Repository navigation
Conversation
- Read the row button's option name with .attr( 'data-option' ). jQuery's
.data() parses JSON-like names such as '["foo"]', '{"a":1}' or 'null', so
those were sent as arrays or empty values. The bulk-delete path already
reads the raw attribute.
- The update-autoload, delete-option and create-option-false routes now
require option_name to be a string of 1 to 191 characters, and no longer
run it through sanitize_text_field(), which changed names like 'a b' or
'a<b>c' and made the action miss or hit a different option.
- Include the table id in DataTables row ids, so <tr> ids stay unique when
an option is listed in more than one table.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Test on Playground |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Row actions (toggle autoload, delete, create option with value false) could miss the option shown in the table, or reach the server with an empty name.
What was wrong
.data()parses the name.handleTableActionsread the name withbutton.data( 'option' ), which turns JSON-like names into values:["foo"]became an array (sent asoption_name[]=foo),{"a":1}an object, andnullan empty value. Bulk delete already read the raw attribute withgetAttribute( 'data-option' ).sanitize_text_field()changed names. The three single-option routes ranoption_namethrough it, soa bbecamea b,a<b>cbecameac, and so on. The action then missed the option or targeted a different one.<tr>ids repeated across tables. An option listed in both "All options" and another table got the same row id in both.Changes
handleTableActionsreadsbutton.attr( 'data-option' ).update-autoload,delete-optionandcreate-option-falseshareget_option_name_arg():type: string,minLength: 1,maxLength: 191, nosanitize_callback. Arrays and objects now get a 400 instead of relying onsanitize_text_field()returning''.getTableRowId()prefixes row ids with the table id. Single actions and bulk delete look rows up through it.Testing
On a local site:
aaaoo two spacesandaaaoo<b>tagare toggled exactly, no altered copy is created["siteurl"],{"a":1},null,123,aaaoo two spaces,aaaoo<b>tag; each request sends the exact name, returns 200, and the options are gone from the database afterwards;siteurlunchangedLint: PHPCS clean, PHPStan unchanged (44 existing errors),
lint:jsonly the existing prettier error in the migration code.🤖 Generated with Claude Code