Fix unslashed REMOTE_ADDR warning in email provider

[masteradhoc]

What?

This fixes the remaining Plugin Check warning outside of the intentionally skipped includes files.

The email provider now applies wp_unslash() to $_SERVER['REMOTE_ADDR'] before the existing sanitization step, matching WordPress input-handling expectations while preserving the current output filtering.

Validation: npm run lint:php -- providers/class-two-factor-email.php passes.

Fixes #

Why?

Pass the Plugin Check Checks

How?

Changelog Entry

Fixed - Unslash REMOTE_ADDR before sanitizing it in the email provider.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: masteradhoc <masteradhoc@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

🟢 Approval recommended

The functional change is minimal and aligns with WordPress sanitization expectations; only a minor inline-comment grammar nit was found.

Pull request overview

This PR updates the Two-Factor Email provider to unslash $_SERVER['REMOTE_ADDR'] before sanitizing it, resolving a remaining Plugin Check warning (outside the intentionally skipped includes/ files) while keeping the existing character allowlist filtering.

Changes:

• Apply wp_unslash() to $_SERVER['REMOTE_ADDR'] before the existing preg_replace() sanitization in the Email provider.

File summaries

File	Description
providers/class-two-factor-email.php	Unslashes REMOTE_ADDR prior to sanitization to align with WordPress input-handling expectations and address Plugin Check warnings.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.