Notes: Arm the mention kses allowance on REST note creation#80221
Conversation
WP_REST_Comments_Controller::create_item() only copies the type param into the prepared data after 'rest_preprocess_comment' has run, and it inserts through wp_filter_comment() directly rather than wp_new_comment(), so neither existing arm hook fired on the REST create path and mention markup was stripped for note authors without unfiltered_html. Resolve the comment type from the request's type param when the prepared data and request id leave it unknown.
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message. To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
|
Flaky tests detected in ce2f51e. 🔍 Workflow run URL: https://github.com/WordPress/gutenberg/actions/runs/29354680864
|
Mamaduka
left a comment
There was a problem hiding this comment.
Makes sense. Thanks, @adamsilverstein!
What?
Fixes #80258. Follow-up to #79604. Arms the note mention kses allowance when a note is created through the REST API, so the
<a class="wp-note-mention user-N">markup survives saving for users withoutunfiltered_html.Why?
The mention kses scoping added in #79604 never fires on the REST create path:
WP_REST_Comments_Controller::create_item()only copies thetypeparam into the prepared data afterprepare_item_for_database()has appliedrest_preprocess_comment, sogutenberg_notes_scope_mention_kses_rest()sees no comment type (and noidto resolve one from) and does not arm.create_item()then inserts throughwp_insert_comment( wp_filter_comment( ... ) )directly, never callingwp_new_comment(), so thepreprocess_commentarm does not fire either.As a result, creating a note with a mention as an author or contributor (or as anyone but a super admin on multisite) silently strips the mention classes, which breaks mention chips in the UI and, once #79606 lands, mention notifications.
How?
When the prepared data and the request
idleave the comment type unknown, resolve it from the request'stypeparam, whichcreate_item()validates against core types before preparing.Testing Instructions
unfiltered_html(e.g. an author) on a post they can edit, open the editor and add a note that@-mentions another user.Regression tests:
test_rest_prepare_arms_for_note_creation,test_rest_prepare_does_not_arm_for_regular_comment_creation, andtest_mention_markup_survives_rest_note_creation_end_to_endfail without the fix and pass with it: