phpcs.ruleset.xml

<?xml version="1.0"?>
<ruleset name="WordPress Security">

	<!-- Set a description for this ruleset. -->
	<description>A WordPress Ruleset to check application safety.</description>

	<config name="installed_paths" value="vendor/wp-coding-standards/wpcs" />
	<config name="testVersion" value="7.4-"/>

	<exclude-pattern>assets/*</exclude-pattern>
	<exclude-pattern>node_modules/*</exclude-pattern>
	<exclude-pattern>test/*</exclude-pattern>
	<exclude-pattern>tests/*</exclude-pattern>
	<exclude-pattern>vendor/*</exclude-pattern>
	<exclude-pattern>*.js</exclude-pattern>
	<exclude-pattern>*.css</exclude-pattern>
	<exclude-pattern>assets/*</exclude-pattern>
	<exclude-pattern>~*</exclude-pattern>

	<rule ref="Generic.PHP.Syntax"/>

	<!-- Include the WordPress ruleset, with exclusions. -->
	<rule ref="WordPress.CodeAnalysis">
	</rule>
	<rule ref="WordPress.DB">
	</rule>
	<rule ref="WordPress.NamingConventions.PrefixAllGlobals">
		<exclude name="WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound"/>
		<exclude name="WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound"/>
		<properties>
			<property name="prefixes" type="array">
				<element value="ACFFieldOpenstreet"/>
				<element value="acf_osm"/>
			</property>
		</properties>
	</rule>
	<rule ref="WordPress.PHP">
		<!-- omit non security sniffs -->
		<exclude name="WordPress.PHP.DontExtract"/>
		<exclude name="WordPress.PHP.YodaConditions"/>
	</rule>
	<rule ref="WordPress.Security">
	</rule>
	<rule ref="WordPress.Security.EscapeOutput">
		<properties>
			<property name="customEscapingFunctions" type="array">
				<!-- acf escaping functions -->
				<element value="acf_esc_attr"/>
				<element value="get_the_*"/>
			</property>
		</properties>
    </rule>
	<rule ref="WordPress.Utils">
	</rule>
	<rule ref="WordPress.WP">
	</rule>
</ruleset>