Adds the required infrastructure to render block-based themes. This is sourced
from the Gutenberg plugin.
Fixes#54335.
Props bernhard-reiter, youknowriad, ntsekouras, hellofromtonya.
git-svn-id: https://develop.svn.wordpress.org/trunk@52062 602fd350-edb4-49c9-b593-d223f7449a82
In the bookmarks walker `_walk_bookmarks()`, add a `'noopener'` to the bookmark's `rel` attribute when there's `target` attribute.
Adds a new test class for `wp_list_bookmarks()` and tests for this change.
Follow-up to [3880], [10712].
Props birgire, costdev, hellofromTonya, mukesh27 , sergeybiryukov, tw2113.
Fixes#53839.
git-svn-id: https://develop.svn.wordpress.org/trunk@52061 602fd350-edb4-49c9-b593-d223f7449a82
This commit ports the global styles rest endpoints from the Gutenberg plugin into the core.
See #54336.
Props oandregal, aristath, timothyblynjacobs, spacedmonkey, youknowriad.
git-svn-id: https://develop.svn.wordpress.org/trunk@52051 602fd350-edb4-49c9-b593-d223f7449a82
This commit ports to core the changes to the classes that deal with theme.json code.
See #54336.
Props oandregal, spacedmonkey, noisysocks, hellofromtonya, youknowriad.
git-svn-id: https://develop.svn.wordpress.org/trunk@52049 602fd350-edb4-49c9-b593-d223f7449a82
Similar to `wp_array_slice_assoc()` or other array-related functions, this appears to be a general-purpose function unrelated to the Formatting component.
Add missing `public` visibility keyword.
Follow-up to [52037].
See #53971.
git-svn-id: https://develop.svn.wordpress.org/trunk@52048 602fd350-edb4-49c9-b593-d223f7449a82
This brings the JS packages up to date and is the first step that will allow us
to include the other block editor updates for WordPress 5.9:
FSE infrastrucutre, site editor and global styles.
Props noisysocks.
See #54337.
git-svn-id: https://develop.svn.wordpress.org/trunk@52042 602fd350-edb4-49c9-b593-d223f7449a82
Adds new test class `Tests_Functions_WpIsNumericArray` for `wp_is_numeric_array()`.
Props pbearne, hareesh-pillai, hellofromTonya.
Fixes#53971.
git-svn-id: https://develop.svn.wordpress.org/trunk@52037 602fd350-edb4-49c9-b593-d223f7449a82
When styles got inlined, relative URLs break. The problem was that URLs inside CSS files are relative to the stylesheet's path, and when styles get inlined that relation is lost. This patch fixes the issue by finding relative URLs which then get modified to be relative to the site's root.
Fixes#54243.
Props aristath, cdyerkes, hellofromtonya.
git-svn-id: https://develop.svn.wordpress.org/trunk@52036 602fd350-edb4-49c9-b593-d223f7449a82
Add a filter that disables output of the icon on RSS feed widgets. Improves accessibility by providing a path to prevent duplicate or invisible links.
Props sabernhardt, Boniu91.
Fixes#52224.
git-svn-id: https://develop.svn.wordpress.org/trunk@52031 602fd350-edb4-49c9-b593-d223f7449a82
This allows for themes that are included inside of a subdirectory, for example `subdir/my-theme`, to be accessed via the single item route of the `/wp/v2/themes` controller.
Fixes#54349.
git-svn-id: https://develop.svn.wordpress.org/trunk@52017 602fd350-edb4-49c9-b593-d223f7449a82
By default, only users with the `edit_theme_options` capability can access the sidebars and widgets REST API endpoints. In this commit, A new `show_in_rest` parameter is added to the `register_sidebar` function. When enabled, all users will be able to access that sidebar and any widgets belonging to that sidebar.
This commit reduces the `context` for a widget's `instance` information to only `edit`. This is to ensure that internal widget data is not inadvertently exposed to the public. A future ticket may expose additional APIs to allow widget authors to indicate that their instance data can be safely exposed. REST API consumers intending to access this `instance` information should take care to explicitly set the `context` parameter to `edit`.
Props spacedmonkey, zieladam.
Fixes#53915.
git-svn-id: https://develop.svn.wordpress.org/trunk@52016 602fd350-edb4-49c9-b593-d223f7449a82
Adds a `public` visibility to test fixtures, tests, data providers, and callbacks methods.
Adds a `private` visibility to helper methods within test classes.
Renames callbacks and helpers that previously started with a `_` prefix. Why? For consistency and to leverage using the method visibility. Further naming standardizations is beyond the scope of this commit.
Props costdev, jrf, hellofromTonya.
Fixes#54177.
git-svn-id: https://develop.svn.wordpress.org/trunk@52010 602fd350-edb4-49c9-b593-d223f7449a82
This commit adds the `public` visibility keyword to each method which did not have an explicit visibility keyword.
Why `public`?
With no visibility previously declared, these methods are implicitly `public` and available for use. As these are part of the WordPress testing framework (for Core and extenders), changing them to anything else would be a backwards-compatibility break.
Props costdev, jrf, hellofromTonya.
See #54177.
git-svn-id: https://develop.svn.wordpress.org/trunk@52009 602fd350-edb4-49c9-b593-d223f7449a82
This resolves an issue where setting up `$_REQUEST['post_type']` and not clearing it afterwards in `Tests_Admin_IncludesScreen::setup_block_editor_test()` started affecting a few `WP_Comments_List_Table` tests after [51997]. It also ensures a similar issue does not inadvertently happen in other tests.
Follow-up to [760/tests], [51997].
See #53363.
git-svn-id: https://develop.svn.wordpress.org/trunk@51999 602fd350-edb4-49c9-b593-d223f7449a82
These were previously combined in the `includesListTable.php` file. Since the tests were specific neither to the `_get_list_table()` function nor the parent `WP_List_Table` class, the naming was confusing, which should now be resolved.
Follow-up to [31730], [38854], [40297], [48151], [48521], [49190], [51993].
See #53363.
git-svn-id: https://develop.svn.wordpress.org/trunk@51997 602fd350-edb4-49c9-b593-d223f7449a82
Adds the `@covers` tag to the test DocBlock.
Adds missing `public` visibility to the test method.
Follow-up to [25002].
Props pbearne, jrf, hellofromTonya.
See #39265.
git-svn-id: https://develop.svn.wordpress.org/trunk@51994 602fd350-edb4-49c9-b593-d223f7449a82
This change prevents non-visible characters in titles from creating encoded values in permalinks, opting instead for the following replacement strategy:
* Non-visible non-zero-width characters are replaced with hyphens
* Non-visible zero-width characters are removed entirely
Included with this change are 64 additional PHPUnit assertions to confirm that only the targeted non-visible characters are sanitized as intended.
Before this change, URLs would unintentionally contain encoded values where these non-visible characters were. After this change, URLs intentionally strip out or hyphenate these non-visible characters.
Props costdev, dhanendran, hellofromtonya, paaljoachim, peterwilsoncc, poena, sergeybiryukov.
Fixes#47912.
git-svn-id: https://develop.svn.wordpress.org/trunk@51984 602fd350-edb4-49c9-b593-d223f7449a82
Adds a new REST API endpoint (`/wp-block-editor/v1/url-details`) for retrieving information from an external URL.
Information retrieved:
* Title: content of the `<title>` element
* Icon: favicon image link
* Description: content of the `description` or `og:description` meta element
* Image: OG image link
This endpoint is used by the block editor for link previews.
Props get_dave, aduth, andraganescu, beaulebens, hellofromTonya, kevin940726, mamaduka, marekhrabe, mnelson4, noisysocks, obenland, ocean90, retrofox, shaunandrews, spacedmonkey, swissspidy, timothyblynjacobs, xknown, youknowriad.
Fixes#54358.
git-svn-id: https://develop.svn.wordpress.org/trunk@51973 602fd350-edb4-49c9-b593-d223f7449a82
Adds an expectation for PHP 8.1 "passing null to non-nullable" deprecation notice to select tests where the deprecation is generated by one of the functions in the `wp-includes/formatting.php` file, either via a filter hook callback or by a direct call.
Instead of haphazardly fixing these issues exposed by the tests, a more structural and all-encompassing solution for input validation should be architected and implemented as otherwise, we'll keep running into similar issues time and again with each new PHP version.
To discourage people from "fixing" these issues now anyway, this commit "hides" nearly all of these issues from the test runs.
Once a more structural solution is designed, these tests and the underlying functions causing the deprecation notices should be revisited and the structural solution put in place.
Includes a few minor other tweaks to select tests:
* Removing a stray `return` (twice) from assertion statements.
* Removing calls to `ob_*()` functions in favour of letting PHPUnit manage the output catching. This prevents warnings along the lines of `Test code or tested code did not (only) close its own output buffers`.
Props jrf, hellofromTonya.
See #53635.
git-svn-id: https://develop.svn.wordpress.org/trunk@51968 602fd350-edb4-49c9-b593-d223f7449a82
While a taxonomy can define a custom route by using the rest_base argument, a namespace of wp/v2 was assumed. This commit introduces support for a rest_namespace argument.
A new rest_get_route_for_taxonomy_items function has been introduced and the rest_get_route_for_term function updated to facilitate getting the correct route for taxonomies.
For maximum compatibility sticking with the default wp/v2 namespace is recommended until the API functions see wider use.
Props spacedmonkey.
Fixes#54267.
See [51962].
git-svn-id: https://develop.svn.wordpress.org/trunk@51964 602fd350-edb4-49c9-b593-d223f7449a82
This change adds two now attribute-related config options to KSES:
- An array of allowed values can be defined for attributes. If the attribute value doesn't fall into the list, the attribute will be removed from the tag.
- Attributes can be marked as required. If a required attribute is not present, KSES will remove all attributes from the tag. As KSES doesn't match opening and closing tags, it's not possible to safely remove the tag itself, the safest fallback is to strip all attributes from the tag, instead.
Included with this change is an implementation of these options, allowing the `<object>` tag to be stored in posts, but only when it has a `type` attribute set to `application/pdf`.
Props pento, swissspidy, peterwilsoncc, dd32, jorbin.
Fixes#54261.
git-svn-id: https://develop.svn.wordpress.org/trunk@51963 602fd350-edb4-49c9-b593-d223f7449a82
While a custom post type can define a custom route by using the `rest_base` argument, a namespace of `wp/v2` was assumed. This commit introduces support for a `rest_namespace` argument.
A new `rest_get_route_for_post_type_items` function has been introduced and the `rest_get_route_for_post` function updated to facilitate getting the correct route for custom post types.
While the WordPress Core Block Editor bootstrap code has been updated to use these API functions, for maximum compatibility sticking with the default `wp/v2` namespace is recommended until the API functions see wider use.
Props spacedmonkey, swissspidy.
Fixes#53656.
git-svn-id: https://develop.svn.wordpress.org/trunk@51962 602fd350-edb4-49c9-b593-d223f7449a82
Previously, a 200 status code would be sent despite the 500 status code present in the response body.
Props hermpheus, lalitjalandhar.
Fixes#53056.
git-svn-id: https://develop.svn.wordpress.org/trunk@51960 602fd350-edb4-49c9-b593-d223f7449a82
Similar to the existing `role`/`role__in`/`role__not_in` query arguments, this adds support for three new query arguments in `WP_User_Query`:
* `capability`
* `capability__in`
* `capability__not_in`
These can be used to fetch users with (or without) a specific set of capabilities, for example to get all users
with the capability to edit a certain post type.
Under the hood, this will check all existing roles on the site and perform a `LIKE` query against the `capabilities` user meta field to find:
* all users with a role that has this capability
* all users with the capability being assigned directly
Note: In WordPress, not all capabilities are stored in the database. Capabilities can also be modified using filters like `map_meta_cap`. These new query arguments do NOT work for such capabilities.
The prime use case for capability queries is to get all "authors", i.e. users with the capability to edit a certain post type.
Until now, `'who' => 'authors'` was used for this, which relies on user levels. However, user levels were deprecated a long time ago and thus never added to custom roles. This led to constant frustration due to users with custom roles missing from places like author dropdowns.
This updates any usage of `'who' => 'authors'` in core to use capability queries instead.
Subsequently, `'who' => 'authors'` queries are being **deprecated** in favor of these new query arguments.
Also adds a new `capabilities` parameter (mapping to `capability__in` in `WP_User_Query`) to the REST API users controller.
Also updates `twentyfourteen_list_authors()` in Twenty Fourteen to make use of this new functionality, adding a new `twentyfourteen_list_authors_query_args` filter to make it easier to override this behavior.
Props scribu, lgladdly, boonebgorges, spacedmonkey, peterwilsoncc, SergeyBiryukov, swissspidy.
Fixes#16841.
git-svn-id: https://develop.svn.wordpress.org/trunk@51943 602fd350-edb4-49c9-b593-d223f7449a82
This change allows for external clients to supply a suggested filename via a `Content-Disposition` response header. This filename is processed through `sanitize_file_name()` to ensure it is allowable (on the server, MIME's, etc...) and `validate_file()` to prevent directory traversal.
If the suggested filename fails the above processing/checks, that suggestion is discarded and the standard temporary filename (generated by WordPress) is used.
If no `Content-Disposition` header is found in the response headers, the standard temporary filename continues to be used as per normal.
Included in this change are 6 additional PHPUnit tests with 9 assertions. These tests confirm that valid filename values are correctly saved, and invalid filename values are correctly rejected.
Props cklosows, costdev, dd32, johnjamesjacoby, ocean90, psrpinto.
Fixes#38231.
git-svn-id: https://develop.svn.wordpress.org/trunk@51939 602fd350-edb4-49c9-b593-d223f7449a82
* Move the directory being tested to the `data` directory, for consistency with other test data.
* Set the `svn:eol-style` property to `native`, for consistency with other files.
* Correct the test class name in `dummy.txt`.
Follow-up to [51246], [51910], [51911].
See #52241, #53363.
git-svn-id: https://develop.svn.wordpress.org/trunk@51938 602fd350-edb4-49c9-b593-d223f7449a82
In `wp_schedule_single_event()`, the cron info array is retrieved via a call to `_get_cron_array()` and straight away cast to an array. But as the documentation for that function (correctly) states, the return type of that function is `array|false`, where `false` is returned for a site where no cron jobs have been scheduled (yet).
In the case that `_get_cron_array()` would return `false`, this would now unintentionally create an array with a single entry with key `0` and as the value `false`.
This is a bug. Fixed now by adding validation to the output of `_get_cron_array()` and initializing `$crons` to an empty array if `false` was returned.
Tests added first to prove the bug (a) was introduced in #44818 [44917] and (b) is now fixed.
Follow-up to [44917].
Props jrf, peterwilsoncc.
Fixes#53950.
git-svn-id: https://develop.svn.wordpress.org/trunk@51916 602fd350-edb4-49c9-b593-d223f7449a82
>PHP natively allows for autovivification (auto-creation of arrays from falsey values). This feature is very useful and used in a lot of PHP projects, especially if the variable is undefined. However, there is a little oddity that allows creating an array from a `false` and `null` value.
The above quote is from the PHP 8.1 RFC and the (accepted) RFC changes the behaviour described above to deprecated auto creation of arrays from `false`. As it is deprecated, it _will_ still work for the time being, but as of PHP 9.0, this will become a Fatal Error, so we may as well fix it now.
The `recurse_dirsize()` function retrieves a transient and places it in the `$directory_cache` variable, but the `get_transient()` function in WP returns `false` when the transient doesn't exist, which subsequently can lead to the above mentioned deprecation notice.
By verifying that the `$directory_cache` variable is an array before assigning to it and initializing it to an empty array, if it's not, we prevent the deprecation notice, as well as harden the function against potentially corrupted transients where this transient would not return the expected array format, but some other variable type.
Includes adding dedicated unit tests for both the PHP 8.1 issue, as well as the hardening against corrupted transients.
Includes some girl-scouting: touching up a parameter description and some code layout.
Refs:
* https://wiki.php.net/rfc/autovivification_false
* https://developer.wordpress.org/reference/functions/get_transient/
Follow-up to [49212], [49744].
Props jrf, hellofromTonya.
See #53635.
git-svn-id: https://develop.svn.wordpress.org/trunk@51911 602fd350-edb4-49c9-b593-d223f7449a82
When the PHP native `dirname()` function is used on a Windows disk name - i.e. `C:\`-, it will return the same, i.e, it will return `C:\` again.
The `clean_dirsize_cache()` function didn't have guard clause against this, which meant that on Windows based systems and IIS servers, this function would result in WordPress getting stuck into an infinite loop.
The adjustment to the `while` part of the function fix this by checking if the return value of the `dirname()` function call is the same as the original path passed to `dirname()`, which effectively fixes the infinite loop.
A number of other improvements made:
1. Add input validation for the `$path` parameter to guard against invalid variable types being passed into the function.
2. Guard against an empty `$path` parameter, which would result in an infinite loop on both Windows as well as *nix based systems.
In both these cases, a PHP notice will now be thrown.
3. When a non-empty string, which isn't a path would previously be passed, the `dirname()` function would transform that to a `.` and the `.` key in the transient cache would be cleared out.
This was a bug as there is no relation between a non-path string and the root directory of file system.
This bug has been fixed by checking that something could actually be a path and handling received non-empty, non-path input parameters in a special way, i.e only removing the cache key for the passed string and bowing out from further processing.
Unfortunately, no tests can be added to guard against the infinite loop.
For the other fixes, we have added appropriate unit tests.
Follow-up up [49212], [49616], [49744].
Props jrf, hellofromTonya, raubvogel, sergeybiryukov, codezen8, sjlevy, drosmog, teachlynx, ekojr, bartoszgrzesik, joegasper, janthiel, josephdickson, ocean90, audrasjb.
Fixes#52241.
git-svn-id: https://develop.svn.wordpress.org/trunk@51910 602fd350-edb4-49c9-b593-d223f7449a82
Since PHPUnit 9.5.10 and 8.5.21, PHP deprecations are no longer converted to exceptions by default (`convertDeprecationsToExceptions="true"` can be configured to enable this).
Reference: [fac02620f6 Do not convert PHP deprecations to exceptions by default]; [https://github.com/sebastianbergmann/phpunit/blob/9.5.10/ChangeLog-9.5.md#9510---2021-09-25 PHPUnit 9.5.10 changelog].
With this change, the test for the `Services_JSON` compat class started failing:
{{{
There was 1 failure:
1) Tests_Compat_jsonEncodeDecode::test_json_encode_decode
Failed asserting that exception of type "PHPUnit\Framework\Error\Deprecated" is thrown.
}}}
This converts the native PHPUnit `::expectDeprecation()` method call in the test to a set of individual WP-specific `::setExpectedDeprecated()` method calls in order to not depend on PHPUnit behavior that is no longer the default.
Additionally, this commit includes support for catching deprecation notices from `_deprecated_file()` function calls to the `WP_UnitTestCase_Base::expectDeprecated()` method.
Follow-up to [46205], [46625], [48996], [51563], [51852], [51871].
Props jrf, netweb, SergeyBiryukov.
See #54183, #54029, #53363.
git-svn-id: https://develop.svn.wordpress.org/trunk@51872 602fd350-edb4-49c9-b593-d223f7449a82
Since PHPUnit 9.5.10 and 8.5.21, PHP deprecations are no longer converted to exceptions by default (`convertDeprecationsToExceptions="true"` can be configured to enable this).
Reference: [fac02620f6 Do not convert PHP deprecations to exceptions by default]; [https://github.com/sebastianbergmann/phpunit/blob/9.5.10/ChangeLog-9.5.md#9510---2021-09-25 PHPUnit 9.5.10 changelog].
Let's unpack this:
Previously (PHPUnit < 9.5.10/8.5.21), if PHPUnit would encounter a PHP native deprecation notice, it would:
1. Show a test which causes a deprecation notice to be thrown as **"errored"**,
2. Show the **first** deprecation notice it encountered and
3. PHPUnit would exit with a **non-0 exit code** (2), which will fail a CI build.
As of PHPUnit 9.5.10/8.5.21, if PHPUnit encounters a PHP native deprecation notice, it will no longer do so. Instead PHPUnit will:
1. Show a test which causes a PHP deprecation notice to be thrown as **"risky"**,
2. Show the **all** deprecation notices it encountered and
3. PHPUnit will exit with a **0 exit code**, which will show a CI build as passing.
This commit reverts PHPUnit to the previous behaviour by adding `convertDeprecationsToExceptions="true"` to the PHPUnit configuration. It also adds the other related directives for consistency.
Props jrf, netweb, costdev, SergeyBiryukov.
See #54183.
git-svn-id: https://develop.svn.wordpress.org/trunk@51871 602fd350-edb4-49c9-b593-d223f7449a82
These were originally added in [26252] to suppress database errors on `setUp()` and restore on `tearDown()` for tests that call `wpmu_create_blog()`, blog factory, or installation code that attempts to clear transients.
As the multisite test coverage expanded, these methods ended up being unnecessarily copied into other test classes, where database error suppression is not required.
Follow-up to [26252], [29916], [30286], [33184], [34898], [34899], [34901], [37234], [37477], [37894], [49212], [49616], [51859].
See #53363.
git-svn-id: https://develop.svn.wordpress.org/trunk@51869 602fd350-edb4-49c9-b593-d223f7449a82
* Rename the test filename and class to match the name of the function being tested.
* Remove unnecessary `setUp()` and `tearDown()` methods.
* Replace the `only` test group with `post`.
Follow-up to [51855-51857].
See #51147.
git-svn-id: https://develop.svn.wordpress.org/trunk@51859 602fd350-edb4-49c9-b593-d223f7449a82
Improvements include:
- Upgrades the test fixture methods to the new snake_case methods.
- Reorders the fixture methods for consistency.
- Uses strict assertions of assertSame and assertNotSame.
Follow-up to [51855-51856].
Props hellofromTonya.
See #51147.
git-svn-id: https://develop.svn.wordpress.org/trunk@51857 602fd350-edb4-49c9-b593-d223f7449a82
