Upgrade/Install: Use wp_print_inline_script_tag() in Bulk_Upgrader_Skin. - #13492
Upgrade/Install: Use wp_print_inline_script_tag() in Bulk_Upgrader_Skin.#13492haritpanchal wants to merge 1 commit into
Conversation
Continuing the migration away from manually constructed SCRIPT markup, the four raw one-liner script tags in Bulk_Upgrader_Skin::error(), ::before(), and ::after() now print through wp_print_inline_script_tag(), so wp_inline_script_attributes can attach a per-request nonce to these as in the other admin screens already migrated. The dynamic jQuery selector is now passed through wp_json_encode() with JSON_HEX_TAG | JSON_UNESCAPED_SLASHES instead of esc_js() string concatenation, consistent with the fix applied to similar call sites in [63481]: esc_js() runs the value through _wp_specialchars(), which is unnecessary here since the value is placed inside a JS string literal rather than HTML attribute context. See #59446.
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
1 participant
Continues the migration away from manually constructed
SCRIPTmarkup begun in [63481] and [63545]. The four raw one-liner script tags inBulk_Upgrader_Skin::error(),::before(), and::after()now print throughwp_print_inline_script_tag(), sowp_inline_script_attributescan attach a per-request nonce to these as well — one more step toward an admin Content-Security-Policy opt-in.The dynamic jQuery selector is now passed through
wp_json_encode()withJSON_HEX_TAG | JSON_UNESCAPED_SLASHESinstead of being built viaesc_js()string concatenation, consistent with the fix applied to similar call sites in [63481]:esc_js()runs the value through_wp_specialchars(), which isn't needed here since the value lands inside a JS string literal, not an HTML attribute.Behavior is unchanged — output was compared before/after with a manual smoke test of all three methods.
Testing instructions
npm run test:php -- --group upgradepasses (183 tests).vendor/bin/phpcs --standard=phpcs.xml.dist src/wp-admin/includes/class-bulk-upgrader-skin.phpis clean.Trac ticket: https://core.trac.wordpress.org/ticket/59446
Use of AI Tools
AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Sonnet 5
Used for: Identifying the unconverted call sites, drafting the
wp_print_inline_script_tag()replacement, and running the coding-standards/PHPUnit/manual smoke checks. I reviewed the diff and test output before opening this PR.