</exclude-pattern>
	</rule>
	<rule ref="Squiz.PHP.CommentedOutCode"/>

	<!-- WordPress.com: https://lobby.vip.wordpress.com/wordpress-com-documentation/code-review-what-we-look-for/#eval-create_function -->
	<!-- VIP-Go: https://wpvip.com/documentation/vip-go/code-review-blockers-warnings-notices/#eval-and-create_function -->
	<rule ref="Squiz.PHP.Eval.Discouraged">
		<type>error</type>
		<message>`eval()` is a security risk, please refrain from using it.</message>
	</rule>

	<!-- WordPress.com: https://lobby.vip.wordpress.com/wordpress-com-documentation/code-review-what-we-look-for/#settings-alteration -->
	<!-- VIP-Go: https://wpvip.com/documentation/vip-go/code-review-blockers-warnings-notices/#settings-alteration -->
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions">
		<!-- https://github.com/WordPress-Coding-Standards/WordPress-Coding-Standards/pull/633#issuecomment-266634811 -->
		<properties>
			<property name="exclude" type="array">
				<element value="obfuscation"/>
			</property>
		</properties>
	</rule>
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions.runtime_configuration_error_reporting">
		<type>error</type>
	</rule>
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions.runtime_configuration_ini_restore">
		<type>error</type>
	</rule>
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions.runtime_configuration_apache_setenv">
		<type>error</type>
	</rule>
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions.runtime_configuration_putenv">
		<type>error</type>
	</rule>
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions.runtime_configuration_set_include_path">
		<type>error</type>
	</rule>
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions.runtime_configuration_restore_include_path">
		<type>error</type>
	</rule>
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions.runtime_configuration_magic_quotes_runtime">
		<type>error</type>
	</rule>
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions.runtime_configuration_set_magic_quotes_runtime">
		<type>error</type>
	</rule>
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions.runtime_configuration_dl">
		<type>error</type>
	</rule>
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions.system_calls_exec">
		<type>error</type>
	</rule>
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions.system_calls_shell_exec">
		<type>error</type>
	</rule>

	<!-- WordPress.com: https://lobby.vip.wordpress.com/wordpress-com-documentation/code-review-what-we-look-for/#commented-out-code-debug-code-or-output -->
	<!-- VIP-Go: https://wpvip.com/documentation/vip-go/code-review-blockers-warnings-notices/#commented-out-code-debug-code-or-output -->
	<rule ref="WordPress.PHP.DevelopmentFunctions">
		<!-- This is already covered in WordPress.PHP.DiscouragedPHPFunctions sniff -->
		<exclude name="WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_error_reporting"/>
	</rule>
	<!-- WordPress.com: https://lobby.vip.wordpress.com/wordpress-com-documentation/code-review-what-we-look-for/#settings-alteration -->
	<!-- VIP-Go: https://wpvip.com/documentation/vip-go/code-review-blockers-warnings-notices/#settings-alteration -->
	<rule ref="WordPress.PHP.DevelopmentFunctions.prevent_path_disclosure_phpinfo">
		<type>error</type>
	</rule>
	<rule ref="WordPress.PHP.DevelopmentFunctions.error_log_error_log">
		<type>error</type>
	</rule>

	<!-- WordPress.com: https://lobby.vip.wordpress.com/wordpress-com-documentation/code-review-what-we-look-for/#wp_json_encode-over-json_encode -->
	<!-- WordPress.com: https://lobby.vip.wordpress.com/wordpress-com-documentation/code-review-what-we-look-for/#filesystem-writes -->
	<!-- WordPress.com: https://lobby.vip.wordpress.com/wordpress-com-documentation/code-review-what-we-look-for/#remote-calls -->
	<!-- VIP-Go: https://wpvip.com/documentation/vip-go/code-review-blockers-warnings-notices/#use-wp_json_encode-over-json_encode -->
	<!-- VIP-Go: https://wpvip.com/documentation/vip-go/code-review-blockers-warnings-notices/#filesystem-operations -->
	<!-- VIP-Go: https://wpvip.com/documentation/vip-go/code-review-blockers-warnings-notices/#remote-calls -->
	<rule ref="WordPress.WP.AlternativeFunctions">
		<!-- This is already covered in WordPressVIPMinimum.Performance.FetchingRemoteData.FileGetContentsUnknown -->
		<exclude name="WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents"/>
		<!-- This is already covered in WordPressVIPMinimum.Functions.StripTags.StripTagsOneParameter -->
		<exclude name="WordPress.WP.AlternativeFunctions.strip_tags_strip_tags"/>
		<!-- This is already covered in WordPressVIPMinimum.Functions.RestrictedFunctions.file_ops_fwrite -->
		<exclude name="WordPress.WP.AlternativeFunctions.file_system_read_fwrite"/>
		<!-- This is already covered in WordPressVIPMinimum.Functions.RestrictedFunctions.file_ops_file_put_contents -->
		<exclude name="WordPress.WP.AlternativeFunctions.file_system_read_file_put_contents"/>
	</rule>
	<!-- VIP recommends other functions -->
	<rule ref="WordPress.WP.AlternativeFunctions.curl_curl_init">
		<message>Using cURL functions is highly discouraged within VIP context. Please see: https://lobby.vip.wordpress.com/wordpress-com-documentation/fetching-remote-data/.</message>
	</rule>
	<rule ref="WordPress.WP.AlternativeFunctions.curl_curl_close">
		<message>Using cURL functions is highly discouraged within VIP context. Please see: https://lobby.vip.wordpress.com/wordpress-com-documentation/fetching-remote-data/.</message>
	</rule>
	<rule ref="WordPress.WP.AlternativeFunctions.curl_curl_getinfo">
		<message>Using cURL functions is highly discouraged within VIP context. Please see: https://lobby.vip.wordpress.com/wordpress-com-documentation/fetching-remote-data/.</message>
	</rule>
	<rule ref="WordPress.WP.AlternativeFunctions.curl_curl_getinfo">
		<message>Using cURL functions is highly discouraged within VIP context. Please see: https://lobby.vip.wordpress.com/wordpress-com-documentation/fetching-remote-data/.</message>
	</rule>

	<rule ref="WordPressVIPMinimum.Functions.RestrictedFunctions.get_posts_get_children">
		<type>error</type>
		<message>`%1$s()` performs a no-LIMIT query by default, make sure to set a reasonable `posts_per_page`. `%1$s()` will do a -1 query by default, a maximum of 100 should be used.</message>
	</rule>

	<rule ref="WordPressVIPMinimum.Variables.VariableAnalysis">
		<properties>
			<property name="allowUnusedCaughtExceptions" value="1"/>
		</properties>
	</rule>

</ruleset>
