Skip to content

Commit 17d2c64

Browse files
desrosjdesrosj
committed
Grouped backports for the 5.8 branch.
- REST API: Increase the specificity of capability checks for collections when the `edit` context is in use. - Menus: Prevent HTML in menu item titles from being rendered unexpectedly. Merges [60814], [60815], [60816] to the 5.8 branch. Props andraganescu, desrosj, ehti, hurayraiit, iandunn, joehoyle, johnbillion, jorbin, mnelson4, noisysocks, peterwilsoncc, phillsav, rmccue, timothyblynjacobs, vortfu, westonruter , whyisjake, zieladam. git-svn-id: https://develop.svn.wordpress.org/branches/5.8@60828 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 0c72329 commit 17d2c64

File tree

10 files changed

+154
-100
lines changed

10 files changed

+154
-100
lines changed

‎src/js/_enqueues/lib/nav-menu.js‎

Lines changed: 35 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -871,7 +871,7 @@
871871
* Handle toggling bulk selection checkboxes for menu items.
872872
*
873873
* @since 5.8.0
874-
*/
874+
*/
875875
attachBulkSelectButtonListeners : function() {
876876
var that = this;
877877

@@ -890,7 +890,7 @@
890890
* Enable bulk selection checkboxes for menu items.
891891
*
892892
* @since 5.8.0
893-
*/
893+
*/
894894
enableBulkSelection : function() {
895895
var checkbox = $( '#menu-to-edit .menu-item-checkbox' );
896896

@@ -907,7 +907,7 @@
907907
* Disable bulk selection checkboxes for menu items.
908908
*
909909
* @since 5.8.0
910-
*/
910+
*/
911911
disableBulkSelection : function() {
912912
var checkbox = $( '#menu-to-edit .menu-item-checkbox' );
913913

@@ -931,7 +931,7 @@
931931
* Listen for state changes on bulk action checkboxes.
932932
*
933933
* @since 5.8.0
934-
*/
934+
*/
935935
attachMenuCheckBoxListeners : function() {
936936
var that = this;
937937

@@ -944,7 +944,7 @@
944944
* Create delete button to remove menu items from collection.
945945
*
946946
* @since 5.8.0
947-
*/
947+
*/
948948
attachMenuItemDeleteButton : function() {
949949
var that = this;
950950

@@ -985,7 +985,7 @@
985985
* List menu items awaiting deletion.
986986
*
987987
* @since 5.8.0
988-
*/
988+
*/
989989
attachPendingMenuItemsListForDeletion : function() {
990990
$( '#post-body-content' ).on( 'change', '.menu-item-checkbox', function() {
991991
var menuItemName, menuItemType, menuItemID, listedMenuItem;
@@ -1004,13 +1004,18 @@
10041004
}
10051005

10061006
if ( this.checked === true ) {
1007-
$( '#pending-menu-items-to-delete ul' ).append(
1008-
'<li data-menu-item-id="' + menuItemID + '">' +
1009-
'<span class="pending-menu-item-name">' + menuItemName + '</span> ' +
1010-
'<span class="pending-menu-item-type">(' + menuItemType + ')</span>' +
1011-
'<span class="separator"></span>' +
1012-
'</li>'
1013-
);
1007+
var $li = $( '<li>', { 'data-menu-item-id': menuItemID } );
1008+
$li.append( $( '<span>', {
1009+
'class': 'pending-menu-item-name',
1010+
text: menuItemName
1011+
} ) );
1012+
$li.append( ' ' );
1013+
$li.append( $( '<span>', {
1014+
'class': 'pending-menu-item-type',
1015+
text: '(' + menuItemType + ')'
1016+
} ) );
1017+
$li.append( $( '<span>', { 'class': 'separator' } ) );
1018+
$( '#pending-menu-items-to-delete ul' ).append( $li );
10141019
}
10151020

10161021
$( '#pending-menu-items-to-delete li .separator' ).html( ', ' );
@@ -1022,7 +1027,7 @@
10221027
* Set status of bulk delete checkbox.
10231028
*
10241029
* @since 5.8.0
1025-
*/
1030+
*/
10261031
setBulkDeleteCheckboxStatus : function() {
10271032
var that = this;
10281033
var checkbox = $( '#menu-to-edit .menu-item-checkbox' );
@@ -1046,7 +1051,7 @@
10461051
* Set status of menu items removal button.
10471052
*
10481053
* @since 5.8.0
1049-
*/
1054+
*/
10501055
setRemoveSelectedButtonStatus : function() {
10511056
var button = $( '.menu-items-delete' );
10521057

@@ -1397,20 +1402,26 @@
13971402
},
13981403

13991404
eventOnClickMenuSave : function() {
1400-
var locs = '',
1401-
menuName = $('#menu-name'),
1402-
menuNameVal = menuName.val();
1405+
var menuName = $('#menu-name'),
1406+
menuNameVal = menuName.val();
14031407

14041408
// Cancel and warn if invalid menu name.
14051409
if ( ! menuNameVal || ! menuNameVal.replace( /\s+/, '' ) ) {
14061410
menuName.parent().addClass( 'form-invalid' );
14071411
return false;
14081412
}
14091413
// Copy menu theme locations.
1414+
// Note: This appears to be dead code since #nav-menu-theme-locations no longer exists, perhaps removed in r32842.
1415+
var $updateNavMenu = $('#update-nav-menu');
14101416
$('#nav-menu-theme-locations select').each(function() {
1411-
locs += '<input type="hidden" name="' + this.name + '" value="' + $(this).val() + '" />';
1417+
$updateNavMenu.append(
1418+
$( '<input>', {
1419+
type: 'hidden',
1420+
name: this.name,
1421+
value: $( this ).val()
1422+
} )
1423+
);
14121424
});
1413-
$('#update-nav-menu').append( locs );
14141425
// Update menu item position data.
14151426
api.menuList.find('.menu-item-data-position').val( function(index) { return index + 1; } );
14161427
window.onbeforeunload = null;
@@ -1453,7 +1464,10 @@
14531464
$item;
14541465

14551466
if( ! $items.length ) {
1456-
$('.categorychecklist', panel).html( '<li><p>' + wp.i18n.__( 'No results found.' ) + '</p></li>' );
1467+
var li = $( '<li>' );
1468+
var p = $( '<p>', { text: wp.i18n.__( 'No results found.' ) } );
1469+
li.append( p );
1470+
$('.categorychecklist', panel).empty().append( li );
14571471
$( '.spinner', panel ).removeClass( 'is-active' );
14581472
wrapper.addClass( 'has-no-menu-item' );
14591473
return;

‎src/js/_enqueues/wp/customize/nav-menus.js‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -526,7 +526,13 @@
526526
return;
527527
}
528528

529-
this.currentMenuControl.addItemToMenu( menu_item.attributes );
529+
// Leave the title as empty to reuse the original title as a placeholder if set.
530+
var nav_menu_item = Object.assign( {}, menu_item.attributes );
531+
if ( nav_menu_item.title === nav_menu_item.original_title ) {
532+
nav_menu_item.title = '';
533+
}
534+
535+
this.currentMenuControl.addItemToMenu( nav_menu_item );
530536

531537
$( menuitemTpl ).find( '.menu-item-handle' ).addClass( 'item-added' );
532538
},
@@ -3020,7 +3026,6 @@
30203026
item,
30213027
{
30223028
nav_menu_term_id: menuControl.params.menu_id,
3023-
original_title: item.title,
30243029
position: position
30253030
}
30263031
);

‎src/wp-includes/class-wp-customize-nav-menus.php‎

Lines changed: 26 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -190,13 +190,15 @@ public function load_available_items_query( $type = 'post_type', $object = 'page
190190
}
191191
} elseif ( 'post' !== $object && 0 === $page && $post_type->has_archive ) {
192192
// Add a post type archive link.
193+
$title = $post_type->labels->archives;
193194
$items[] = array(
194-
'id' => $object . '-archive',
195-
'title' => $post_type->labels->archives,
196-
'type' => 'post_type_archive',
197-
'type_label' => __( 'Post Type Archive' ),
198-
'object' => $object,
199-
'url' => get_post_type_archive_link( $object ),
195+
'id' => $object . '-archive',
196+
'title' => $title,
197+
'original_title' => $title,
198+
'type' => 'post_type_archive',
199+
'type_label' => __( 'Post Type Archive' ),
200+
'object' => $object,
201+
'url' => get_post_type_archive_link( $object ),
200202
);
201203
}
202204

@@ -243,14 +245,16 @@ public function load_available_items_query( $type = 'post_type', $object = 'page
243245
$post_type_label = implode( ',', $post_states );
244246
}
245247

248+
$title = html_entity_decode( $post_title, ENT_QUOTES, get_bloginfo( 'charset' ) );
246249
$items[] = array(
247-
'id' => "post-{$post->ID}",
248-
'title' => html_entity_decode( $post_title, ENT_QUOTES, get_bloginfo( 'charset' ) ),
249-
'type' => 'post_type',
250-
'type_label' => $post_type_label,
251-
'object' => $post->post_type,
252-
'object_id' => (int) $post->ID,
253-
'url' => get_permalink( (int) $post->ID ),
250+
'id' => "post-{$post->ID}",
251+
'title' => $title,
252+
'original_title' => $title,
253+
'type' => 'post_type',
254+
'type_label' => $post_type_label,
255+
'object' => $post->post_type,
256+
'object_id' => (int) $post->ID,
257+
'url' => get_permalink( (int) $post->ID ),
254258
);
255259
}
256260
} elseif ( 'taxonomy' === $type ) {
@@ -275,14 +279,16 @@ public function load_available_items_query( $type = 'post_type', $object = 'page
275279
}
276280

277281
foreach ( $terms as $term ) {
282+
$title = html_entity_decode( $term->name, ENT_QUOTES, get_bloginfo( 'charset' ) );
278283
$items[] = array(
279-
'id' => "term-{$term->term_id}",
280-
'title' => html_entity_decode( $term->name, ENT_QUOTES, get_bloginfo( 'charset' ) ),
281-
'type' => 'taxonomy',
282-
'type_label' => get_taxonomy( $term->taxonomy )->labels->singular_name,
283-
'object' => $term->taxonomy,
284-
'object_id' => (int) $term->term_id,
285-
'url' => get_term_link( (int) $term->term_id, $term->taxonomy ),
284+
'id' => "term-{$term->term_id}",
285+
'title' => $title,
286+
'original_title' => $title,
287+
'type' => 'taxonomy',
288+
'type_label' => get_taxonomy( $term->taxonomy )->labels->singular_name,
289+
'object' => $term->taxonomy,
290+
'object_id' => (int) $term->term_id,
291+
'url' => get_term_link( (int) $term->term_id, $term->taxonomy ),
286292
);
287293
}
288294
}

‎src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php‎

Lines changed: 29 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,6 @@ class WP_Customize_Nav_Menu_Item_Setting extends WP_Customize_Setting {
5656
'classes' => '',
5757
'xfn' => '',
5858
'status' => 'publish',
59-
'original_title' => '',
6059
'nav_menu_term_id' => 0, // This will be supplied as the $menu_id arg for wp_update_nav_menu_item().
6160
'_invalid' => false,
6261
);
@@ -211,6 +210,7 @@ public function flush_cached_value( $menu_id, $menu_item_id ) {
211210
* @return array|false Instance data array, or false if the item is marked for deletion.
212211
*/
213212
public function value() {
213+
$type_label = null;
214214
if ( $this->is_previewed && get_current_blog_id() === $this->_previewed_blog_id ) {
215215
$undefined = new stdClass(); // Symbol.
216216
$post_value = $this->post_value( $undefined );
@@ -220,9 +220,6 @@ public function value() {
220220
} else {
221221
$value = $post_value;
222222
}
223-
if ( ! empty( $value ) && empty( $value['original_title'] ) ) {
224-
$value['original_title'] = $this->get_original_title( (object) $value );
225-
}
226223
} elseif ( isset( $this->value ) ) {
227224
$value = $this->value;
228225
} else {
@@ -234,6 +231,9 @@ public function value() {
234231
if ( $post && self::POST_TYPE === $post->post_type ) {
235232
$is_title_empty = empty( $post->post_title );
236233
$value = (array) wp_setup_nav_menu_item( $post );
234+
if ( isset( $value['type_label'] ) ) {
235+
$type_label = $value['type_label'];
236+
}
237237
if ( $is_title_empty ) {
238238
$value['title'] = '';
239239
}
@@ -250,20 +250,39 @@ public function value() {
250250
$value = $this->value;
251251
}
252252

253-
if ( ! empty( $value ) && empty( $value['type_label'] ) ) {
254-
$value['type_label'] = $this->get_type_label( (object) $value );
253+
// These properties are read-only and are part of the setting for use in the Customizer UI.
254+
if ( is_array( $value ) ) {
255+
$value_obj = (object) $value;
256+
$value['type_label'] = isset( $type_label ) ? $type_label : $this->get_type_label( $value_obj );
257+
$value['original_title'] = $this->get_original_title( $value_obj );
255258
}
256259

257260
return $value;
258261
}
259262

263+
/**
264+
* Prepares the value for editing on the client.
265+
*
266+
* @since 6.8.3
267+
*
268+
* @return array|false Value prepared for the client.
269+
*/
270+
public function js_value() {
271+
$value = parent::js_value();
272+
if ( is_array( $value ) && isset( $value['original_title'] ) ) {
273+
// Decode entities for the sake of displaying the original title as a placeholder.
274+
$value['original_title'] = html_entity_decode( $value['original_title'], ENT_QUOTES, get_bloginfo( 'charset' ) );
275+
}
276+
return $value;
277+
}
278+
260279
/**
261280
* Get original title.
262281
*
263282
* @since 4.7.0
264283
*
265284
* @param object $item Nav menu item.
266-
* @return string The original title.
285+
* @return string The original title, without entity decoding.
267286
*/
268287
protected function get_original_title( $item ) {
269288
$original_title = '';
@@ -289,7 +308,6 @@ protected function get_original_title( $item ) {
289308
$original_title = $original_object->labels->archives;
290309
}
291310
}
292-
$original_title = html_entity_decode( $original_title, ENT_QUOTES, get_bloginfo( 'charset' ) );
293311
return $original_title;
294312
}
295313

@@ -347,10 +365,6 @@ protected function populate_value() {
347365
unset( $this->value['post_status'] );
348366
}
349367

350-
if ( ! isset( $this->value['original_title'] ) ) {
351-
$this->value['original_title'] = $this->get_original_title( (object) $this->value );
352-
}
353-
354368
if ( ! isset( $this->value['nav_menu_term_id'] ) && $this->post_id > 0 ) {
355369
$menus = wp_get_post_terms(
356370
$this->post_id,
@@ -595,11 +609,8 @@ public function value_as_wp_post_nav_menu_item() {
595609
$item->menu_order = $item->position;
596610
unset( $item->position );
597611

598-
if ( empty( $item->original_title ) ) {
599-
$item->original_title = $this->get_original_title( $item );
600-
}
601612
if ( empty( $item->title ) && ! empty( $item->original_title ) ) {
602-
$item->title = $item->original_title;
613+
$item->title = $item->original_title; // This is NOT entity-decoded. It comes from self::get_original_title().
603614
}
604615
if ( $item->title ) {
605616
$item->post_title = $item->title;
@@ -653,8 +664,9 @@ public function value_as_wp_post_nav_menu_item() {
653664
* we remove that in this override.
654665
*
655666
* @since 4.3.0
667+
* @since 5.9.0 Renamed `$menu_item_value` to `$value` for PHP 8 named parameter support.
656668
*
657-
* @param array $menu_item_value The value to sanitize.
669+
* @param array|false $value The menu item value to sanitize.
658670
* @return array|false|null|WP_Error Null or WP_Error if an input isn't valid. False if it is marked for deletion.
659671
* Otherwise the sanitized value.
660672
*/
@@ -708,8 +720,6 @@ public function sanitize( $menu_item_value ) {
708720
$menu_item_value[ $key ] = implode( ' ', array_map( 'sanitize_html_class', $value ) );
709721
}
710722

711-
$menu_item_value['original_title'] = sanitize_text_field( $menu_item_value['original_title'] );
712-
713723
// Apply the same filters as when calling wp_insert_post().
714724

715725
/** This filter is documented in wp-includes/post.php */

‎src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,13 @@ public function get_items( $request ) {
360360
$posts = array();
361361

362362
foreach ( $query_result as $post ) {
363-
if ( ! $this->check_read_permission( $post ) ) {
363+
if ( 'edit' === $request['context'] ) {
364+
$permission = $this->check_update_permission( $post );
365+
} else {
366+
$permission = $this->check_read_permission( $post );
367+
}
368+
369+
if ( ! $permission ) {
364370
continue;
365371
}
366372

‎src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -330,6 +330,10 @@ public function get_items( $request ) {
330330
$response = array();
331331

332332
foreach ( $query_result as $term ) {
333+
if ( 'edit' === $request['context'] && ! current_user_can( 'edit_term', $term->term_id ) ) {
334+
continue;
335+
}
336+
333337
$data = $this->prepare_item_for_response( $term, $request );
334338
$response[] = $this->prepare_response_for_collection( $data );
335339
}

0 commit comments

Comments
 (0)