From 5c773867fc74ff1601b1ceb665b58de0f476ee15 Mon Sep 17 00:00:00 2001
From: Shyamsundar Gadde <shyamsundar.gadde@rtcamp.com>
Date: Wed, 11 Dec 2024 23:14:28 +0530
Subject: [PATCH 1/5] Add guidance for managing Performance feature plugins

Signed-off-by: Shyamsundar Gadde <shyamsundar.gadde@rtcamp.com>
---
 plugins/performance-lab/includes/admin/plugins.php | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/plugins/performance-lab/includes/admin/plugins.php b/plugins/performance-lab/includes/admin/plugins.php
index 2458792c1..a687f6986 100644
--- a/plugins/performance-lab/includes/admin/plugins.php
+++ b/plugins/performance-lab/includes/admin/plugins.php
@@ -291,6 +291,16 @@ static function ( string $error_message ): string {
 		</div>
 		<div class="clear"></div>
 	</div>
+	<p>
+		<?php
+		printf(
+			/* translators: %1$s: opening anchor tag, %2$s: closing anchor tag */
+			esc_html__( 'Performance features are installed as plugins. To update features or remove them, %1$s manage them on the plugins screen. %2$s', 'performance-lab' ),
+			'<a href="' . esc_url( admin_url( 'plugins.php?s=WordPress%20Performance%20Team&plugin_status=all' ) ) . '">',
+			'</a>'
+		);
+		?>
+	</p>
 	<?php
 }
 

From 8f670f58a7faa1c8bcf92469feac48dc2cc6775a Mon Sep 17 00:00:00 2001
From: Shyamsundar Gadde <shyamsundar.gadde@rtcamp.com>
Date: Wed, 11 Dec 2024 23:45:50 +0530
Subject: [PATCH 2/5] Replace hardcoded URL with `add_query_arg()`

Signed-off-by: Shyamsundar Gadde <shyamsundar.gadde@rtcamp.com>
---
 plugins/performance-lab/includes/admin/plugins.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/plugins/performance-lab/includes/admin/plugins.php b/plugins/performance-lab/includes/admin/plugins.php
index a687f6986..377f984ba 100644
--- a/plugins/performance-lab/includes/admin/plugins.php
+++ b/plugins/performance-lab/includes/admin/plugins.php
@@ -296,7 +296,15 @@ static function ( string $error_message ): string {
 		printf(
 			/* translators: %1$s: opening anchor tag, %2$s: closing anchor tag */
 			esc_html__( 'Performance features are installed as plugins. To update features or remove them, %1$s manage them on the plugins screen. %2$s', 'performance-lab' ),
-			'<a href="' . esc_url( admin_url( 'plugins.php?s=WordPress%20Performance%20Team&plugin_status=all' ) ) . '">',
+			'<a href="' . esc_url(
+				add_query_arg(
+					array(
+						's'             => 'WordPress Performance Team',
+						'plugin_status' => 'all',
+					),
+					admin_url( 'plugins.php' )
+				)
+			) . '">',
 			'</a>'
 		);
 		?>

From 7b8312790f9b7fe44e570370bfb96b37c3e84b6c Mon Sep 17 00:00:00 2001
From: Shyamsundar Gadde <shyamgadde1602@gmail.com>
Date: Thu, 12 Dec 2024 21:14:22 +0530
Subject: [PATCH 3/5] Refactor plugins screen message to use `wp_kses`

Co-authored-by: Weston Ruter <westonruter@google.com>
---
 .../includes/admin/plugins.php                | 29 ++++++++++---------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/plugins/performance-lab/includes/admin/plugins.php b/plugins/performance-lab/includes/admin/plugins.php
index 377f984ba..bbfc41a32 100644
--- a/plugins/performance-lab/includes/admin/plugins.php
+++ b/plugins/performance-lab/includes/admin/plugins.php
@@ -293,20 +293,23 @@ static function ( string $error_message ): string {
 	</div>
 	<p>
 		<?php
-		printf(
-			/* translators: %1$s: opening anchor tag, %2$s: closing anchor tag */
-			esc_html__( 'Performance features are installed as plugins. To update features or remove them, %1$s manage them on the plugins screen. %2$s', 'performance-lab' ),
-			'<a href="' . esc_url(
-				add_query_arg(
-					array(
-						's'             => 'WordPress Performance Team',
-						'plugin_status' => 'all',
-					),
-					admin_url( 'plugins.php' )
+			$plugins_url = add_query_arg(
+				array(
+					's'             => 'WordPress Performance Team',
+					'plugin_status' => 'all',
+				),
+				admin_url( 'plugins.php' )
+			);
+			echo wp_kses(
+				sprintf(
+					/* translators: %s is the URL to the plugins screen */
+					__( 'Performance features are installed as plugins. To update features or remove them, <a href="%s">manage them on the plugins screen</a>.', 'performance-lab' ),
+					esc_url( $plugins_url )
+				),
+				array(
+					'a' => array( 'href' => true ),
 				)
-			) . '">',
-			'</a>'
-		);
+			);
 		?>
 	</p>
 	<?php

From 70b51ba60794e963b22935c28e3e83620b57031b Mon Sep 17 00:00:00 2001
From: Shyamsundar Gadde <shyamgadde1602@gmail.com>
Date: Mon, 16 Dec 2024 13:34:09 +0530
Subject: [PATCH 4/5] Only show plugin management link to authorized users

Co-authored-by: Felix Arntz <flixos90@gmail.com>
---
 plugins/performance-lab/includes/admin/plugins.php | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/plugins/performance-lab/includes/admin/plugins.php b/plugins/performance-lab/includes/admin/plugins.php
index bbfc41a32..aabbd6c24 100644
--- a/plugins/performance-lab/includes/admin/plugins.php
+++ b/plugins/performance-lab/includes/admin/plugins.php
@@ -291,8 +291,11 @@ static function ( string $error_message ): string {
 		</div>
 		<div class="clear"></div>
 	</div>
-	<p>
-		<?php
+	<?php
+	if ( current_user_can( 'activate_plugins' ) ) {
+		?>
+		<p>
+			<?php
 			$plugins_url = add_query_arg(
 				array(
 					's'             => 'WordPress Performance Team',
@@ -310,8 +313,10 @@ static function ( string $error_message ): string {
 					'a' => array( 'href' => true ),
 				)
 			);
-		?>
-	</p>
+			?>
+		</p>
+		<?php
+	}
 	<?php
 }
 

From 0aadb1e0585e2294e68875076ef44ddde2eb87d9 Mon Sep 17 00:00:00 2001
From: Shyamsundar Gadde <shyamsundar.gadde@rtcamp.com>
Date: Mon, 16 Dec 2024 13:41:31 +0530
Subject: [PATCH 5/5] Resolve PHP opening tag and whitespace violations

Signed-off-by: Shyamsundar Gadde <shyamsundar.gadde@rtcamp.com>
---
 plugins/performance-lab/includes/admin/plugins.php | 1 -
 1 file changed, 1 deletion(-)

diff --git a/plugins/performance-lab/includes/admin/plugins.php b/plugins/performance-lab/includes/admin/plugins.php
index aabbd6c24..003138e52 100644
--- a/plugins/performance-lab/includes/admin/plugins.php
+++ b/plugins/performance-lab/includes/admin/plugins.php
@@ -317,7 +317,6 @@ static function ( string $error_message ): string {
 		</p>
 		<?php
 	}
-	<?php
 }
 
 /**