From 24f12a986a9dc9fe41504fe2aa672b79e4177901 Mon Sep 17 00:00:00 2001 From: Sergey Biryukov Date: Sat, 29 Aug 2026 18:23:22 +0000 Subject: [PATCH 1/4] Migrate raw admin inline scripts to wp_print_inline_script_tag() - admin-header.php: global admin JS (ajaxurl, pagenow, adminpage...) and the no-js replacement now print through wp_print_inline_script_tag(). - includes/media.php: all 11 inline script blocks (send-to-editor, plupload init, addExtImage, preloaded item lists) migrated to wp_print_inline_script_tag() with the same JS output; the disable_captions conditional and dynamic admin image URLs are preserved. - Prerequisite for the CSP rollout (#59446): the wp_inline_script_attributes filter can now attach a per-request nonce to these scripts. --- src/wp-admin/admin-header.php | 32 +++++---- src/wp-admin/includes/media.php | 111 ++++++++++++++++++-------------- 2 files changed, 81 insertions(+), 62 deletions(-) diff --git a/src/wp-admin/admin-header.php b/src/wp-admin/admin-header.php index 92fbd3a4a2f79..133723c586c34 100644 --- a/src/wp-admin/admin-header.php +++ b/src/wp-admin/admin-header.php @@ -101,16 +101,20 @@ $admin_body_class = preg_replace( '/[^a-z0-9_-]+/i', '-', $hook_suffix ); ?> - +id ) . "',\n"; +$admin_inline_js .= "\ttypenow = '" . esc_js( $current_screen->post_type ) . "',\n"; +$admin_inline_js .= "\tadminpage = '" . esc_js( $admin_body_class ) . "',\n"; +$admin_inline_js .= "\tthousandsSeparator = '" . esc_js( $wp_locale->number_format['thousands_sep'] ) . "',\n"; +$admin_inline_js .= "\tdecimalPoint = '" . esc_js( $wp_locale->number_format['decimal_point'] ) . "',\n"; +$admin_inline_js .= "\tisRtl = " . (int) is_rtl() . ";\n"; + +wp_print_inline_script_tag( $admin_inline_js ); +?> - + - + - + class="wp-core-ui no-js "> - + - + - + post_id = ' . $post_id . ';'; + wp_print_inline_script_tag( 'post_id = ' . $post_id . ';' ); if ( empty( $_GET['chromeless'] ) ) { echo '
'; @@ -2248,7 +2255,6 @@ function media_upload_form( $errors = null ) { $plupload_init = apply_filters( 'plupload_init', $plupload_init ); ?> -
- + 0 ) {\n" + . "\t\t\tpreloaded.each(function(){prepareMediaItem({id:this.id.replace(/[^0-9]/g, '')},'');});\n" + . "\t\t}\n" + . "\t\tupdateMediaForm();\n" + . '});' + ); + ?>
- + 0 ) {\n" + . "\t\t\tpreloaded.each(function(){prepareMediaItem({id:this.id.replace(/[^0-9]/g, '')},'');});\n" + . "\t\t\tupdateMediaForm();\n" + . "\t\t}\n" + . '});' + ); + ?>
@@ -2925,15 +2936,17 @@ function media_upload_library_form( $errors ) {
- + 0 ) {\n" + . "\t\t\tpreloaded.each(function(){prepareMediaItem({id:this.id.replace(/[^0-9]/g, '')},'');});\n" + . "\t\t\tupdateMediaForm();\n" + . "\t\t}\n" + . '});' + ); + ?>
From 7579b1a8a820c5641efef7c109bc80dd4bd4fc20 Mon Sep 17 00:00:00 2001 From: tin Date: Tue, 1 Sep 2026 10:43:27 +0700 Subject: [PATCH 2/4] Media/Admin: refactor inline scripts per westonruter feedback - Use nowdoc for addLoadEvent in admin-header.php - Use Object.assign + wp_json_encode for globals instead of esc_js() - Clean up indentation and code style Addresses feedback from westonruter on #13319 (see PR review comments). --- src/wp-admin/admin-header.php | 45 +++++++++++++++++++++++++++-------- 1 file changed, 35 insertions(+), 10 deletions(-) diff --git a/src/wp-admin/admin-header.php b/src/wp-admin/admin-header.php index 133723c586c34..d23d55f1accd1 100644 --- a/src/wp-admin/admin-header.php +++ b/src/wp-admin/admin-header.php @@ -104,16 +104,41 @@ id ) . "',\n"; -$admin_inline_js .= "\ttypenow = '" . esc_js( $current_screen->post_type ) . "',\n"; -$admin_inline_js .= "\tadminpage = '" . esc_js( $admin_body_class ) . "',\n"; -$admin_inline_js .= "\tthousandsSeparator = '" . esc_js( $wp_locale->number_format['thousands_sep'] ) . "',\n"; -$admin_inline_js .= "\tdecimalPoint = '" . esc_js( $wp_locale->number_format['decimal_point'] ) . "',\n"; -$admin_inline_js .= "\tisRtl = " . (int) is_rtl() . ";\n"; - -wp_print_inline_script_tag( $admin_inline_js ); +wp_print_inline_script_tag( + <<<'JS' + function addLoadEvent(func) { + if (typeof jQuery !== 'undefined') { + jQuery(function () { + func(); + }); + } else if (typeof wpOnload !== 'function') { + window.wpOnload = func; + } else { + const oldonload = wpOnload; + window.wpOnload = function () { + oldonload(); + func(); + } + } + } + JS +); +wp_print_inline_script_tag( + sprintf( + 'Object.assign( window, %s );', + wp_json_encode( + array( + 'ajaxurl' => admin_url( 'admin-ajax.php', 'relative' ), + 'pagenow' => $current_screen->id, + 'typenow' => $current_screen->post_type, + 'adminpage' => $admin_body_class, + 'thousandsSeparator' => $wp_locale->number_format['thousands_sep'], + 'decimalPoint' => $wp_locale->number_format['decimal_point'], + 'isRtl' => (bool) is_rtl(), + ) + ) + ) +); ?> Date: Tue, 1 Sep 2026 11:30:46 +0700 Subject: [PATCH 3/4] Media/Admin: apply westonruter's review feedback on the inline script refactor - Use nowdoc for the migrated inline scripts (admin-header.php no-js replacement, the three preloaded-item handlers in media.php, the popup addLoadEvent) so IDEs syntax-check the JS. - Refactor the media-upload-popup globals block the same way as admin-header.php: unminified, strict-mode compatible addLoadEvent, and Object.assign( window, wp_json_encode( ... ) ) instead of esc_js() string building, per the suggestion. - media_send_to_editor() prints via the suggested sprintf() + wp_json_encode(). - Remove the PHP close/reopen pairs introduced by the migration in media_send_to_editor(), wp_iframe(), media_upload_form_handler(), media_upload_gallery_form() and admin-header.php. - Keep isRtl as (int) to preserve the previous JS value type. See #59446. --- src/wp-admin/admin-header.php | 13 ++-- src/wp-admin/includes/media.php | 104 +++++++++++++++++++------------- 2 files changed, 67 insertions(+), 50 deletions(-) diff --git a/src/wp-admin/admin-header.php b/src/wp-admin/admin-header.php index d23d55f1accd1..5efc4ccc940cc 100644 --- a/src/wp-admin/admin-header.php +++ b/src/wp-admin/admin-header.php @@ -100,8 +100,7 @@ wp_enqueue_script( 'svg-painter' ); $admin_body_class = preg_replace( '/[^a-z0-9_-]+/i', '-', $hook_suffix ); -?> - $admin_body_class, 'thousandsSeparator' => $wp_locale->number_format['thousands_sep'], 'decimalPoint' => $wp_locale->number_format['decimal_point'], - 'isRtl' => (bool) is_rtl(), + 'isRtl' => (int) is_rtl(), ) ) ) ); -?> -"> - - - - admin_url( 'admin-ajax.php', 'relative' ), + 'pagenow' => 'media-upload-popup', + 'adminpage' => 'media-upload-popup', + 'isRtl' => (int) is_rtl(), + ), + 0 | JSON_HEX_TAG | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_LINE_TERMINATORS + ) + ) ); - ?> - - - - 0 ) {\n" - . "\t\t\tpreloaded.each(function(){prepareMediaItem({id:this.id.replace(/[^0-9]/g, '')},'');});\n" - . "\t\t}\n" - . "\t\tupdateMediaForm();\n" - . '});' + <<<'JS' + jQuery(function($){ + var preloaded = $(".media-item.preloaded"); + if ( preloaded.length > 0 ) { + preloaded.each(function(){prepareMediaItem({id:this.id.replace(/[^0-9]/g, '')},'');}); + } + updateMediaForm(); + }); + JS ); ?>
@@ -2605,16 +2623,16 @@ function media_upload_gallery_form( $errors ) { $form_class .= ' html-uploader'; } - ?> - 0 ) {\n" - . "\t\t\tpreloaded.each(function(){prepareMediaItem({id:this.id.replace(/[^0-9]/g, '')},'');});\n" - . "\t\t\tupdateMediaForm();\n" - . "\t\t}\n" - . '});' + <<<'JS' + jQuery(function($){ + var preloaded = $(".media-item.preloaded"); + if ( preloaded.length > 0 ) { + preloaded.each(function(){prepareMediaItem({id:this.id.replace(/[^0-9]/g, '')},'');}); + updateMediaForm(); + } + }); + JS ); ?>
@@ -2938,13 +2956,15 @@ function media_upload_library_form( $errors ) { 0 ) {\n" - . "\t\t\tpreloaded.each(function(){prepareMediaItem({id:this.id.replace(/[^0-9]/g, '')},'');});\n" - . "\t\t\tupdateMediaForm();\n" - . "\t\t}\n" - . '});' + <<<'JS' + jQuery(function($){ + var preloaded = $(".media-item.preloaded"); + if ( preloaded.length > 0 ) { + preloaded.each(function(){prepareMediaItem({id:this.id.replace(/[^0-9]/g, '')},'');}); + updateMediaForm(); + } + }); + JS ); ?> From 11f6b33f042be33b958d1c7fe743584c302020f2 Mon Sep 17 00:00:00 2001 From: tin Date: Tue, 1 Sep 2026 13:53:01 +0700 Subject: [PATCH 4/4] Media/Admin: apply second round of review feedback - Use nowdoc heredocs for static inline scripts in wp_iframe() and gallery handling. - Use wp_json_encode() with full JSON flag set for Object.assign() data payloads. - Scope post_id to var instead of implicit global in media_upload_header(). --- src/wp-admin/admin-header.php | 3 ++- src/wp-admin/includes/media.php | 35 +++++++++++++++++++++++++++------ 2 files changed, 31 insertions(+), 7 deletions(-) diff --git a/src/wp-admin/admin-header.php b/src/wp-admin/admin-header.php index 5efc4ccc940cc..8d935bb2b86e7 100644 --- a/src/wp-admin/admin-header.php +++ b/src/wp-admin/admin-header.php @@ -134,7 +134,8 @@ function addLoadEvent(func) { 'thousandsSeparator' => $wp_locale->number_format['thousands_sep'], 'decimalPoint' => $wp_locale->number_format['decimal_point'], 'isRtl' => (int) is_rtl(), - ) + ), + 0 | JSON_HEX_TAG | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_LINE_TERMINATORS ) ) ); diff --git a/src/wp-admin/includes/media.php b/src/wp-admin/includes/media.php index 7ff3ac7c166ad..176f78dff8225 100644 --- a/src/wp-admin/includes/media.php +++ b/src/wp-admin/includes/media.php @@ -658,7 +658,9 @@ function addLoadEvent(func) { class="wp-core-ui no-js "> - + '; @@ -2286,8 +2300,17 @@ function media_upload_form( $errors = null ) { } wp_print_inline_script_tag( - "var resize_height = {$large_size_h}, resize_width = {$large_size_w},\n" - . 'wpUploaderInit = ' . wp_json_encode( $plupload_init, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ';' + sprintf( + 'Object.assign( window, %s );', + wp_json_encode( + array( + 'resize_height' => $large_size_h, + 'resize_width' => $large_size_w, + 'wpUploaderInit' => $plupload_init, + ), + 0 | JSON_HEX_TAG | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_LINE_TERMINATORS + ) + ) ); ?>