Photo Directory: make EXIF value handling consistent and escape metadata output

[obenland]

Photo::get_exif() normalises the camera settings it returns, but the iso case only sets a label and passes its value straight through, while aperture, focal_length and shutter_speed each cast or reformat theirs. This casts iso to an integer for consistency and skips non-positive values the same way focal_length does.

While in there, metadata is now escaped where it is rendered rather than assumed safe from its storage path:

• show_exif() — label and value
• show_colors() / show_categories() / show_tags() — term names
• Photo::get_moderator_link() and the flag/unflag admin notice — esc_html() for the display name instead of sanitize_text_field(), which is a sanitiser rather than an escaper, plus esc_url() on the adjacent profile link
• the pending-submissions table — stored original filename and date
• the flagged-photos count link — esc_url()

No behaviour change beyond ISO now rendering as a plain integer.

Companion change in the theme: WordPress/wporg-photo-directory (meta-list block renders these same values).

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props obenland.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

Pull request overview

This PR hardens the Photo Directory plugin’s metadata rendering by consistently escaping user/content-derived values at output time, and it makes Photo::get_exif() treat iso like the other camera settings by normalizing it to a positive integer.

Changes:

• Normalize EXIF iso to an integer and skip non-positive values for consistency with other EXIF fields.
• Escape metadata output at render time across EXIF output, taxonomy term names, moderator display names/profile links, pending-submission rows, and flagged-photo links.
• Replace sanitize_text_field() (sanitization) with esc_html() (output escaping) where values are being rendered.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
wordpress.org/public_html/wp-content/plugins/photo-directory/inc/template-tags.php	Escapes term names (colors/categories/tags) and EXIF labels/values when rendering.
wordpress.org/public_html/wp-content/plugins/photo-directory/inc/photo.php	Normalizes EXIF ISO to positive int; escapes moderator display name in rendered moderator link.
wordpress.org/public_html/wp-content/plugins/photo-directory/inc/moderation.php	Escapes original filename and submission date when rendering pending submissions table rows.
wordpress.org/public_html/wp-content/plugins/photo-directory/inc/flagged.php	Escapes the flagged-photos count link URL before output.
wordpress.org/public_html/wp-content/plugins/photo-directory/inc/admin.php	Escapes profile URL and display name in the flagged/unflagged admin notice.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.