Skip to content

Notes: Arm the mention kses allowance on REST note creation#80221

Merged
adamsilverstein merged 3 commits into
trunkfrom
fix/notes-mention-kses-rest-create
Jul 15, 2026
Merged

Notes: Arm the mention kses allowance on REST note creation#80221
adamsilverstein merged 3 commits into
trunkfrom
fix/notes-mention-kses-rest-create

Conversation

@adamsilverstein

@adamsilverstein adamsilverstein commented Jul 14, 2026

Copy link
Copy Markdown
Member

What?

Fixes #80258. Follow-up to #79604. Arms the note mention kses allowance when a note is created through the REST API, so the <a class="wp-note-mention user-N"> markup survives saving for users without unfiltered_html.

Why?

The mention kses scoping added in #79604 never fires on the REST create path:

  • WP_REST_Comments_Controller::create_item() only copies the type param into the prepared data after prepare_item_for_database() has applied rest_preprocess_comment, so gutenberg_notes_scope_mention_kses_rest() sees no comment type (and no id to resolve one from) and does not arm.
  • create_item() then inserts through wp_insert_comment( wp_filter_comment( ... ) ) directly, never calling wp_new_comment(), so the preprocess_comment arm does not fire either.

As a result, creating a note with a mention as an author or contributor (or as anyone but a super admin on multisite) silently strips the mention classes, which breaks mention chips in the UI and, once #79606 lands, mention notifications.

How?

When the prepared data and the request id leave the comment type unknown, resolve it from the request's type param, which create_item() validates against core types before preparing.

Testing Instructions

Test in WordPress Playground

  1. As a user without unfiltered_html (e.g. an author) on a post they can edit, open the editor and add a note that @-mentions another user.
  2. Save and reload: without this fix the mention renders as a plain link (classes stripped); with it the mention chip survives.

Regression tests: test_rest_prepare_arms_for_note_creation, test_rest_prepare_does_not_arm_for_regular_comment_creation, and test_mention_markup_survives_rest_note_creation_end_to_end fail without the fix and pass with it:

npm run test:unit:php:base -- --filter Tests_Notes_Mention_Kses

WP_REST_Comments_Controller::create_item() only copies the type param
into the prepared data after 'rest_preprocess_comment' has run, and it
inserts through wp_filter_comment() directly rather than
wp_new_comment(), so neither existing arm hook fired on the REST create
path and mention markup was stripped for note authors without
unfiltered_html. Resolve the comment type from the request's type param
when the prepared data and request id leave it unknown.
@github-actions

github-actions Bot commented Jul 14, 2026

Copy link
Copy Markdown

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: adamsilverstein <adamsilverstein@git.wordpress.org>
Co-authored-by: Mamaduka <mamaduka@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@adamsilverstein adamsilverstein added the [Type] Bug An existing feature does not function as intended label Jul 14, 2026
@github-actions

github-actions Bot commented Jul 14, 2026

Copy link
Copy Markdown

Flaky tests detected in ce2f51e.
Some tests passed with failed attempts. The failures may not be related to this commit but are still reported for visibility. See the documentation for more information.

🔍 Workflow run URL: https://github.com/WordPress/gutenberg/actions/runs/29354680864
📝 Reported issues:

@Mamaduka Mamaduka left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense. Thanks, @adamsilverstein!

@adamsilverstein adamsilverstein added Backport to Gutenberg RC Pull request that needs to be backported to a Gutenberg release candidate (RC) [Feature] Notes Phase 3 of the Gutenberg roadmap around block commenting labels Jul 15, 2026
@adamsilverstein adamsilverstein merged commit 1e2ccca into trunk Jul 15, 2026
54 checks passed
@adamsilverstein adamsilverstein deleted the fix/notes-mention-kses-rest-create branch July 15, 2026 16:07
@github-actions github-actions Bot added this to the Gutenberg 23.7 milestone Jul 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Backport to Gutenberg RC Pull request that needs to be backported to a Gutenberg release candidate (RC) [Feature] Notes Phase 3 of the Gutenberg roadmap around block commenting [Type] Bug An existing feature does not function as intended

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Notes: mention markup is stripped by kses when a note is created via the REST API

2 participants