From 36fdad4ef20dddcce8b2fa43e711fe4ee8372e44 Mon Sep 17 00:00:00 2001 From: Shail Mehta Date: Sat, 28 Feb 2026 09:41:13 +0530 Subject: [PATCH 01/10] Used wp_kses_post() Instead of esc_html() --- src/wp-includes/link-template.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wp-includes/link-template.php b/src/wp-includes/link-template.php index 3b72ff6351ad7..0bae1a3bebe4b 100644 --- a/src/wp-includes/link-template.php +++ b/src/wp-includes/link-template.php @@ -4820,7 +4820,7 @@ function get_the_privacy_policy_link( $before = '', $after = '' ) { $link = sprintf( '%s', esc_url( $privacy_policy_url ), - esc_html( $page_title ) + wp_kses_post( $page_title ) ); } From 88368d84af07a601729f08107e5eaae645f90e84 Mon Sep 17 00:00:00 2001 From: Shail Mehta Date: Sat, 25 Jul 2026 10:02:30 +0530 Subject: [PATCH 02/10] Apply Feedback Changes --- src/wp-admin/comment.php | 18 +- src/wp-admin/edit-form-comment.php | 16 +- .../includes/class-walker-nav-menu-edit.php | 16 +- .../includes/class-wp-comments-list-table.php | 15 +- .../includes/dashboard-on-this-day.php | 11 +- .../themes/twentytwentyone/image.php | 11 +- src/wp-includes/blocks/latest-posts.php | 11 +- src/wp-includes/link-template.php | 12 +- .../tests/link/getThePrivacyPolicyLink.php | 358 ++++++++++-------- 9 files changed, 287 insertions(+), 181 deletions(-) diff --git a/src/wp-admin/comment.php b/src/wp-admin/comment.php index b834f7b594062..8c914cb67f210 100644 --- a/src/wp-admin/comment.php +++ b/src/wp-admin/comment.php @@ -202,12 +202,23 @@ comment_post_ID; + $post_id = $comment->comment_post_ID; + $post_title = wp_kses( + get_the_title( $post_id ), + array( + 'strong' => array(), + 'em' => array(), + 'b' => array(), + 'i' => array(), + 'span' => array(), + + ) + ); if ( current_user_can( 'edit_post', $post_id ) ) { $post_link = ""; - $post_link .= esc_html( get_the_title( $post_id ) ) . ''; + $post_link .= $post_title . ''; } else { - $post_link = esc_html( get_the_title( $post_id ) ); + $post_link = $post_title; } echo $post_link; @@ -223,6 +234,7 @@ } ?> + diff --git a/src/wp-admin/edit-form-comment.php b/src/wp-admin/edit-form-comment.php index 375dd61ad955e..ee93052d42ac9 100644 --- a/src/wp-admin/edit-form-comment.php +++ b/src/wp-admin/edit-form-comment.php @@ -181,12 +181,22 @@ comment_post_ID; +$post_id = $comment->comment_post_ID; +$post_title = wp_kses( + get_the_title( $post_id ), + array( + 'strong' => array(), + 'em' => array(), + 'b' => array(), + 'i' => array(), + 'span' => array(), + ) +); if ( current_user_can( 'edit_post', $post_id ) ) { $post_link = ""; - $post_link .= esc_html( get_the_title( $post_id ) ) . ''; + $post_link .= $post_title . ''; } else { - $post_link = esc_html( get_the_title( $post_id ) ); + $post_link = $post_title; } ?> diff --git a/src/wp-admin/includes/class-walker-nav-menu-edit.php b/src/wp-admin/includes/class-walker-nav-menu-edit.php index a287a7c4b8cdd..a1907083009c9 100644 --- a/src/wp-admin/includes/class-walker-nav-menu-edit.php +++ b/src/wp-admin/includes/class-walker-nav-menu-edit.php @@ -293,8 +293,22 @@ public function start_el( &$output, $data_object, $depth = 0, $args = null, $cur type && false !== $original_title ) : ?>

type ) { + $original_title = wp_kses( + $original_title, + array( + 'strong' => array(), + 'em' => array(), + 'b' => array(), + 'i' => array(), + 'span' => array(), + ) + ); + } else { + $original_title = esc_html( $original_title ); + } /* translators: %s: Link to menu item's original object. */ - printf( __( 'Original: %s' ), '' . esc_html( $original_title ) . '' ); + printf( __( 'Original: %s' ), '' . $original_title . '' ); ?>

diff --git a/src/wp-admin/includes/class-wp-comments-list-table.php b/src/wp-admin/includes/class-wp-comments-list-table.php index 2b927a7f81a6a..50124408ce19b 100644 --- a/src/wp-admin/includes/class-wp-comments-list-table.php +++ b/src/wp-admin/includes/class-wp-comments-list-table.php @@ -1119,11 +1119,22 @@ public function column_response( $comment ) { $this->pending_count[ $post->ID ] = $pending_comments; } + $post_title = wp_kses( + get_the_title( $post->ID ), + array( + 'strong' => array(), + 'em' => array(), + 'b' => array(), + 'i' => array(), + 'span' => array(), + ) + ); + if ( current_user_can( 'edit_post', $post->ID ) ) { $post_link = ""; - $post_link .= esc_html( get_the_title( $post->ID ) ) . ''; + $post_link .= $post_title . ''; } else { - $post_link = esc_html( get_the_title( $post->ID ) ); + $post_link = $post_title; } echo '
'; diff --git a/src/wp-admin/includes/dashboard-on-this-day.php b/src/wp-admin/includes/dashboard-on-this-day.php index 1939f8ca4b0e3..8f0163dcb821d 100644 --- a/src/wp-admin/includes/dashboard-on-this-day.php +++ b/src/wp-admin/includes/dashboard-on-this-day.php @@ -125,7 +125,16 @@ function wp_dashboard_on_this_day() { $show_author = '' !== trim( $author_name ) && get_current_user_id() !== $author_id; ?>
  • - + array(), + 'em' => array(), + 'b' => array(), + 'i' => array(), + 'span' => array(), + ) + ); ?> ' . esc_html( diff --git a/src/wp-content/themes/twentytwentyone/image.php b/src/wp-content/themes/twentytwentyone/image.php index 4b3abcca2a44e..cc4fa37f723c5 100644 --- a/src/wp-content/themes/twentytwentyone/image.php +++ b/src/wp-content/themes/twentytwentyone/image.php @@ -59,7 +59,16 @@ printf( /* translators: %s: Parent post. */ esc_html__( 'Published in %s', 'twentytwentyone' ), - '' . esc_html( get_the_title( wp_get_post_parent_id( $post ) ) ) . '' + '' . wp_kses( + get_the_title( wp_get_post_parent_id( $post ) ), + array( + 'strong' => array(), + 'em' => array(), + 'b' => array(), + 'i' => array(), + 'span' => array(), + ) + ) . '' ); echo ''; } else { diff --git a/src/wp-includes/blocks/latest-posts.php b/src/wp-includes/blocks/latest-posts.php index ed399ad1fe2f0..8977222cf2f9d 100644 --- a/src/wp-includes/blocks/latest-posts.php +++ b/src/wp-includes/blocks/latest-posts.php @@ -171,7 +171,16 @@ function render_block_core_latest_posts( $attributes ) { /* translators: 1: A URL to a post, 2: Hidden accessibility text: Post title */ __( '… Read more: %2$s' ), esc_url( $post_link ), - esc_html( $title ) + wp_kses( + $title, + array( + 'strong' => array(), + 'em' => array(), + 'b' => array(), + 'i' => array(), + 'span' => array(), + ) + ) ); } } diff --git a/src/wp-includes/link-template.php b/src/wp-includes/link-template.php index 1fa0d8d6fea84..c054014d362c5 100644 --- a/src/wp-includes/link-template.php +++ b/src/wp-includes/link-template.php @@ -4820,7 +4820,17 @@ function get_the_privacy_policy_link( $before = '', $after = '' ) { $link = sprintf( '%s', esc_url( $privacy_policy_url ), - wp_kses_post( $page_title ) + wp_kses( + $page_title, + array( + 'strong' => array(), + 'em' => array(), + 'b' => array(), + 'i' => array(), + 'span' => array(), + ) + ) + ); } diff --git a/tests/phpunit/tests/link/getThePrivacyPolicyLink.php b/tests/phpunit/tests/link/getThePrivacyPolicyLink.php index ca489bf177d7c..2e408bf2badbf 100644 --- a/tests/phpunit/tests/link/getThePrivacyPolicyLink.php +++ b/tests/phpunit/tests/link/getThePrivacyPolicyLink.php @@ -1,168 +1,190 @@ -post->create( - array( - 'post_type' => 'page', - 'post_title' => WP_TESTS_DOMAIN . ' Privacy Policy', - ) - ); - - // `esc_url()` is added for consistency with `get_the_privacy_policy_link()`. - self::$privacy_policy_url = esc_url( get_permalink( self::$privacy_policy_page_id ) ); - - self::$before = ''; - self::$after = ''; - } - - /** - * The function should return a valid link if a privacy policy page has been - * created and set as the `wp_page_for_privacy_policy`. The post title should - * be used as the link text. - */ - public function test_get_the_privacy_policy_link_should_return_valid_link_when_privacy_page_set() { - update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); - - $actual_link = get_the_privacy_policy_link(); - - $this->assertStringStartsWith( 'assertStringContainsString( self::$privacy_policy_url, $actual_link ); - $this->assertStringEndsWith( '>' . WP_TESTS_DOMAIN . ' Privacy Policy', $actual_link ); - } - - /** - * The function should prepend the supplied `$before` markup and append the - * supplied `$after` markup when the `wp_page_for_privacy_policy` is configured. - */ - public function test_get_the_privacy_policy_link_should_prepend_and_append_supplied_markup_when_privacy_page_set() { - update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); - - $actual_link = get_the_privacy_policy_link( self::$before, self::$after ); - - $this->assertStringStartsWith( self::$before . 'assertStringContainsString( self::$privacy_policy_url, $actual_link ); - $this->assertStringEndsWith( '' . self::$after, $actual_link ); - } - - /** - * The function should _not_ prepend the supplied `$before` markup and append - * the supplied `$after` markup when the `wp_page_for_privacy_policy` is _not_ configured. - */ - public function test_get_the_privacy_policy_link_should_not_prepend_and_append_supplied_markup_when_privacy_page_not_set() { - $actual_link = get_the_privacy_policy_link( self::$before, self::$after ); - - $this->assertSame( '', $actual_link ); - } - - /** - * The function should return an empty string when there is an empty page title - * for the privacy policy. - * - * @ticket 44192 - */ - public function test_function_should_return_empty_string_when_privacy_page_title_empty() { - $nameless_page_id = self::factory()->post->create( - array( - 'post_type' => 'page', - 'post_title' => '', - ) - ); - - update_option( 'wp_page_for_privacy_policy', $nameless_page_id ); - - $this->assertSame( '', get_the_privacy_policy_link( self::$before, self::$after ) ); - } - - /** - * The function should return an empty string when `wp_page_for_privacy_policy` is _not_ configured. - */ - public function test_get_the_privacy_policy_link_should_return_empty_string_when_privacy_page_not_set() { - $this->assertSame( '', get_the_privacy_policy_link() ); - } - - /** - * The output of the get_the_privacy_policy_link() function should be filterable with the 'privacy_policy_link' filter. - */ - public function test_get_the_privacy_policy_link_should_be_filterable() { - update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); - $expected_url = get_privacy_policy_url(); - - $this->assertNotEmpty( $expected_url ); - - add_filter( 'the_privacy_policy_link', array( $this, 'modify_link_markup' ), 10, 2 ); - $this->assertSame( 'Policy: ' . $expected_url, get_the_privacy_policy_link() ); - remove_filter( 'the_privacy_policy_link', array( $this, 'modify_link_markup' ), 10 ); - } - - /** - * Return modified `the_privacy_policy_link` content in order to test the filter. - * - * @param string $link The privacy policy link. Empty string if it - * doesn't exist. - * @param string $privacy_policy_url The URL of the privacy policy. Empty string - * if it doesn't exist. - * @return string - */ - public static function modify_link_markup( $link, $privacy_policy_url ) { - return 'Policy: ' . $privacy_policy_url; - } - - /** - * Tests that `get_the_privacy_policy_link()` adds `rel="privacy-policy"`. - * - * @ticket 56345 - */ - public function test_get_the_privacy_policy_link_should_add_rel_privacy_policy() { - update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); - - $this->assertStringContainsString( 'rel="privacy-policy"', get_the_privacy_policy_link() ); - } -} +post->create( + array( + 'post_type' => 'page', + 'post_title' => WP_TESTS_DOMAIN . ' Privacy Policy', + ) + ); + + // `esc_url()` is added for consistency with `get_the_privacy_policy_link()`. + self::$privacy_policy_url = esc_url( get_permalink( self::$privacy_policy_page_id ) ); + + self::$before = ''; + self::$after = ''; + } + + /** + * The function should return a valid link if a privacy policy page has been + * created and set as the `wp_page_for_privacy_policy`. The post title should + * be used as the link text. + */ + public function test_get_the_privacy_policy_link_should_return_valid_link_when_privacy_page_set() { + update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); + + $actual_link = get_the_privacy_policy_link(); + + $this->assertStringStartsWith( 'assertStringContainsString( self::$privacy_policy_url, $actual_link ); + $this->assertStringEndsWith( '>' . WP_TESTS_DOMAIN . ' Privacy Policy', $actual_link ); + } + + /** + * The function should allow only supported formatting in the privacy policy page title. + * + * @ticket 64748 + */ + public function test_get_the_privacy_policy_link_should_allow_supported_title_markup() { + wp_update_post( + array( + 'ID' => self::$privacy_policy_page_id, + 'post_title' => 'Privacy Policy Bold Italic Page ', + ) + ); + update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); + + $actual_link = get_the_privacy_policy_link(); + + $this->assertStringEndsWith( + '>Privacy Policy Bold Italic Page alert("test")', + $actual_link + ); + } + + /** + * The function should prepend the supplied `$before` markup and append the + * supplied `$after` markup when the `wp_page_for_privacy_policy` is configured. + */ + public function test_get_the_privacy_policy_link_should_prepend_and_append_supplied_markup_when_privacy_page_set() { + update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); + + $actual_link = get_the_privacy_policy_link( self::$before, self::$after ); + + $this->assertStringStartsWith( self::$before . 'assertStringContainsString( self::$privacy_policy_url, $actual_link ); + $this->assertStringEndsWith( '' . self::$after, $actual_link ); + } + + /** + * The function should _not_ prepend the supplied `$before` markup and append + * the supplied `$after` markup when the `wp_page_for_privacy_policy` is _not_ configured. + */ + public function test_get_the_privacy_policy_link_should_not_prepend_and_append_supplied_markup_when_privacy_page_not_set() { + $actual_link = get_the_privacy_policy_link( self::$before, self::$after ); + + $this->assertSame( '', $actual_link ); + } + + /** + * The function should return an empty string when there is an empty page title + * for the privacy policy. + * + * @ticket 44192 + */ + public function test_function_should_return_empty_string_when_privacy_page_title_empty() { + $nameless_page_id = self::factory()->post->create( + array( + 'post_type' => 'page', + 'post_title' => '', + ) + ); + + update_option( 'wp_page_for_privacy_policy', $nameless_page_id ); + + $this->assertSame( '', get_the_privacy_policy_link( self::$before, self::$after ) ); + } + + /** + * The function should return an empty string when `wp_page_for_privacy_policy` is _not_ configured. + */ + public function test_get_the_privacy_policy_link_should_return_empty_string_when_privacy_page_not_set() { + $this->assertSame( '', get_the_privacy_policy_link() ); + } + + /** + * The output of the get_the_privacy_policy_link() function should be filterable with the 'privacy_policy_link' filter. + */ + public function test_get_the_privacy_policy_link_should_be_filterable() { + update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); + $expected_url = get_privacy_policy_url(); + + $this->assertNotEmpty( $expected_url ); + + add_filter( 'the_privacy_policy_link', array( $this, 'modify_link_markup' ), 10, 2 ); + $this->assertSame( 'Policy: ' . $expected_url, get_the_privacy_policy_link() ); + remove_filter( 'the_privacy_policy_link', array( $this, 'modify_link_markup' ), 10 ); + } + + /** + * Return modified `the_privacy_policy_link` content in order to test the filter. + * + * @param string $link The privacy policy link. Empty string if it + * doesn't exist. + * @param string $privacy_policy_url The URL of the privacy policy. Empty string + * if it doesn't exist. + * @return string + */ + public static function modify_link_markup( $link, $privacy_policy_url ) { + return 'Policy: ' . $privacy_policy_url; + } + + /** + * Tests that `get_the_privacy_policy_link()` adds `rel="privacy-policy"`. + * + * @ticket 56345 + */ + public function test_get_the_privacy_policy_link_should_add_rel_privacy_policy() { + update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); + + $this->assertStringContainsString( 'rel="privacy-policy"', get_the_privacy_policy_link() ); + } +} From 5bf13e3d2077600263afed3f7fa0ab74a1c5b27c Mon Sep 17 00:00:00 2001 From: Shail Mehta Date: Sat, 25 Jul 2026 10:09:15 +0530 Subject: [PATCH 03/10] fix phpcs issue --- .../includes/dashboard-on-this-day.php | 24 +++++++++++-------- src/wp-includes/link-template.php | 1 - 2 files changed, 14 insertions(+), 11 deletions(-) diff --git a/src/wp-admin/includes/dashboard-on-this-day.php b/src/wp-admin/includes/dashboard-on-this-day.php index 8f0163dcb821d..55073bbc04d47 100644 --- a/src/wp-admin/includes/dashboard-on-this-day.php +++ b/src/wp-admin/includes/dashboard-on-this-day.php @@ -125,16 +125,20 @@ function wp_dashboard_on_this_day() { $show_author = '' !== trim( $author_name ) && get_current_user_id() !== $author_id; ?>
  • - array(), - 'em' => array(), - 'b' => array(), - 'i' => array(), - 'span' => array(), - ) - ); ?> + + array(), + 'em' => array(), + 'b' => array(), + 'i' => array(), + 'span' => array(), + ) + ); + ?> + ' . esc_html( diff --git a/src/wp-includes/link-template.php b/src/wp-includes/link-template.php index c054014d362c5..bc3ee623bec65 100644 --- a/src/wp-includes/link-template.php +++ b/src/wp-includes/link-template.php @@ -4830,7 +4830,6 @@ function get_the_privacy_policy_link( $before = '', $after = '' ) { 'span' => array(), ) ) - ); } From 1aeb53d444a47e2a1dfe12b6c99779a610483bd4 Mon Sep 17 00:00:00 2001 From: Shail Mehta Date: Sat, 25 Jul 2026 10:16:11 +0530 Subject: [PATCH 04/10] fix lint issue --- src/wp-includes/blocks/latest-posts.php | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/src/wp-includes/blocks/latest-posts.php b/src/wp-includes/blocks/latest-posts.php index 8977222cf2f9d..ed399ad1fe2f0 100644 --- a/src/wp-includes/blocks/latest-posts.php +++ b/src/wp-includes/blocks/latest-posts.php @@ -171,16 +171,7 @@ function render_block_core_latest_posts( $attributes ) { /* translators: 1: A URL to a post, 2: Hidden accessibility text: Post title */ __( '… Read more: %2$s' ), esc_url( $post_link ), - wp_kses( - $title, - array( - 'strong' => array(), - 'em' => array(), - 'b' => array(), - 'i' => array(), - 'span' => array(), - ) - ) + esc_html( $title ) ); } } From cf3c67f0f9ae01f1b9e91ed5c0a09d1c364713f4 Mon Sep 17 00:00:00 2001 From: Shail Mehta Date: Sat, 25 Jul 2026 10:32:54 +0530 Subject: [PATCH 05/10] Added Class Support in span --- src/wp-admin/comment.php | 4 +++- src/wp-admin/edit-form-comment.php | 4 +++- src/wp-admin/includes/class-walker-nav-menu-edit.php | 4 +++- src/wp-admin/includes/class-wp-comments-list-table.php | 4 +++- src/wp-admin/includes/dashboard-on-this-day.php | 4 +++- src/wp-content/themes/twentytwentyone/image.php | 4 +++- src/wp-includes/link-template.php | 4 +++- tests/phpunit/tests/link/getThePrivacyPolicyLink.php | 4 ++-- 8 files changed, 23 insertions(+), 9 deletions(-) diff --git a/src/wp-admin/comment.php b/src/wp-admin/comment.php index 8c914cb67f210..17bd15dd58dd9 100644 --- a/src/wp-admin/comment.php +++ b/src/wp-admin/comment.php @@ -210,7 +210,9 @@ 'em' => array(), 'b' => array(), 'i' => array(), - 'span' => array(), + 'span' => array( + 'class' => true, + ), ) ); diff --git a/src/wp-admin/edit-form-comment.php b/src/wp-admin/edit-form-comment.php index ee93052d42ac9..a65706499f1d7 100644 --- a/src/wp-admin/edit-form-comment.php +++ b/src/wp-admin/edit-form-comment.php @@ -189,7 +189,9 @@ 'em' => array(), 'b' => array(), 'i' => array(), - 'span' => array(), + 'span' => array( + 'class' => true, + ), ) ); if ( current_user_can( 'edit_post', $post_id ) ) { diff --git a/src/wp-admin/includes/class-walker-nav-menu-edit.php b/src/wp-admin/includes/class-walker-nav-menu-edit.php index a1907083009c9..750afba9aed39 100644 --- a/src/wp-admin/includes/class-walker-nav-menu-edit.php +++ b/src/wp-admin/includes/class-walker-nav-menu-edit.php @@ -301,7 +301,9 @@ public function start_el( &$output, $data_object, $depth = 0, $args = null, $cur 'em' => array(), 'b' => array(), 'i' => array(), - 'span' => array(), + 'span' => array( + 'class' => true, + ), ) ); } else { diff --git a/src/wp-admin/includes/class-wp-comments-list-table.php b/src/wp-admin/includes/class-wp-comments-list-table.php index 50124408ce19b..b02895a39cf17 100644 --- a/src/wp-admin/includes/class-wp-comments-list-table.php +++ b/src/wp-admin/includes/class-wp-comments-list-table.php @@ -1126,7 +1126,9 @@ public function column_response( $comment ) { 'em' => array(), 'b' => array(), 'i' => array(), - 'span' => array(), + 'span' => array( + 'class' => true, + ), ) ); diff --git a/src/wp-admin/includes/dashboard-on-this-day.php b/src/wp-admin/includes/dashboard-on-this-day.php index 55073bbc04d47..868cc137dc20d 100644 --- a/src/wp-admin/includes/dashboard-on-this-day.php +++ b/src/wp-admin/includes/dashboard-on-this-day.php @@ -134,7 +134,9 @@ function wp_dashboard_on_this_day() { 'em' => array(), 'b' => array(), 'i' => array(), - 'span' => array(), + 'span' => array( + 'class' => true, + ), ) ); ?> diff --git a/src/wp-content/themes/twentytwentyone/image.php b/src/wp-content/themes/twentytwentyone/image.php index cc4fa37f723c5..ffd1f68ac4332 100644 --- a/src/wp-content/themes/twentytwentyone/image.php +++ b/src/wp-content/themes/twentytwentyone/image.php @@ -66,7 +66,9 @@ 'em' => array(), 'b' => array(), 'i' => array(), - 'span' => array(), + 'span' => array( + 'class' => true, + ), ) ) . '' ); diff --git a/src/wp-includes/link-template.php b/src/wp-includes/link-template.php index bc3ee623bec65..23a6e98eb61f3 100644 --- a/src/wp-includes/link-template.php +++ b/src/wp-includes/link-template.php @@ -4827,7 +4827,9 @@ function get_the_privacy_policy_link( $before = '', $after = '' ) { 'em' => array(), 'b' => array(), 'i' => array(), - 'span' => array(), + 'span' => array( + 'class' => true, + ), ) ) ); diff --git a/tests/phpunit/tests/link/getThePrivacyPolicyLink.php b/tests/phpunit/tests/link/getThePrivacyPolicyLink.php index 2e408bf2badbf..a5fed9aac6f99 100644 --- a/tests/phpunit/tests/link/getThePrivacyPolicyLink.php +++ b/tests/phpunit/tests/link/getThePrivacyPolicyLink.php @@ -87,7 +87,7 @@ public function test_get_the_privacy_policy_link_should_allow_supported_title_ma wp_update_post( array( 'ID' => self::$privacy_policy_page_id, - 'post_title' => 'Privacy Policy Bold Italic Page ', + 'post_title' => 'Privacy Policy Bold Italic Page ', ) ); update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); @@ -95,7 +95,7 @@ public function test_get_the_privacy_policy_link_should_allow_supported_title_ma $actual_link = get_the_privacy_policy_link(); $this->assertStringEndsWith( - '>Privacy Policy Bold Italic Page alert("test")', + '>Privacy Policy Bold Italic Page alert("test")', $actual_link ); } From 413ca1711d37d4a96ef78163b36c8daf1b2d985e Mon Sep 17 00:00:00 2001 From: Shail Mehta Date: Sat, 25 Jul 2026 10:48:52 +0530 Subject: [PATCH 06/10] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../tests/link/getThePrivacyPolicyLink.php | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/tests/phpunit/tests/link/getThePrivacyPolicyLink.php b/tests/phpunit/tests/link/getThePrivacyPolicyLink.php index a5fed9aac6f99..4e7f855a4b30d 100644 --- a/tests/phpunit/tests/link/getThePrivacyPolicyLink.php +++ b/tests/phpunit/tests/link/getThePrivacyPolicyLink.php @@ -87,15 +87,28 @@ public function test_get_the_privacy_policy_link_should_allow_supported_title_ma wp_update_post( array( 'ID' => self::$privacy_policy_page_id, - 'post_title' => 'Privacy Policy Bold Italic Page ', + 'post_title' => 'Privacy Policy Bold Italic ', ) ); + + $privacy_policy_page_id = self::$privacy_policy_page_id; + $filter = static function ( $title, $post_id ) use ( $privacy_policy_page_id ) { + if ( (int) $privacy_policy_page_id === (int) $post_id ) { + return '' . $title . ''; + } + + return $title; + }; + + add_filter( 'the_title', $filter, 10, 2 ); update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); $actual_link = get_the_privacy_policy_link(); + remove_filter( 'the_title', $filter, 10 ); + $this->assertStringEndsWith( - '>Privacy Policy Bold Italic Page alert("test")', + '>Privacy Policy Bold Italic alert("test")', $actual_link ); } From c3d3e6f4521f5d8e7e97c75f9f8189746cd9c718 Mon Sep 17 00:00:00 2001 From: Shail Mehta Date: Sat, 25 Jul 2026 10:54:01 +0530 Subject: [PATCH 07/10] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- .../tests/link/getThePrivacyPolicyLink.php | 23 +++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/tests/phpunit/tests/link/getThePrivacyPolicyLink.php b/tests/phpunit/tests/link/getThePrivacyPolicyLink.php index 4e7f855a4b30d..b2632f30621ab 100644 --- a/tests/phpunit/tests/link/getThePrivacyPolicyLink.php +++ b/tests/phpunit/tests/link/getThePrivacyPolicyLink.php @@ -88,8 +88,8 @@ public function test_get_the_privacy_policy_link_should_allow_supported_title_ma array( 'ID' => self::$privacy_policy_page_id, 'post_title' => 'Privacy Policy Bold Italic ', + ) - ); $privacy_policy_page_id = self::$privacy_policy_page_id; $filter = static function ( $title, $post_id ) use ( $privacy_policy_page_id ) { @@ -101,14 +101,29 @@ public function test_get_the_privacy_policy_link_should_allow_supported_title_ma }; add_filter( 'the_title', $filter, 10, 2 ); + } + + + + return $title; + + }; + + + + add_filter( 'the_title', $filter, 10, 2 ); + update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); $actual_link = get_the_privacy_policy_link(); - remove_filter( 'the_title', $filter, 10 ); - + remove_filter( 'the_title', $filter, 10 ); + + + $this->assertStringEndsWith( - '>Privacy Policy Bold Italic alert("test")', + '>Privacy Policy Bold Italic alert("test")', + $actual_link ); } From da23ba47492144d6e787a4194bd3b9084e682d99 Mon Sep 17 00:00:00 2001 From: Shail Mehta Date: Sun, 27 Sep 2026 16:13:13 +0530 Subject: [PATCH 08/10] Tests: Use LF line endings in the privacy policy link tests. The file was saved with CRLF, so the pull request diff rewrote every line. --- .../tests/link/getThePrivacyPolicyLink.php | 436 +++++++++--------- 1 file changed, 218 insertions(+), 218 deletions(-) diff --git a/tests/phpunit/tests/link/getThePrivacyPolicyLink.php b/tests/phpunit/tests/link/getThePrivacyPolicyLink.php index b2632f30621ab..67d9554dd3f28 100644 --- a/tests/phpunit/tests/link/getThePrivacyPolicyLink.php +++ b/tests/phpunit/tests/link/getThePrivacyPolicyLink.php @@ -1,218 +1,218 @@ -post->create( - array( - 'post_type' => 'page', - 'post_title' => WP_TESTS_DOMAIN . ' Privacy Policy', - ) - ); - - // `esc_url()` is added for consistency with `get_the_privacy_policy_link()`. - self::$privacy_policy_url = esc_url( get_permalink( self::$privacy_policy_page_id ) ); - - self::$before = ''; - self::$after = ''; - } - - /** - * The function should return a valid link if a privacy policy page has been - * created and set as the `wp_page_for_privacy_policy`. The post title should - * be used as the link text. - */ - public function test_get_the_privacy_policy_link_should_return_valid_link_when_privacy_page_set() { - update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); - - $actual_link = get_the_privacy_policy_link(); - - $this->assertStringStartsWith( 'assertStringContainsString( self::$privacy_policy_url, $actual_link ); - $this->assertStringEndsWith( '>' . WP_TESTS_DOMAIN . ' Privacy Policy', $actual_link ); - } - - /** - * The function should allow only supported formatting in the privacy policy page title. - * - * @ticket 64748 - */ - public function test_get_the_privacy_policy_link_should_allow_supported_title_markup() { - wp_update_post( - array( - 'ID' => self::$privacy_policy_page_id, - 'post_title' => 'Privacy Policy Bold Italic ', - - ) - - $privacy_policy_page_id = self::$privacy_policy_page_id; - $filter = static function ( $title, $post_id ) use ( $privacy_policy_page_id ) { - if ( (int) $privacy_policy_page_id === (int) $post_id ) { - return '' . $title . ''; - } - - return $title; - }; - - add_filter( 'the_title', $filter, 10, 2 ); - } - - - - return $title; - - }; - - - - add_filter( 'the_title', $filter, 10, 2 ); - - update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); - - $actual_link = get_the_privacy_policy_link(); - - remove_filter( 'the_title', $filter, 10 ); - - - - $this->assertStringEndsWith( - '>Privacy Policy Bold Italic alert("test")', - - $actual_link - ); - } - - /** - * The function should prepend the supplied `$before` markup and append the - * supplied `$after` markup when the `wp_page_for_privacy_policy` is configured. - */ - public function test_get_the_privacy_policy_link_should_prepend_and_append_supplied_markup_when_privacy_page_set() { - update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); - - $actual_link = get_the_privacy_policy_link( self::$before, self::$after ); - - $this->assertStringStartsWith( self::$before . 'assertStringContainsString( self::$privacy_policy_url, $actual_link ); - $this->assertStringEndsWith( '' . self::$after, $actual_link ); - } - - /** - * The function should _not_ prepend the supplied `$before` markup and append - * the supplied `$after` markup when the `wp_page_for_privacy_policy` is _not_ configured. - */ - public function test_get_the_privacy_policy_link_should_not_prepend_and_append_supplied_markup_when_privacy_page_not_set() { - $actual_link = get_the_privacy_policy_link( self::$before, self::$after ); - - $this->assertSame( '', $actual_link ); - } - - /** - * The function should return an empty string when there is an empty page title - * for the privacy policy. - * - * @ticket 44192 - */ - public function test_function_should_return_empty_string_when_privacy_page_title_empty() { - $nameless_page_id = self::factory()->post->create( - array( - 'post_type' => 'page', - 'post_title' => '', - ) - ); - - update_option( 'wp_page_for_privacy_policy', $nameless_page_id ); - - $this->assertSame( '', get_the_privacy_policy_link( self::$before, self::$after ) ); - } - - /** - * The function should return an empty string when `wp_page_for_privacy_policy` is _not_ configured. - */ - public function test_get_the_privacy_policy_link_should_return_empty_string_when_privacy_page_not_set() { - $this->assertSame( '', get_the_privacy_policy_link() ); - } - - /** - * The output of the get_the_privacy_policy_link() function should be filterable with the 'privacy_policy_link' filter. - */ - public function test_get_the_privacy_policy_link_should_be_filterable() { - update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); - $expected_url = get_privacy_policy_url(); - - $this->assertNotEmpty( $expected_url ); - - add_filter( 'the_privacy_policy_link', array( $this, 'modify_link_markup' ), 10, 2 ); - $this->assertSame( 'Policy: ' . $expected_url, get_the_privacy_policy_link() ); - remove_filter( 'the_privacy_policy_link', array( $this, 'modify_link_markup' ), 10 ); - } - - /** - * Return modified `the_privacy_policy_link` content in order to test the filter. - * - * @param string $link The privacy policy link. Empty string if it - * doesn't exist. - * @param string $privacy_policy_url The URL of the privacy policy. Empty string - * if it doesn't exist. - * @return string - */ - public static function modify_link_markup( $link, $privacy_policy_url ) { - return 'Policy: ' . $privacy_policy_url; - } - - /** - * Tests that `get_the_privacy_policy_link()` adds `rel="privacy-policy"`. - * - * @ticket 56345 - */ - public function test_get_the_privacy_policy_link_should_add_rel_privacy_policy() { - update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); - - $this->assertStringContainsString( 'rel="privacy-policy"', get_the_privacy_policy_link() ); - } -} +post->create( + array( + 'post_type' => 'page', + 'post_title' => WP_TESTS_DOMAIN . ' Privacy Policy', + ) + ); + + // `esc_url()` is added for consistency with `get_the_privacy_policy_link()`. + self::$privacy_policy_url = esc_url( get_permalink( self::$privacy_policy_page_id ) ); + + self::$before = ''; + self::$after = ''; + } + + /** + * The function should return a valid link if a privacy policy page has been + * created and set as the `wp_page_for_privacy_policy`. The post title should + * be used as the link text. + */ + public function test_get_the_privacy_policy_link_should_return_valid_link_when_privacy_page_set() { + update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); + + $actual_link = get_the_privacy_policy_link(); + + $this->assertStringStartsWith( 'assertStringContainsString( self::$privacy_policy_url, $actual_link ); + $this->assertStringEndsWith( '>' . WP_TESTS_DOMAIN . ' Privacy Policy', $actual_link ); + } + + /** + * The function should allow only supported formatting in the privacy policy page title. + * + * @ticket 64748 + */ + public function test_get_the_privacy_policy_link_should_allow_supported_title_markup() { + wp_update_post( + array( + 'ID' => self::$privacy_policy_page_id, + 'post_title' => 'Privacy Policy Bold Italic ', + + ) + + $privacy_policy_page_id = self::$privacy_policy_page_id; + $filter = static function ( $title, $post_id ) use ( $privacy_policy_page_id ) { + if ( (int) $privacy_policy_page_id === (int) $post_id ) { + return '' . $title . ''; + } + + return $title; + }; + + add_filter( 'the_title', $filter, 10, 2 ); + } + + + + return $title; + + }; + + + + add_filter( 'the_title', $filter, 10, 2 ); + + update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); + + $actual_link = get_the_privacy_policy_link(); + + remove_filter( 'the_title', $filter, 10 ); + + + + $this->assertStringEndsWith( + '>Privacy Policy Bold Italic alert("test")', + + $actual_link + ); + } + + /** + * The function should prepend the supplied `$before` markup and append the + * supplied `$after` markup when the `wp_page_for_privacy_policy` is configured. + */ + public function test_get_the_privacy_policy_link_should_prepend_and_append_supplied_markup_when_privacy_page_set() { + update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); + + $actual_link = get_the_privacy_policy_link( self::$before, self::$after ); + + $this->assertStringStartsWith( self::$before . 'assertStringContainsString( self::$privacy_policy_url, $actual_link ); + $this->assertStringEndsWith( '' . self::$after, $actual_link ); + } + + /** + * The function should _not_ prepend the supplied `$before` markup and append + * the supplied `$after` markup when the `wp_page_for_privacy_policy` is _not_ configured. + */ + public function test_get_the_privacy_policy_link_should_not_prepend_and_append_supplied_markup_when_privacy_page_not_set() { + $actual_link = get_the_privacy_policy_link( self::$before, self::$after ); + + $this->assertSame( '', $actual_link ); + } + + /** + * The function should return an empty string when there is an empty page title + * for the privacy policy. + * + * @ticket 44192 + */ + public function test_function_should_return_empty_string_when_privacy_page_title_empty() { + $nameless_page_id = self::factory()->post->create( + array( + 'post_type' => 'page', + 'post_title' => '', + ) + ); + + update_option( 'wp_page_for_privacy_policy', $nameless_page_id ); + + $this->assertSame( '', get_the_privacy_policy_link( self::$before, self::$after ) ); + } + + /** + * The function should return an empty string when `wp_page_for_privacy_policy` is _not_ configured. + */ + public function test_get_the_privacy_policy_link_should_return_empty_string_when_privacy_page_not_set() { + $this->assertSame( '', get_the_privacy_policy_link() ); + } + + /** + * The output of the get_the_privacy_policy_link() function should be filterable with the 'privacy_policy_link' filter. + */ + public function test_get_the_privacy_policy_link_should_be_filterable() { + update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); + $expected_url = get_privacy_policy_url(); + + $this->assertNotEmpty( $expected_url ); + + add_filter( 'the_privacy_policy_link', array( $this, 'modify_link_markup' ), 10, 2 ); + $this->assertSame( 'Policy: ' . $expected_url, get_the_privacy_policy_link() ); + remove_filter( 'the_privacy_policy_link', array( $this, 'modify_link_markup' ), 10 ); + } + + /** + * Return modified `the_privacy_policy_link` content in order to test the filter. + * + * @param string $link The privacy policy link. Empty string if it + * doesn't exist. + * @param string $privacy_policy_url The URL of the privacy policy. Empty string + * if it doesn't exist. + * @return string + */ + public static function modify_link_markup( $link, $privacy_policy_url ) { + return 'Policy: ' . $privacy_policy_url; + } + + /** + * Tests that `get_the_privacy_policy_link()` adds `rel="privacy-policy"`. + * + * @ticket 56345 + */ + public function test_get_the_privacy_policy_link_should_add_rel_privacy_policy() { + update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); + + $this->assertStringContainsString( 'rel="privacy-policy"', get_the_privacy_policy_link() ); + } +} From d538a5837931ac47f24507fefc55b75db4d32eae Mon Sep 17 00:00:00 2001 From: Shail Mehta Date: Sun, 27 Sep 2026 16:19:19 +0530 Subject: [PATCH 09/10] Tests: Fix coding standards in the privacy policy link test. The markup test did not parse and had extra blank lines that fail PHPCS. --- .../tests/link/getThePrivacyPolicyLink.php | 16 +--------------- 1 file changed, 1 insertion(+), 15 deletions(-) diff --git a/tests/phpunit/tests/link/getThePrivacyPolicyLink.php b/tests/phpunit/tests/link/getThePrivacyPolicyLink.php index 67d9554dd3f28..8da5f0f4adcde 100644 --- a/tests/phpunit/tests/link/getThePrivacyPolicyLink.php +++ b/tests/phpunit/tests/link/getThePrivacyPolicyLink.php @@ -88,8 +88,8 @@ public function test_get_the_privacy_policy_link_should_allow_supported_title_ma array( 'ID' => self::$privacy_policy_page_id, 'post_title' => 'Privacy Policy Bold Italic ', - ) + ); $privacy_policy_page_id = self::$privacy_policy_page_id; $filter = static function ( $title, $post_id ) use ( $privacy_policy_page_id ) { @@ -100,17 +100,6 @@ public function test_get_the_privacy_policy_link_should_allow_supported_title_ma return $title; }; - add_filter( 'the_title', $filter, 10, 2 ); - } - - - - return $title; - - }; - - - add_filter( 'the_title', $filter, 10, 2 ); update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); @@ -119,11 +108,8 @@ public function test_get_the_privacy_policy_link_should_allow_supported_title_ma remove_filter( 'the_title', $filter, 10 ); - - $this->assertStringEndsWith( '>Privacy Policy Bold Italic alert("test")', - $actual_link ); } From 058fc87294a152912f0c376a4d5666d1ac054bed Mon Sep 17 00:00:00 2001 From: Shail Mehta Date: Sun, 27 Sep 2026 16:40:13 +0530 Subject: [PATCH 10/10] Tests: Stabilize privacy policy link markup coverage. Inject title markup through the_title after core formatting filters so the assertion is not affected by wptexturize or title-save KSES. --- .../tests/link/getThePrivacyPolicyLink.php | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-) diff --git a/tests/phpunit/tests/link/getThePrivacyPolicyLink.php b/tests/phpunit/tests/link/getThePrivacyPolicyLink.php index 8da5f0f4adcde..903c3fb70907e 100644 --- a/tests/phpunit/tests/link/getThePrivacyPolicyLink.php +++ b/tests/phpunit/tests/link/getThePrivacyPolicyLink.php @@ -84,32 +84,27 @@ public function test_get_the_privacy_policy_link_should_return_valid_link_when_p * @ticket 64748 */ public function test_get_the_privacy_policy_link_should_allow_supported_title_markup() { - wp_update_post( - array( - 'ID' => self::$privacy_policy_page_id, - 'post_title' => 'Privacy Policy Bold Italic ', - ) - ); - $privacy_policy_page_id = self::$privacy_policy_page_id; - $filter = static function ( $title, $post_id ) use ( $privacy_policy_page_id ) { + + // Run after core `the_title` formatting filters (e.g. wptexturize). + $filter = static function ( $title, $post_id ) use ( $privacy_policy_page_id ) { if ( (int) $privacy_policy_page_id === (int) $post_id ) { - return '' . $title . ''; + return 'Privacy Policy Bold Italic Page '; } return $title; }; - add_filter( 'the_title', $filter, 10, 2 ); + add_filter( 'the_title', $filter, 20, 2 ); update_option( 'wp_page_for_privacy_policy', self::$privacy_policy_page_id ); $actual_link = get_the_privacy_policy_link(); - remove_filter( 'the_title', $filter, 10 ); + remove_filter( 'the_title', $filter, 20 ); $this->assertStringEndsWith( - '>Privacy Policy Bold Italic alert("test")', + '>Privacy Policy Bold Italic Page alert("test")', $actual_link ); }