Instead of hitting the live API, this commit mocks the remote request when testing creating an item that's an unknown plugin.
Follow-up to [48242].
Props hellofromTonya, noisysocks, sergeybiryukov, TimothyBlynJacobs.
See #54420.
git-svn-id: https://develop.svn.wordpress.org/trunk@52138 602fd350-edb4-49c9-b593-d223f7449a82
Instead of hitting the live API, this commit mocks the remote request.
Follow-up to [48242].
Props hellofromTonya, noisysocks, sergeybiryukov, TimothyBlynJacobs.
Fixes#54420.
git-svn-id: https://develop.svn.wordpress.org/trunk@52137 602fd350-edb4-49c9-b593-d223f7449a82
When `m` query_tag has a valid year, i.e. `?m=2021`, and there are posts for that year, `substr()` returns a `false` on PHP 5.6 and an empty string on PHP 7.0+. Passing either of those values to `$wp_locale->get_month()` results in a PHP notice on PHP 5.6 to PHP 7.4 and a PHP Warning on PHP 8.0+.
Why? The `$month` lookup table has zeroized keys from '01' to '12'. A empty value is passed to `zeroise()` returns `'00'` which is directly passed as a key in the month property. That key does not exist.
While `$wp_locale->get_month()` would benefit from guarding/validation, this fix ensures a falsey value is not passed as a month.
Tests are added including a test that fails with this fix not applied.
Follow-up to [801], [35294], [35624].
Props antpb, audrasjb, costdev, davidmosterd, drewapicture, herregroen, hellofromTonya, michelwppi, sergeybiryukov.
Fixes#31521.
git-svn-id: https://develop.svn.wordpress.org/trunk@52136 602fd350-edb4-49c9-b593-d223f7449a82
Copies WP_REST_Block_Navigation_Areas_Controller from the Gutenberg plugin. This
provides the /wp/v2/block-navigation-areas endpoint used by the Navigation
block.
Props antonvlasenko, TimothyBlynJacobs.
Fixes#54393.
git-svn-id: https://develop.svn.wordpress.org/trunk@52133 602fd350-edb4-49c9-b593-d223f7449a82
* Prevent loading `wp-embed` script unconditionally on every page in favor of conditionally enqueueing when a post embed is detected. The `wp-embed` script is also explicitly marked as being in the footer group. Sites which currently disable post embed scripts from being enqueued via `remove_action( 'wp_head', 'wp_oembed_add_host_js' )` will continue to do so.
* Send a `ready` message from the host page to each post embed window in case the `iframe` loads before the `wp-embed` script does. When the `ready` message is received by the post embed window, it sends the same `height` message as it sends when it loads.
* Eliminate use of `grunt-include` to inject emoji script and the post embed script. Instead obtain the script contents via `file_get_contents()` (as is done elsewhere in core) and utilize `wp_print_inline_script_tag()`/`wp_get_inline_script_tag()` to construct out the script. This simplifies the logic and allows the running of src without `SCRIPT_DEBUG` enabled.
* For the embed code that users are provided to copy for embedding outside of WP, add the `secret` on the `blockquote` and `iframe`. This ensures the `blockquote` will be hidden when the `iframe` loads. The embed code in question is accessed here via `get_post_embed_html()`.
Props westonruter, swissspidy, pento, flixos90, ocean90.
Fixes#44632, #44306.
git-svn-id: https://develop.svn.wordpress.org/trunk@52132 602fd350-edb4-49c9-b593-d223f7449a82
There's now a way to get a link to a given post's revisions. Introducing `wp_get_post_revisions_url()` and its unit tests.
Props adamsilverstein, audrasjb, costdev, davidbaumwald, garrett-eclipse, georgestephanis, hellofromTonya, iaaxpage.
Fixes#39062.
git-svn-id: https://develop.svn.wordpress.org/trunk@52095 602fd350-edb4-49c9-b593-d223f7449a82
Adds a new filter `'http_allowed_safe_ports'` to control which ports are allowed for remote requests. By default, ports 80, 443, and 8080 are allowed for safe remote requests.
Adds tests.
Follow-up to [24480].
Props xknown, johnbillion, jorbin, costdev, dd32.
Fixes#54331.
git-svn-id: https://develop.svn.wordpress.org/trunk@52084 602fd350-edb4-49c9-b593-d223f7449a82
This commit introduces the `/wp/v2/menus`, `/wp/v2/menu-items` and `/wp/v2/menu-locations` REST API endpoints. These endpoints are fully available to users with the `edit_theme_options` capability, but can be read by any user who can edit a REST API available post type.
The `nav_menu` taxonomy and `nav_menu_item` post type now map their capabilities to the `edit_theme_options` primitive capability. This allows developers to provide more fine-grained access control. However, if a developer is currently dynamically removing the `edit_theme_options` capability using `map_meta_cap`, they should use the `user_has_cap` filter instead.
The `wp_update_nav_menu_item()` function has been adjusted to return an error if saving the menu item post or assigning the menu item to a menu generate an error.
Lastly, a new menu item type is introduced, `block`, that can be used to store a Block as a menu item.
Props andraganescu, antonvlasenko, dingo_d, dlh, isabel_brison, kadamwhite, Mamaduka, NateWr, noisysocks, peterwilsoncc, ryelle, schlessera, soean, Spacedmonkey, talldanwp, TimothyBlynJacobs, tobifjellner, westonruter, wpscholar, zieladam.
Fixes#40878.
git-svn-id: https://develop.svn.wordpress.org/trunk@52079 602fd350-edb4-49c9-b593-d223f7449a82
- First pass at adding the site editor from the Gutenberg plugin to
wp-admin/site-editor.php.
- Adds miscellaneous PHP changes from Gutenberg 10.1 - 11.9.
Follows [52042].
See #54337.
Props youknowriad, aristath, hellofromtonya, gziolo.
git-svn-id: https://develop.svn.wordpress.org/trunk@52069 602fd350-edb4-49c9-b593-d223f7449a82
This also exposes the value of `allow_batch` in `OPTIONS` requests to a route.
A future commit will add batch support to more resources.
Props spacedmonkey, chrisvanpatten.
See #53063.
git-svn-id: https://develop.svn.wordpress.org/trunk@52068 602fd350-edb4-49c9-b593-d223f7449a82
This changeset implements the refined lazy-loading behavior outlined in https://make.wordpress.org/core/2021/07/15/refining-wordpress-cores-lazy-loading-implementation/ in order to improve the Largest Contentful Paint metric, which can see a regression from images or iframes above the fold being lazy-loaded. Adjusting this so far has been possible for developers via filters and still is, however this enhancement brings a more accurate behavior out of the box for the majority of themes.
Specifically, this changeset skips the very first "content image or iframe" on the page from being lazy-loaded. "Content image or iframe" denotes any image or iframe that is found within content of any post in the current main query loop as well as any featured image of such a post. This applies both to "singular" as well as "archive" content: On a "singular" page the first image/iframe of the post is not lazy-loaded, while on an "archive" page the first image/iframe of the _first_ post in the query is not lazy-loaded.
This approach refines the lazy-loading behavior correctly for the majority of themes, which use a single-column layout for post content. For themes with multi-column layouts, a new `wp_omit_loading_attr_threshold` filter can be used to change how many of the first images/iframes are being skipped from lazy-loaded (default is `1`). For example, a theme using a three-column grid of latest posts for archives could use the filter to override the threshold to `3` on archive pages, so that the first three content images/iframes would not be lazy-loaded.
Props adamsilverstein, azaozz, flixos90, hellofromtonya, jonoaldersonwp, mte90, rviscomi, tweetythierry, westonruter.
Fixes#53675. See #50425.
git-svn-id: https://develop.svn.wordpress.org/trunk@52065 602fd350-edb4-49c9-b593-d223f7449a82
Introduces a new function called `wp_list_users()`. Similar to other list functions such as `wp_list_authors()`, it lists all the users of the site. Options are available to configure the HTML output.
Following the same pattern of the other list functions, the list's HTML output is rendered by default. Setting the `echo` argument to `false`, returns the list's HTML output.
A new test class is included.
Props afercia, audrasjb, chriscct7, costdev, desrosj, greenshady, hellofromTonya, mte90, nacin, rohan013, sergeybiryukov.
Fixes#15145.
git-svn-id: https://develop.svn.wordpress.org/trunk@52064 602fd350-edb4-49c9-b593-d223f7449a82
Adds the required infrastructure to render block-based themes. This is sourced
from the Gutenberg plugin.
Fixes#54335.
Props bernhard-reiter, youknowriad, ntsekouras, hellofromtonya.
git-svn-id: https://develop.svn.wordpress.org/trunk@52062 602fd350-edb4-49c9-b593-d223f7449a82
In the bookmarks walker `_walk_bookmarks()`, add a `'noopener'` to the bookmark's `rel` attribute when there's `target` attribute.
Adds a new test class for `wp_list_bookmarks()` and tests for this change.
Follow-up to [3880], [10712].
Props birgire, costdev, hellofromTonya, mukesh27 , sergeybiryukov, tw2113.
Fixes#53839.
git-svn-id: https://develop.svn.wordpress.org/trunk@52061 602fd350-edb4-49c9-b593-d223f7449a82
This commit ports the global styles rest endpoints from the Gutenberg plugin into the core.
See #54336.
Props oandregal, aristath, timothyblynjacobs, spacedmonkey, youknowriad.
git-svn-id: https://develop.svn.wordpress.org/trunk@52051 602fd350-edb4-49c9-b593-d223f7449a82
This commit ports to core the changes to the classes that deal with theme.json code.
See #54336.
Props oandregal, spacedmonkey, noisysocks, hellofromtonya, youknowriad.
git-svn-id: https://develop.svn.wordpress.org/trunk@52049 602fd350-edb4-49c9-b593-d223f7449a82
Similar to `wp_array_slice_assoc()` or other array-related functions, this appears to be a general-purpose function unrelated to the Formatting component.
Add missing `public` visibility keyword.
Follow-up to [52037].
See #53971.
git-svn-id: https://develop.svn.wordpress.org/trunk@52048 602fd350-edb4-49c9-b593-d223f7449a82
This brings the JS packages up to date and is the first step that will allow us
to include the other block editor updates for WordPress 5.9:
FSE infrastrucutre, site editor and global styles.
Props noisysocks.
See #54337.
git-svn-id: https://develop.svn.wordpress.org/trunk@52042 602fd350-edb4-49c9-b593-d223f7449a82
Adds new test class `Tests_Functions_WpIsNumericArray` for `wp_is_numeric_array()`.
Props pbearne, hareesh-pillai, hellofromTonya.
Fixes#53971.
git-svn-id: https://develop.svn.wordpress.org/trunk@52037 602fd350-edb4-49c9-b593-d223f7449a82
When styles got inlined, relative URLs break. The problem was that URLs inside CSS files are relative to the stylesheet's path, and when styles get inlined that relation is lost. This patch fixes the issue by finding relative URLs which then get modified to be relative to the site's root.
Fixes#54243.
Props aristath, cdyerkes, hellofromtonya.
git-svn-id: https://develop.svn.wordpress.org/trunk@52036 602fd350-edb4-49c9-b593-d223f7449a82
Add a filter that disables output of the icon on RSS feed widgets. Improves accessibility by providing a path to prevent duplicate or invisible links.
Props sabernhardt, Boniu91.
Fixes#52224.
git-svn-id: https://develop.svn.wordpress.org/trunk@52031 602fd350-edb4-49c9-b593-d223f7449a82
This allows for themes that are included inside of a subdirectory, for example `subdir/my-theme`, to be accessed via the single item route of the `/wp/v2/themes` controller.
Fixes#54349.
git-svn-id: https://develop.svn.wordpress.org/trunk@52017 602fd350-edb4-49c9-b593-d223f7449a82
By default, only users with the `edit_theme_options` capability can access the sidebars and widgets REST API endpoints. In this commit, A new `show_in_rest` parameter is added to the `register_sidebar` function. When enabled, all users will be able to access that sidebar and any widgets belonging to that sidebar.
This commit reduces the `context` for a widget's `instance` information to only `edit`. This is to ensure that internal widget data is not inadvertently exposed to the public. A future ticket may expose additional APIs to allow widget authors to indicate that their instance data can be safely exposed. REST API consumers intending to access this `instance` information should take care to explicitly set the `context` parameter to `edit`.
Props spacedmonkey, zieladam.
Fixes#53915.
git-svn-id: https://develop.svn.wordpress.org/trunk@52016 602fd350-edb4-49c9-b593-d223f7449a82
Adds a `public` visibility to test fixtures, tests, data providers, and callbacks methods.
Adds a `private` visibility to helper methods within test classes.
Renames callbacks and helpers that previously started with a `_` prefix. Why? For consistency and to leverage using the method visibility. Further naming standardizations is beyond the scope of this commit.
Props costdev, jrf, hellofromTonya.
Fixes#54177.
git-svn-id: https://develop.svn.wordpress.org/trunk@52010 602fd350-edb4-49c9-b593-d223f7449a82
This commit adds the `public` visibility keyword to each method which did not have an explicit visibility keyword.
Why `public`?
With no visibility previously declared, these methods are implicitly `public` and available for use. As these are part of the WordPress testing framework (for Core and extenders), changing them to anything else would be a backwards-compatibility break.
Props costdev, jrf, hellofromTonya.
See #54177.
git-svn-id: https://develop.svn.wordpress.org/trunk@52009 602fd350-edb4-49c9-b593-d223f7449a82
This resolves an issue where setting up `$_REQUEST['post_type']` and not clearing it afterwards in `Tests_Admin_IncludesScreen::setup_block_editor_test()` started affecting a few `WP_Comments_List_Table` tests after [51997]. It also ensures a similar issue does not inadvertently happen in other tests.
Follow-up to [760/tests], [51997].
See #53363.
git-svn-id: https://develop.svn.wordpress.org/trunk@51999 602fd350-edb4-49c9-b593-d223f7449a82
These were previously combined in the `includesListTable.php` file. Since the tests were specific neither to the `_get_list_table()` function nor the parent `WP_List_Table` class, the naming was confusing, which should now be resolved.
Follow-up to [31730], [38854], [40297], [48151], [48521], [49190], [51993].
See #53363.
git-svn-id: https://develop.svn.wordpress.org/trunk@51997 602fd350-edb4-49c9-b593-d223f7449a82
Adds the `@covers` tag to the test DocBlock.
Adds missing `public` visibility to the test method.
Follow-up to [25002].
Props pbearne, jrf, hellofromTonya.
See #39265.
git-svn-id: https://develop.svn.wordpress.org/trunk@51994 602fd350-edb4-49c9-b593-d223f7449a82
This change prevents non-visible characters in titles from creating encoded values in permalinks, opting instead for the following replacement strategy:
* Non-visible non-zero-width characters are replaced with hyphens
* Non-visible zero-width characters are removed entirely
Included with this change are 64 additional PHPUnit assertions to confirm that only the targeted non-visible characters are sanitized as intended.
Before this change, URLs would unintentionally contain encoded values where these non-visible characters were. After this change, URLs intentionally strip out or hyphenate these non-visible characters.
Props costdev, dhanendran, hellofromtonya, paaljoachim, peterwilsoncc, poena, sergeybiryukov.
Fixes#47912.
git-svn-id: https://develop.svn.wordpress.org/trunk@51984 602fd350-edb4-49c9-b593-d223f7449a82
Adds a new REST API endpoint (`/wp-block-editor/v1/url-details`) for retrieving information from an external URL.
Information retrieved:
* Title: content of the `<title>` element
* Icon: favicon image link
* Description: content of the `description` or `og:description` meta element
* Image: OG image link
This endpoint is used by the block editor for link previews.
Props get_dave, aduth, andraganescu, beaulebens, hellofromTonya, kevin940726, mamaduka, marekhrabe, mnelson4, noisysocks, obenland, ocean90, retrofox, shaunandrews, spacedmonkey, swissspidy, timothyblynjacobs, xknown, youknowriad.
Fixes#54358.
git-svn-id: https://develop.svn.wordpress.org/trunk@51973 602fd350-edb4-49c9-b593-d223f7449a82
Adds an expectation for PHP 8.1 "passing null to non-nullable" deprecation notice to select tests where the deprecation is generated by one of the functions in the `wp-includes/formatting.php` file, either via a filter hook callback or by a direct call.
Instead of haphazardly fixing these issues exposed by the tests, a more structural and all-encompassing solution for input validation should be architected and implemented as otherwise, we'll keep running into similar issues time and again with each new PHP version.
To discourage people from "fixing" these issues now anyway, this commit "hides" nearly all of these issues from the test runs.
Once a more structural solution is designed, these tests and the underlying functions causing the deprecation notices should be revisited and the structural solution put in place.
Includes a few minor other tweaks to select tests:
* Removing a stray `return` (twice) from assertion statements.
* Removing calls to `ob_*()` functions in favour of letting PHPUnit manage the output catching. This prevents warnings along the lines of `Test code or tested code did not (only) close its own output buffers`.
Props jrf, hellofromTonya.
See #53635.
git-svn-id: https://develop.svn.wordpress.org/trunk@51968 602fd350-edb4-49c9-b593-d223f7449a82
While a taxonomy can define a custom route by using the rest_base argument, a namespace of wp/v2 was assumed. This commit introduces support for a rest_namespace argument.
A new rest_get_route_for_taxonomy_items function has been introduced and the rest_get_route_for_term function updated to facilitate getting the correct route for taxonomies.
For maximum compatibility sticking with the default wp/v2 namespace is recommended until the API functions see wider use.
Props spacedmonkey.
Fixes#54267.
See [51962].
git-svn-id: https://develop.svn.wordpress.org/trunk@51964 602fd350-edb4-49c9-b593-d223f7449a82
This change adds two now attribute-related config options to KSES:
- An array of allowed values can be defined for attributes. If the attribute value doesn't fall into the list, the attribute will be removed from the tag.
- Attributes can be marked as required. If a required attribute is not present, KSES will remove all attributes from the tag. As KSES doesn't match opening and closing tags, it's not possible to safely remove the tag itself, the safest fallback is to strip all attributes from the tag, instead.
Included with this change is an implementation of these options, allowing the `<object>` tag to be stored in posts, but only when it has a `type` attribute set to `application/pdf`.
Props pento, swissspidy, peterwilsoncc, dd32, jorbin.
Fixes#54261.
git-svn-id: https://develop.svn.wordpress.org/trunk@51963 602fd350-edb4-49c9-b593-d223f7449a82
While a custom post type can define a custom route by using the `rest_base` argument, a namespace of `wp/v2` was assumed. This commit introduces support for a `rest_namespace` argument.
A new `rest_get_route_for_post_type_items` function has been introduced and the `rest_get_route_for_post` function updated to facilitate getting the correct route for custom post types.
While the WordPress Core Block Editor bootstrap code has been updated to use these API functions, for maximum compatibility sticking with the default `wp/v2` namespace is recommended until the API functions see wider use.
Props spacedmonkey, swissspidy.
Fixes#53656.
git-svn-id: https://develop.svn.wordpress.org/trunk@51962 602fd350-edb4-49c9-b593-d223f7449a82
Previously, a 200 status code would be sent despite the 500 status code present in the response body.
Props hermpheus, lalitjalandhar.
Fixes#53056.
git-svn-id: https://develop.svn.wordpress.org/trunk@51960 602fd350-edb4-49c9-b593-d223f7449a82
Similar to the existing `role`/`role__in`/`role__not_in` query arguments, this adds support for three new query arguments in `WP_User_Query`:
* `capability`
* `capability__in`
* `capability__not_in`
These can be used to fetch users with (or without) a specific set of capabilities, for example to get all users
with the capability to edit a certain post type.
Under the hood, this will check all existing roles on the site and perform a `LIKE` query against the `capabilities` user meta field to find:
* all users with a role that has this capability
* all users with the capability being assigned directly
Note: In WordPress, not all capabilities are stored in the database. Capabilities can also be modified using filters like `map_meta_cap`. These new query arguments do NOT work for such capabilities.
The prime use case for capability queries is to get all "authors", i.e. users with the capability to edit a certain post type.
Until now, `'who' => 'authors'` was used for this, which relies on user levels. However, user levels were deprecated a long time ago and thus never added to custom roles. This led to constant frustration due to users with custom roles missing from places like author dropdowns.
This updates any usage of `'who' => 'authors'` in core to use capability queries instead.
Subsequently, `'who' => 'authors'` queries are being **deprecated** in favor of these new query arguments.
Also adds a new `capabilities` parameter (mapping to `capability__in` in `WP_User_Query`) to the REST API users controller.
Also updates `twentyfourteen_list_authors()` in Twenty Fourteen to make use of this new functionality, adding a new `twentyfourteen_list_authors_query_args` filter to make it easier to override this behavior.
Props scribu, lgladdly, boonebgorges, spacedmonkey, peterwilsoncc, SergeyBiryukov, swissspidy.
Fixes#16841.
git-svn-id: https://develop.svn.wordpress.org/trunk@51943 602fd350-edb4-49c9-b593-d223f7449a82
This change allows for external clients to supply a suggested filename via a `Content-Disposition` response header. This filename is processed through `sanitize_file_name()` to ensure it is allowable (on the server, MIME's, etc...) and `validate_file()` to prevent directory traversal.
If the suggested filename fails the above processing/checks, that suggestion is discarded and the standard temporary filename (generated by WordPress) is used.
If no `Content-Disposition` header is found in the response headers, the standard temporary filename continues to be used as per normal.
Included in this change are 6 additional PHPUnit tests with 9 assertions. These tests confirm that valid filename values are correctly saved, and invalid filename values are correctly rejected.
Props cklosows, costdev, dd32, johnjamesjacoby, ocean90, psrpinto.
Fixes#38231.
git-svn-id: https://develop.svn.wordpress.org/trunk@51939 602fd350-edb4-49c9-b593-d223f7449a82
* Move the directory being tested to the `data` directory, for consistency with other test data.
* Set the `svn:eol-style` property to `native`, for consistency with other files.
* Correct the test class name in `dummy.txt`.
Follow-up to [51246], [51910], [51911].
See #52241, #53363.
git-svn-id: https://develop.svn.wordpress.org/trunk@51938 602fd350-edb4-49c9-b593-d223f7449a82
