[salvatorecorsi]

Two callbacks on postmeta_form_keys can provide the same key to the Custom Fields meta box. The duplicate then appears twice in the Name dropdown. A non-null filter result bypasses the database query, so the query's DISTINCT clause does not cover this case.

To reproduce, register two callbacks at different priorities that each append the same string to (array) $keys. Edit a post with the Custom Fields box enabled and open its Name dropdown. The shared key appears twice on trunk.

Remove duplicate keys before the existing natural sort. Case-distinct names remain separate, and the form still checks permissions and skips protected keys.

Trac ticket: https://core.trac.wordpress.org/ticket/54339

Testing

• The new integration test fails on unchanged production code because shared appears twice. It passes with the fix and checks natural order, case-distinct keys, and hidden or unauthorized keys.
• Tests_Admin_IncludesTemplate passes in single-site and multisite mode (45 tests, 130 assertions each). Changed files pass PHP syntax, PHPCS, and PHP compatibility checks. Scoped PHPStan passes for template.php.
• The broader admin group has an unrelated download_url() failure under native Windows. The same dataset fails on the unchanged production baseline. The group also reports PHPUnit deprecation warnings.

Use of AI Tools

AI assistance: Yes
Tool: OpenAI Codex
Used for: Investigating the report, writing the code and regression test, and running and reviewing the automated checks. The account owner has not performed a human review of this patch.

---

This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs.

Core Committers: Use this line as a base for the props when committing in SVN:

Props salvatorecorsi.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

---

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

• @propsbot add <username> to give props to a GitHub user. Requires write access.
• @propsbot remove <username> to leave a user out of the props. Requires write access.
• @propsbot refresh to refresh this list. Adding the props-bot label works too.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.