Repository navigation
Keep submitted shortcodes and merge tags encoded on WordPress 7.2 - #1972
Merged
Merged
Conversation
2 tasks
Contributor
|
Coverage report for commit: 7d39622 Summary - Lines: 93.30% | Methods: 88.89% | Branches: 82.27%
🤖 Jest coverage report |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Contributor
|
Coverage report for commit: 7d39622 Summary - Lines: 88.36% | Methods: 95.14%
🤖 PHPUnit coverage report |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
gravitypdf-bot
force-pushed
the
fix/kses-keep-encoded-tags-wp72
branch
2 times, most recently
from
October 27, 2026 05:47
55efccf to
8fb2921
Compare
WordPress 7.2 rebuilds wp_kses() on the HTML API, which decodes the `[`/`{` references encode_tags() used, so Kses::parse() turned submitted `{admin_email}` and `[gravitypdf]` back into live tags. encode_tags() now puts a zero-width no-break space (U+FEFF) after each `[`, `{` and `:` instead. Kses keeps it, and mPDF strips it before drawing, so it's invisible in every font (U+2060 showed as a box or a gap in most). Joiners go on the whole value and the HTML tag processor takes them back out of attribute values, which are URL-encoded as before. An attribute's colons are neutralised too, so a merge tag opened in the text can't end inside one: a URL keeps its scheme and gets %3A, a style declaration keeps a lone property colon, and anything else gets the joiner. Trusted default tags are mapped back from both attribute forms. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gravitypdf-bot
force-pushed
the
fix/kses-keep-encoded-tags-wp72
branch
from
October 27, 2026 05:54
8fb2921 to
7d39622
Compare
zamoragregory
pushed a commit
that referenced
this pull request
Oct 27, 2026
…olon handling Same encode_tags() change as #1972. A zero-width no-break space (U+FEFF) replaces the word joiner, as mPDF strips it before drawing. Joiners now go on the whole value and come back out of attribute values, so text that only looks like a tag is covered, and an attribute's colons are neutralised so a merge tag opened in the text can't end inside one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Gravity PDF encodes
[ ] { }in submitted values as[ ] { }, so shortcodes and merge tags in them aren't processed in a PDF. The HTML then goes throughKses::parse(). WordPress 7.2 rebuildswp_kses()on the HTML API, which decodes those character references, soKses::parse()turned them back into real tags. On WordPress 7.2-beta1, a submitted{admin_email}printed the site admin's email address in the PDF, and a submitted[gravitypdf]shortcode printed a link.encode_tags()now puts a zero-width no-break space (U+FEFF) after each[,{and:instead. Kses keeps it on both parsers, it stops shortcodes and merge tags matching, and mPDF strips it before drawing, so the PDF shows the text as typed. HTML attributes keep their URL-encoding, and their colons are neutralised too, so a merge tag opened in the text can't end inside one.$form_datavalues get the same.Try it
{admin_email} [gravitypdf id="<PDF ID>"].Test plan
yarn test:php -- --filter 'test_encode_tags|test_html_structure_keeps_user_tags_encoded'More info
wp_kses_force_legacy_parser.:too: Gravity Forms' field merge tags ({Label:1},{Label:1:value},{:1}) and Gravity PDF's{Label:pdf:ID}allow any text after{, so a joiner there alone doesn't stop them.I <3 {admin_email} >_<, is covered too.[ ] { }are URL-encoded as before. A colon gets%3Ain a URL after the scheme, stays as a style declaration's property colon, and gets the joiner anywhere else, so a rich-text value like{x <b title=":3:">}can't print field 3's value.[ ] { }don't change.$form_datathat contains brackets also gets a joiner afterhttps:. It prints the same, but a custom template that uses it as a link would need to strip U+FEFF.[ ] { }, a link with a port, likehttps://example.org:8080/, gets%3Afor the port's colon, which breaks the link.test_encode_tagscovers 11 cases. Each is checked encoded twice, and against Gravity PDF's and Gravity Forms' merge tag patterns after kses.test_default_tags_are_restored_in_attributesis new.test_html_structure_keeps_user_tags_encodedruns on both kses parsers, and covers a{Text:1}field tag andI <3 {admin_email} >_<.[to U+FEFF.entry-tagsandsigned-urlPlaywright specs look for U+FEFF instead of[.hot-patch-6.18.0.🤖 Generated with AI