Menu

#19 Fix the latest version to fit wp.org requirements

v1.1
open
nobody
None
9
2012-02-26
2012-02-26
No

The latest version (1.1) didn't pass the wordpress.org requirements. It should be fixed.
the complete description is available at http://themes.trac.wordpress.org/ticket/5904

Textdomain

Don't use constants for the theme textdomain. Use a string instead. In a month, this will be a requirement. Read this for more info:
http://markjaquith.wordpress.com/2011/10/06/translating-wordpress-plugins-and-themes-dont-get-clever/

On that note, if you're going to load translation files, make sure the entire theme is internationalized.

Sidebars

Here's a guide on appropriately registering sidebars. It will explain everything you've done wrong.
http://justintadlock.com/archives/2010/11/08/sidebars-in-wordpress

Wrong posts showing

Don't create custom queries to overwrite the posts showing in the theme templates. The home page, using the index.php template, is not loading the correct posts in the correct. Just get rid of this and run the normal loop with no custom query. If you want to add custom queries to templates, do it within a page template.

get_template_part()

get_template_part() is not meant for including templates in sub-folders. For this, use locate_template(). Read:
http://justintadlock.com/archives/2010/11/17/how-to-load-files-within-wordpress-themes

Function names

Prefix all custom function names with something unique to your theme. For example, some_function() should be named clear_line_some_function(). This goes for global variables and constants as well.

Use wp_head

All of that extra stuff like meta and inline CSS should be hooked to wp_head rather than added to header.php.

Backwards Compatibility

There's no need for backwards compatibility checks such as function_exists('register_sidebar') and function_exists('dynamic_sidebar') since the rest of your theme isn't backwards compatible.

The theme should either be fully backwards compatible or not at all, preferrably not at all so as not to encourage users to use old, insecure versions of WordPress?.

CSS

<table>, <h5>, and <h6> are nearly unreadable. I suggest a larger font size.

Posts with no title

Posts with no title have no way of getting to the single view from an archive view because there's no permalink shown.

Theme Options

The theme options page doesn't even appear for me. Nevertheless, I reviewed the code and can tell you it's not up-to-par yet.

The theme options page has too many security vulnerabilities to approve this theme.

None of the options are validated or sanitized before entering data into the database nor are options escaped on output in the form elements. Theme author should read up on data validation:
http://codex.wordpress.org/Data_Validation

The settings page does no nonce checking:
http://codex.wordpress.org/WordPress_Nonces

It is also highly recommended that the theme use the Settings API, which is easier to use, more secure, and takes care of a lot of the hard work of settings pages:
http://codex.wordpress.org/Settings_API

For a good tutorial on using the Settings API, see:
http://planetozh.com/blog/2009/05/handling-plugins-options-in-wordpress-28-with-register_setting/

If you want to check out a theme with a secure and solidly-coded theme settings page, check out this theme:
http://wordpress.org/extend/themes/coraline

Drop this into any text input box and you can see an example of what a malicious script could do (don't worry, this specific script is harmless):

"<script>alert('XSS');</script>"

Review

If you have any questions about the review, please check the Theme Review guidelines or ask in the form below. I'll be happy to help out.
http://codex.wordpress.org/Theme_Review

Note that this is not a complete review. Other theme reviewers may find other issues. Please follow all the notes in the Theme Review guidelines.

Discussion


Log in to post a comment.