From 410afb75542909fb9838fbb87465071667669f02 Mon Sep 17 00:00:00 2001
From: Justin Foell <630830+jrfoell@users.noreply.github.com>
Date: Fri, 26 Nov 2021 09:47:16 -0600
Subject: [PATCH 01/10] Added API post debugging

---
 src/WPStrava/API.php | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/src/WPStrava/API.php b/src/WPStrava/API.php
index e756e8d..6e632c5 100755
--- a/src/WPStrava/API.php
+++ b/src/WPStrava/API.php
@@ -45,6 +45,21 @@ class WPStrava_API {
 
 		$response = wp_remote_post( $url . $uri, $args );
 
+		if ( WPSTRAVA_DEBUG ) {
+			// phpcs:disable WordPress.PHP.DevelopmentFunctions -- Debug output.
+			error_log(
+				print_r(
+					array(
+						'url'      => $url . $uri,
+						'args'     => $args,
+						'response' => $response,
+					),
+					true
+				)
+			);
+			// phpcs:enable
+		}
+
 		if ( is_wp_error( $response ) ) {
 			throw WPStrava_Exception::from_wp_error( $response );
 		}

From 41552830f226986b7c9974fa9a6b6cf59395c639 Mon Sep 17 00:00:00 2001
From: Justin Foell <630830+jrfoell@users.noreply.github.com>
Date: Fri, 26 Nov 2021 09:53:46 -0600
Subject: [PATCH 02/10] Updated beta version 1

---
 readme.txt    | 6 +++++-
 wp-strava.php | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/readme.txt b/readme.txt
index 70ce305..1c3bf20 100755
--- a/readme.txt
+++ b/readme.txt
@@ -4,7 +4,7 @@ Contributors: cmanon, jrfoell, lancewillett, dlintott, sebastianerb
 Tags: strava, activity, bicycle, cycling, biking, running, run, swimming, swim, paddle, kayak, gps, shortcode, widget, plugin, block, blocks
 Requires at least: 4.6
 Tested up to: 5.8
-Stable tag: 2.10.1
+Stable tag: 2.10.2-beta1
 Requires PHP: 5.3
 License: GPLv2 or later
 
@@ -134,6 +134,10 @@ On the WP-Strava settings page you cannot currently remove and add another athle
 
 == Changelog ==
 
+= 2.10.2 =
+Added debugging for API POST to troubleshoot 401 errors https://wordpress.org/support/topic/wp-strava-error-401-unauthorized/
+
+
 = 2.10.1 =
 Reworked settings save with multiple athletes, related to https://wordpress.org/support/topic/wp-strava-error-401-unauthorized/
 
diff --git a/wp-strava.php b/wp-strava.php
index c732c04..46eb9c9 100755
--- a/wp-strava.php
+++ b/wp-strava.php
@@ -3,7 +3,7 @@
  * Plugin Name: WP Strava
  * Plugin URI: https://wordpress.org/plugins/wp-strava/
  * Description: Show your strava.com activity on your WordPress site. Some Icons are Copyright © Yusuke Kamiyamane. All rights reserved. Licensed under a Creative Commons Attribution 3.0 license.
- * Version: 2.10.1
+ * Version: 2.10.2-beta1
  * Author: Carlos Santa Cruz, Justin Foell, Lance Willett, Daniel Lintott, Sebastian Erb
  * License: GPL2
  * Text Domain: wp-strava

From 01f2cfa90e69a536865112f8ccabcddf37fb60d0 Mon Sep 17 00:00:00 2001
From: Justin Foell <630830+jrfoell@users.noreply.github.com>
Date: Fri, 25 Feb 2022 13:40:42 -0600
Subject: [PATCH 03/10] Beta1

---
 wp-strava.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/wp-strava.php b/wp-strava.php
index b3abd8e..dd246ce 100755
--- a/wp-strava.php
+++ b/wp-strava.php
@@ -27,7 +27,7 @@ along with this program; if not, write to the Free Software
 Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 */
 
-define( 'WPSTRAVA_PLUGIN_VERSION', '2.12.0-beta' );
+define( 'WPSTRAVA_PLUGIN_VERSION', '2.12.0-beta1' );
 define( 'WPSTRAVA_PLUGIN_FILE', __FILE__ );
 define( 'WPSTRAVA_PLUGIN_DIR', trailingslashit( dirname( __FILE__ ) ) );
 define( 'WPSTRAVA_PLUGIN_URL', plugins_url( '/', __FILE__ ) );

From ed4df3cee273558871c6db6e854fc17871cb6430 Mon Sep 17 00:00:00 2001
From: Justin Foell <630830+jrfoell@users.noreply.github.com>
Date: Fri, 29 Apr 2022 14:18:30 -0500
Subject: [PATCH 04/10] Add debug logging to remote_get

---
 src/WPStrava/API.php | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/WPStrava/API.php b/src/WPStrava/API.php
index 6e632c5..5a478b8 100755
--- a/src/WPStrava/API.php
+++ b/src/WPStrava/API.php
@@ -151,6 +151,22 @@ class WPStrava_API {
 		}
 
 		$response = wp_remote_get( $url, $get_args );
+
+		if ( WPSTRAVA_DEBUG ) {
+			// phpcs:disable WordPress.PHP.DevelopmentFunctions -- Debug output.
+			error_log(
+				print_r(
+					array(
+						'url'      => $url,
+						'args'     => $get_args,
+						'response' => $response,
+					),
+					true
+				)
+			);
+			// phpcs:enable
+		}
+
 		if ( is_wp_error( $response ) ) {
 			throw WPStrava_Exception::from_wp_error( $response );
 		}

From fe2589bebfa258b0b3357ab955272140d86789da Mon Sep 17 00:00:00 2001
From: Justin Foell <630830+jrfoell@users.noreply.github.com>
Date: Fri, 29 Apr 2022 15:23:57 -0500
Subject: [PATCH 05/10] Updated changelog

---
 readme.txt | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/readme.txt b/readme.txt
index ab129dd..3266dfc 100755
--- a/readme.txt
+++ b/readme.txt
@@ -3,12 +3,8 @@
 Contributors: cmanon, jrfoell, lancewillett, dlintott, sebastianerb
 Tags: strava, activity, bicycle, cycling, biking, running, run, swimming, swim, paddle, kayak, gps, shortcode, widget, plugin, block, blocks
 Requires at least: 4.6
-Tested up to: 5.8
-<<<<<<< HEAD
-Stable tag: 2.10.2-beta1
-=======
-Stable tag: 2.11.0
->>>>>>> @{-1}
+Tested up to: 5.9
+Stable tag: 2.12.0-beta2
 Requires PHP: 5.3
 License: GPLv2 or later
 
@@ -138,7 +134,7 @@ On the WP-Strava settings page you cannot currently remove and add another athle
 
 == Changelog ==
 
-= 2.12.0-beta1 =
+= 2.12.0-beta2 =
 Added debugging for API POST to troubleshoot 401 errors https://wordpress.org/support/topic/wp-strava-error-401-unauthorized/
 
 = 2.11.0 =

From dabe0a48c73990723907aaca9a7448ecf17f2fd1 Mon Sep 17 00:00:00 2001
From: Justin Foell <630830+jrfoell@users.noreply.github.com>
Date: Fri, 26 Aug 2022 14:31:19 -0500
Subject: [PATCH 06/10] Require (rather than include) blocks if WP5+

---
 src/WPStrava.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/WPStrava.php b/src/WPStrava.php
index 212b100..af6aeeb 100644
--- a/src/WPStrava.php
+++ b/src/WPStrava.php
@@ -243,7 +243,7 @@ class WPStrava {
 		);
 
 		// automatically load dependencies and version
-		$asset_file = include WPSTRAVA_PLUGIN_DIR . 'build/index.asset.php';
+		$asset_file = require WPSTRAVA_PLUGIN_DIR . 'build/index.asset.php';
 
 		wp_register_script(
 			'wp-strava-block',

From 90cb573c28c0ec55fbe8492b5790b0eca6d93b37 Mon Sep 17 00:00:00 2001
From: Justin Foell <630830+jrfoell@users.noreply.github.com>
Date: Fri, 26 Aug 2022 14:32:01 -0500
Subject: [PATCH 07/10] Simplify retry

---
 src/WPStrava/API.php | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/src/WPStrava/API.php b/src/WPStrava/API.php
index 5a478b8..131b175 100755
--- a/src/WPStrava/API.php
+++ b/src/WPStrava/API.php
@@ -177,11 +177,8 @@ class WPStrava_API {
 			$auth  = WPStrava::get_instance()->auth;
 			if ( $auth instanceof WPStrava_AuthRefresh ) {
 				$auth->auth_refresh();
-				$access_token = $this->get_access_token();
-				if ( $access_token ) {
-					$get_args['headers']['Authorization'] = 'Bearer ' . $access_token;
-				}
-				return $this->remote_get( $uri, $get_args );
+				// Try again.
+				return $this->remote_get( $uri, $args );
 			}
 		}
 

From 38a6a59ff2198d29f9690f1e66cb3c3e79757ea1 Mon Sep 17 00:00:00 2001
From: Justin Foell <630830+jrfoell@users.noreply.github.com>
Date: Fri, 30 Sep 2022 11:24:02 -0500
Subject: [PATCH 08/10] Add debug info textarea

---
 src/WPStrava/Settings.php | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

diff --git a/src/WPStrava/Settings.php b/src/WPStrava/Settings.php
index d4b8401..3149cf4 100644
--- a/src/WPStrava/Settings.php
+++ b/src/WPStrava/Settings.php
@@ -114,6 +114,11 @@ class WPStrava_Settings {
 		// Clear cache.
 		register_setting( $this->option_page, 'strava_cache_clear', array( $this, 'sanitize_cache_clear' ) );
 		add_settings_field( 'strava_cache_clear', __( 'Clear cache', 'wp-strava' ), array( $this, 'print_clear_input' ), 'wp-strava', 'strava_cache' );
+
+		if ( WPSTRAVA_DEBUG ) {
+			add_settings_section( 'strava_debug', __( 'Debug', 'wp-strava' ), null, 'wp-strava' );
+			add_settings_field( 'strava_debug_info', __( 'Connection Info', 'wp-strava' ), array( $this, 'print_debug_info' ), 'wp-strava', 'strava_debug' );
+		}
 	}
 
 	/**
@@ -449,7 +454,8 @@ class WPStrava_Settings {
 		$infos = $this->info;
 
 		foreach ( $infos as $id => $info ) {
-			if ( ! in_array( $id, $ids ) ) { // phpcs:ignore WordPress.PHP.StrictInArray.MissingTrueStrict -- loose OK.
+			// phpcs:ignore WordPress.PHP.StrictInArray.MissingTrueStrict -- Loose comparison OK.
+			if ( ! in_array( $id, $ids ) ) {
 				$update = true;
 				unset( $infos[ $id ] );
 			}
@@ -677,6 +683,17 @@ class WPStrava_Settings {
 		<?php
 	}
 
+	/**
+	 * Print stored connection info.
+	 *
+	 * @author Justin Foell <justin@foell.org>
+	 * @since  NEXT
+	 */
+	public function print_debug_info() {
+		// phpcs:ignore Squiz.PHP.EmbeddedPhp, WordPress.PHP.DevelopmentFunctions -- Formatting & debug OK.
+		?><textarea style="width: 100%;" rows="11" readonly="readonly"><?php print_r( get_option( 'strava_info' ) ); ?></textarea><?php
+	}
+
 	/**
 	 * Sanitize cache time input.
 	 *
@@ -875,7 +892,8 @@ class WPStrava_Settings {
 	 * @since  2.0.0
 	 */
 	public function is_option_page() {
-		return filter_input( INPUT_POST, 'option_page', FILTER_SANITIZE_STRING ) === $this->option_page;
+		// phpcs:ignore WordPress.Security.NonceVerification -- Comparison only.
+		return htmlspecialchars( $_POST['options_page'], ENT_QUOTES, get_bloginfo( 'charset' ) ) === $this->option_page;
 	}
 
 	/**
@@ -886,7 +904,8 @@ class WPStrava_Settings {
 	 * @since  2.0.0
 	 */
 	public function is_settings_page() {
-		return filter_input( INPUT_GET, 'page', FILTER_SANITIZE_STRING ) === $this->page_name;
+		// phpcs:ignore WordPress.Security.NonceVerification -- Comparison only.
+		return htmlspecialchars( $_GET['page'], ENT_QUOTES, get_bloginfo( 'charset' ) ) === $this->page_name;
 	}
 
 	/**
@@ -908,7 +927,8 @@ class WPStrava_Settings {
 	 * @since  2.0.0
 	 */
 	private function is_adding_athlete() {
-		return filter_input( INPUT_POST, 'strava_client_id', FILTER_SANITIZE_NUMBER_INT ) && filter_input( INPUT_POST, 'strava_client_secret', FILTER_SANITIZE_STRING );
+		return filter_input( INPUT_POST, 'strava_client_id', FILTER_SANITIZE_NUMBER_INT ) &&
+			htmlspecialchars( $_POST['strava_client_secret'], ENT_QUOTES, get_bloginfo( 'charset' ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Comparison only.
 	}
 
 	/**

From 46a67d18ecb42b041c45c5c4b328e434de6de669 Mon Sep 17 00:00:00 2001
From: Justin Foell <630830+jrfoell@users.noreply.github.com>
Date: Fri, 30 Sep 2022 13:47:48 -0500
Subject: [PATCH 09/10] Reset filter, renamed is_options_page() function,
 changed option_page to option_group

---
 src/WPStrava/Auth.php        |  8 +++---
 src/WPStrava/Settings.php    | 49 ++++++++++++++++++------------------
 templates/admin-settings.php |  2 +-
 3 files changed, 29 insertions(+), 30 deletions(-)

diff --git a/src/WPStrava/Auth.php b/src/WPStrava/Auth.php
index ce6838d..db3cb8e 100644
--- a/src/WPStrava/Auth.php
+++ b/src/WPStrava/Auth.php
@@ -47,7 +47,7 @@ abstract class WPStrava_Auth {
 				'filter' => FILTER_SANITIZE_NUMBER_INT,
 				'flags'  => FILTER_REQUIRE_SCALAR,
 			),
-			'strava_client_secret' => FILTER_SANITIZE_STRING,
+			'strava_client_secret' => FILTER_SANITIZE_FULL_SPECIAL_CHARS,
 		);
 
 		$input = filter_input_array( INPUT_POST, $input_args );
@@ -57,7 +57,7 @@ abstract class WPStrava_Auth {
 		}
 
 		// Redirect only if all the right options are in place.
-		if ( $settings->is_settings_updated( $value ) && $settings->is_option_page() ) {
+		if ( $settings->is_settings_updated( $value ) && $settings->is_options_page() ) {
 			// Only re-auth if client ID and secret were saved.
 			if ( ! empty( $input['strava_client_id'] ) && ! empty( $input['strava_client_secret'] ) ) {
 				wp_redirect( $this->get_authorize_url( $input['strava_client_id'] ) );
@@ -71,8 +71,8 @@ abstract class WPStrava_Auth {
 		$settings = WPStrava::get_instance()->settings;
 
 		$input_args = array(
-			'settings-updated' => FILTER_SANITIZE_STRING,
-			'code'             => FILTER_SANITIZE_STRING,
+			'settings-updated' => FILTER_SANITIZE_FULL_SPECIAL_CHARS,
+			'code'             => FILTER_SANITIZE_FULL_SPECIAL_CHARS,
 		);
 
 		$input = filter_input_array( INPUT_GET, $input_args );
diff --git a/src/WPStrava/Settings.php b/src/WPStrava/Settings.php
index 3149cf4..704f687 100644
--- a/src/WPStrava/Settings.php
+++ b/src/WPStrava/Settings.php
@@ -12,7 +12,7 @@ class WPStrava_Settings {
 
 	private $ids            = array();
 	private $page_name      = 'wp-strava-options';
-	private $option_page    = 'wp-strava-settings-group';
+	private $option_group   = 'wp-strava-settings-group';
 	private $adding_athlete = true;
 
 	/**
@@ -58,21 +58,21 @@ class WPStrava_Settings {
 
 		$ids = $this->get_ids();
 		if ( $this->ids_empty( $ids ) ) {
-			register_setting( $this->option_page, 'strava_client_id', array( $this, 'sanitize_client_id' ) );
-			register_setting( $this->option_page, 'strava_client_secret', array( $this, 'sanitize_client_secret' ) );
-			register_setting( $this->option_page, 'strava_nickname', array( $this, 'sanitize_nickname' ) );
+			register_setting( $this->option_group, 'strava_client_id', array( $this, 'sanitize_client_id' ) );
+			register_setting( $this->option_group, 'strava_client_secret', array( $this, 'sanitize_client_secret' ) );
+			register_setting( $this->option_group, 'strava_nickname', array( $this, 'sanitize_nickname' ) );
 
 			add_settings_field( 'strava_client_id', __( 'Strava Client ID', 'wp-strava' ), array( $this, 'print_client_input' ), 'wp-strava', 'strava_api' );
 			add_settings_field( 'strava_client_secret', __( 'Strava Client Secret', 'wp-strava' ), array( $this, 'print_secret_input' ), 'wp-strava', 'strava_api' );
 			add_settings_field( 'strava_nickname', __( 'Strava Nickname', 'wp-strava' ), array( $this, 'print_nickname_input' ), 'wp-strava', 'strava_api' );
 		} else {
-			register_setting( $this->option_page, 'strava_id', array( $this, 'sanitize_id' ) );
+			register_setting( $this->option_group, 'strava_id', array( $this, 'sanitize_id' ) );
 			add_settings_field( 'strava_id', __( 'Saved ID', 'wp-strava' ), array( $this, 'print_id_input' ), 'wp-strava', 'strava_api' );
 
 			// Add additional fields
-			register_setting( $this->option_page, 'strava_client_id', array( $this, 'sanitize_client_id' ) );
-			register_setting( $this->option_page, 'strava_client_secret', array( $this, 'sanitize_client_secret' ) );
-			register_setting( $this->option_page, 'strava_nickname', array( $this, 'sanitize_nickname' ) );
+			register_setting( $this->option_group, 'strava_client_id', array( $this, 'sanitize_client_id' ) );
+			register_setting( $this->option_group, 'strava_client_secret', array( $this, 'sanitize_client_secret' ) );
+			register_setting( $this->option_group, 'strava_nickname', array( $this, 'sanitize_nickname' ) );
 
 			add_settings_field( 'strava_client_id', __( 'Additional Athlete Client ID', 'wp-strava' ), array( $this, 'print_client_input' ), 'wp-strava', 'strava_api' );
 			add_settings_field( 'strava_client_secret', __( 'Additional Athlete Client Secret', 'wp-strava' ), array( $this, 'print_secret_input' ), 'wp-strava', 'strava_api' );
@@ -82,37 +82,37 @@ class WPStrava_Settings {
 		// Google Maps API.
 		add_settings_section( 'strava_maps', __( 'Maps', 'wp-strava' ), null, 'wp-strava' );
 
-		register_setting( $this->option_page, 'strava_map_type', array( $this, 'sanitize_map_type' ) );
+		register_setting( $this->option_group, 'strava_map_type', array( $this, 'sanitize_map_type' ) );
 		add_settings_field( 'strava_map_type', __( 'Map Type', 'wp-strava' ), array( $this, 'print_map_type_input' ), 'wp-strava', 'strava_maps' );
 
-		register_setting( $this->option_page, 'strava_gmaps_key', array( $this, 'sanitize_gmaps_key' ) );
+		register_setting( $this->option_group, 'strava_gmaps_key', array( $this, 'sanitize_gmaps_key' ) );
 		add_settings_field( 'strava_gmaps_key', __( 'Google Static Maps API Key', 'wp-strava' ), array( $this, 'print_gmaps_key_input' ), 'wp-strava', 'strava_maps' );
 
-		register_setting( $this->option_page, 'strava_mapbox_token', array( $this, 'sanitize_mapbox_token' ) );
+		register_setting( $this->option_group, 'strava_mapbox_token', array( $this, 'sanitize_mapbox_token' ) );
 		add_settings_field( 'strava_mapbox_token', __( 'Mapbox Public Token', 'wp-strava' ), array( $this, 'print_mapbox_token_input' ), 'wp-strava', 'strava_maps' );
 
 		// System of Measurement.
-		register_setting( $this->option_page, 'strava_som', array( $this, 'sanitize_som' ) );
+		register_setting( $this->option_group, 'strava_som', array( $this, 'sanitize_som' ) );
 		add_settings_section( 'strava_options', __( 'Options', 'wp-strava' ), null, 'wp-strava' );
 		add_settings_field( 'strava_som', __( 'System of Measurement', 'wp-strava' ), array( $this, 'print_som_input' ), 'wp-strava', 'strava_options' );
 
 		// Hide Options.
-		register_setting( $this->option_page, 'strava_hide_time', array( $this, 'sanitize_hide_time' ) );
+		register_setting( $this->option_group, 'strava_hide_time', array( $this, 'sanitize_hide_time' ) );
 		add_settings_field( 'strava_hide_time', __( 'Time', 'wp-strava' ), array( $this, 'print_hide_time_input' ), 'wp-strava', 'strava_options' );
-		register_setting( $this->option_page, 'strava_hide_elevation', array( $this, 'sanitize_hide_elevation' ) );
+		register_setting( $this->option_group, 'strava_hide_elevation', array( $this, 'sanitize_hide_elevation' ) );
 		add_settings_field( 'strava_hide_elevation', __( 'Elevation', 'wp-strava' ), array( $this, 'print_hide_elevation_input' ), 'wp-strava', 'strava_options' );
 
 		// No Activity Links.
-		register_setting( $this->option_page, 'strava_no_link', array( $this, 'sanitize_no_link' ) );
+		register_setting( $this->option_group, 'strava_no_link', array( $this, 'sanitize_no_link' ) );
 		add_settings_field( 'strava_no_link', __( 'Links', 'wp-strava' ), array( $this, 'print_no_link_input' ), 'wp-strava', 'strava_options' );
 
 		// Cache lifetime.
-		register_setting( $this->option_page, 'strava_cache_time', array( $this, 'sanitize_cache_time' ) );
+		register_setting( $this->option_group, 'strava_cache_time', array( $this, 'sanitize_cache_time' ) );
 		add_settings_section( 'strava_cache', __( 'Cache', 'wp-strava' ), null, 'wp-strava' );
 		add_settings_field( 'strava_cache_time', __( 'Cache time', 'wp-strava' ), array( $this, 'print_cache_input' ), 'wp-strava', 'strava_cache' );
 
 		// Clear cache.
-		register_setting( $this->option_page, 'strava_cache_clear', array( $this, 'sanitize_cache_clear' ) );
+		register_setting( $this->option_group, 'strava_cache_clear', array( $this, 'sanitize_cache_clear' ) );
 		add_settings_field( 'strava_cache_clear', __( 'Clear cache', 'wp-strava' ), array( $this, 'print_clear_input' ), 'wp-strava', 'strava_cache' );
 
 		if ( WPSTRAVA_DEBUG ) {
@@ -691,7 +691,7 @@ class WPStrava_Settings {
 	 */
 	public function print_debug_info() {
 		// phpcs:ignore Squiz.PHP.EmbeddedPhp, WordPress.PHP.DevelopmentFunctions -- Formatting & debug OK.
-		?><textarea style="width: 100%;" rows="11" readonly="readonly"><?php print_r( get_option( 'strava_info' ) ); ?></textarea><?php
+		?><textarea style="width: 100%;" rows="11" readonly="readonly"><?php var_export( get_option( 'strava_info' ) ); ?></textarea><?php
 	}
 
 	/**
@@ -885,15 +885,15 @@ class WPStrava_Settings {
 	}
 
 	/**
-	 * Whether or not we're on the options page.
+	 * Whether or not we're on the options.php page (saving options).
 	 *
 	 * @return boolean
 	 * @author Justin Foell <justin@foell.org>
 	 * @since  2.0.0
 	 */
-	public function is_option_page() {
-		// phpcs:ignore WordPress.Security.NonceVerification -- Comparison only.
-		return htmlspecialchars( $_POST['options_page'], ENT_QUOTES, get_bloginfo( 'charset' ) ) === $this->option_page;
+	public function is_options_page() {
+		$screen = get_current_screen();
+		return isset( $screen->id ) && 'options' === $screen->id;
 	}
 
 	/**
@@ -904,8 +904,7 @@ class WPStrava_Settings {
 	 * @since  2.0.0
 	 */
 	public function is_settings_page() {
-		// phpcs:ignore WordPress.Security.NonceVerification -- Comparison only.
-		return htmlspecialchars( $_GET['page'], ENT_QUOTES, get_bloginfo( 'charset' ) ) === $this->page_name;
+		return filter_input( INPUT_GET, 'page', FILTER_SANITIZE_FULL_SPECIAL_CHARS ) === $this->page_name;
 	}
 
 	/**
@@ -928,7 +927,7 @@ class WPStrava_Settings {
 	 */
 	private function is_adding_athlete() {
 		return filter_input( INPUT_POST, 'strava_client_id', FILTER_SANITIZE_NUMBER_INT ) &&
-			htmlspecialchars( $_POST['strava_client_secret'], ENT_QUOTES, get_bloginfo( 'charset' ) ); // phpcs:ignore WordPress.Security.NonceVerification.Missing -- Comparison only.
+			filter_input( INPUT_POST, 'strava_client_secret', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
 	}
 
 	/**
diff --git a/templates/admin-settings.php b/templates/admin-settings.php
index 6d732fc..5cd3e8b 100644
--- a/templates/admin-settings.php
+++ b/templates/admin-settings.php
@@ -3,7 +3,7 @@
 	<h2><?php esc_html_e( 'Strava Settings', 'wp-strava' ); ?></h2>
 
 	<form method="post" action="<?php echo esc_attr( admin_url( 'options.php' ) ); ?>">
-		<?php settings_fields( $this->option_page ); ?>
+		<?php settings_fields( $this->option_group ); ?>
 		<?php do_settings_sections( 'wp-strava' ); ?>
 
 		<p class="submit">

From 8b47fbabfd70117000afa2a3cf2d76f6ff74c76f Mon Sep 17 00:00:00 2001
From: Justin Foell <630830+jrfoell@users.noreply.github.com>
Date: Fri, 30 Sep 2022 13:48:54 -0500
Subject: [PATCH 10/10] Calling this 2.12

---
 readme.txt    | 17 +++++------------
 wp-strava.php |  4 ++--
 2 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/readme.txt b/readme.txt
index afd4d52..98876ba 100755
--- a/readme.txt
+++ b/readme.txt
@@ -3,13 +3,8 @@
 Contributors: cmanon, jrfoell, lancewillett, dlintott, sebastianerb
 Tags: strava, activity, bicycle, cycling, biking, running, run, swimming, swim, paddle, kayak, gps, shortcode, widget, plugin, block, blocks
 Requires at least: 4.6
-<<<<<<< HEAD
-Tested up to: 5.9
-Stable tag: 2.12.0-beta2
-=======
 Tested up to: 6.0
-Stable tag: 2.11.2
->>>>>>> @{-1}
+Stable tag: 2.12.0
 Requires PHP: 5.3
 License: GPLv2 or later
 
@@ -139,22 +134,20 @@ On the WP-Strava settings page you cannot currently remove and add another athle
 
 == Changelog ==
 
-= Unreleased =
-Added debugging for API POST to troubleshoot 401 errors https://wordpress.org/support/topic/wp-strava-error-401-unauthorized/
-
-
-= 2.11.2 =
+= 2.12.0 =
 Update documentation around block embeds https://wordpress.org/support/topic/which-editor-to-use-2/
+Added debugging for API GET/POST to troubleshoot 401 errors https://wordpress.org/support/topic/wp-strava-error-401-unauthorized/
 
 
 = 2.11.1 =
 Add class selector to responsive tables https://wordpress.org/support/topic/shortcode-embed-responsive-table-styling-issues/
->>>>>>> @{-1}
+
 
 = 2.11.0 =
 Add additional block transformations for "Activity" (from: Paragraph, Classic Shortcode; to: Paragraph)
 Add Mapbox Static Map support https://github.com/cmanon/wp-strava/issues/26
 
+
 = 2.10.1 =
 Reworked settings save with multiple athletes, related to https://wordpress.org/support/topic/wp-strava-error-401-unauthorized/
 
diff --git a/wp-strava.php b/wp-strava.php
index d3e7b0a..eba1c63 100755
--- a/wp-strava.php
+++ b/wp-strava.php
@@ -3,7 +3,7 @@
  * Plugin Name: WP Strava
  * Plugin URI: https://wordpress.org/plugins/wp-strava/
  * Description: Show your strava.com activity on your WordPress site. Some Icons are Copyright © Yusuke Kamiyamane. All rights reserved. Licensed under a Creative Commons Attribution 3.0 license.
- * Version: 2.12.0-beta2
+ * Version: 2.12.0
  * Author: Carlos Santa Cruz, Justin Foell, Lance Willett, Daniel Lintott, Sebastian Erb
  * License: GPL2
  * Text Domain: wp-strava
@@ -28,7 +28,7 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 */
 
 
-define( 'WPSTRAVA_PLUGIN_VERSION', '2.12.0-beta1' );
+define( 'WPSTRAVA_PLUGIN_VERSION', '2.12.0' );
 define( 'WPSTRAVA_PLUGIN_FILE', __FILE__ );
 define( 'WPSTRAVA_PLUGIN_DIR', trailingslashit( dirname( __FILE__ ) ) );
 define( 'WPSTRAVA_PLUGIN_URL', plugins_url( '/', __FILE__ ) );