<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[60681] trunk: Scripts: Use appropriate JSON encoding flags for script tags.</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { white-space: pre-line; overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta" style="font-size: 105%">
<dt style="float: left; width: 6em; font-weight: bold">Revision</dt> <dd><a style="font-weight: bold" href="https://core.trac.wordpress.org/changeset/60681">60681</a><script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","description":"Review this Commit","action":{"@type":"ViewAction","url":"https://core.trac.wordpress.org/changeset/60681","name":"Review Commit"}}</script></dd>
<dt style="float: left; width: 6em; font-weight: bold">Author</dt> <dd>jonsurrell</dd>
<dt style="float: left; width: 6em; font-weight: bold">Date</dt> <dd>2025-08-27 10:32:57 +0000 (Wed, 27 Aug 2025)</dd>
</dl>
<pre style='padding-left: 1em; margin: 2em 0; border-left: 2px solid #ccc; line-height: 1.25; font-size: 105%; font-family: sans-serif'>Scripts: Use appropriate JSON encoding flags for script tags.
`wp_json_encode()` with default arguments is insufficient to safely escape JSON for script tags. Use `JSON_HEX_TAG | JSON_UNESCAPED_SLASHES` flags.
Developed in https://github.com/WordPress/wordpress-develop/pull/9557.
Props devasheeshkaul, jonsurrell, siliconforks.
Fixes <a href="https://core.trac.wordpress.org/ticket/63851">#63851</a>.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunksrcwpadminasyncuploadphp">trunk/src/wp-admin/async-upload.php</a></li>
<li><a href="#trunksrcwpadmincustomizephp">trunk/src/wp-admin/customize.php</a></li>
<li><a href="#trunksrcwpadmineditformblocksphp">trunk/src/wp-admin/edit-form-blocks.php</a></li>
<li><a href="#trunksrcwpadminincludesclasswpinternalpointersphp">trunk/src/wp-admin/includes/class-wp-internal-pointers.php</a></li>
<li><a href="#trunksrcwpadminincludesclasswplisttablephp">trunk/src/wp-admin/includes/class-wp-list-table.php</a></li>
<li><a href="#trunksrcwpadminincludesclasswpprivacypolicycontentphp">trunk/src/wp-admin/includes/class-wp-privacy-policy-content.php</a></li>
<li><a href="#trunksrcwpadminincludesclasswpthemeslisttablephp">trunk/src/wp-admin/includes/class-wp-themes-list-table.php</a></li>
<li><a href="#trunksrcwpadminincludesmediaphp">trunk/src/wp-admin/includes/media.php</a></li>
<li><a href="#trunksrcwpadminincludesmiscphp">trunk/src/wp-admin/includes/misc.php</a></li>
<li><a href="#trunksrcwpadminincludesoptionsphp">trunk/src/wp-admin/includes/options.php</a></li>
<li><a href="#trunksrcwpadminincludespostphp">trunk/src/wp-admin/includes/post.php</a></li>
<li><a href="#trunksrcwpadminincludestemplatephp">trunk/src/wp-admin/includes/template.php</a></li>
<li><a href="#trunksrcwpadminplugineditorphp">trunk/src/wp-admin/plugin-editor.php</a></li>
<li><a href="#trunksrcwpadminsiteeditorphp">trunk/src/wp-admin/site-editor.php</a></li>
<li><a href="#trunksrcwpadminthemeeditorphp">trunk/src/wp-admin/theme-editor.php</a></li>
<li><a href="#trunksrcwpadminwidgetsformblocksphp">trunk/src/wp-admin/widgets-form-blocks.php</a></li>
<li><a href="#trunksrcwpcontentthemestwentytwentyfunctionsphp">trunk/src/wp-content/themes/twentytwenty/functions.php</a></li>
<li><a href="#trunksrcwpincludesclasswpcustomizemanagerphp">trunk/src/wp-includes/class-wp-customize-manager.php</a></li>
<li><a href="#trunksrcwpincludesclasswpcustomizenavmenusphp">trunk/src/wp-includes/class-wp-customize-nav-menus.php</a></li>
<li><a href="#trunksrcwpincludesclasswpcustomizewidgetsphp">trunk/src/wp-includes/class-wp-customize-widgets.php</a></li>
<li><a href="#trunksrcwpincludesclasswpscriptmodulesphp">trunk/src/wp-includes/class-wp-script-modules.php</a></li>
<li><a href="#trunksrcwpincludesclasswpscriptsphp">trunk/src/wp-includes/class-wp-scripts.php</a></li>
<li><a href="#trunksrcwpincludescustomizeclasswpcustomizeselectiverefreshphp">trunk/src/wp-includes/customize/class-wp-customize-selective-refresh.php</a></li>
<li><a href="#trunksrcwpincludesgeneraltemplatephp">trunk/src/wp-includes/general-template.php</a></li>
<li><a href="#trunksrcwpincludesmediaphp">trunk/src/wp-includes/media.php</a></li>
<li><a href="#trunksrcwpincludesscriptloaderphp">trunk/src/wp-includes/script-loader.php</a></li>
<li><a href="#trunksrcwpincludesspeculativeloadingphp">trunk/src/wp-includes/speculative-loading.php</a></li>
<li><a href="#trunksrcwpincludesthemepreviewsphp">trunk/src/wp-includes/theme-previews.php</a></li>
<li><a href="#trunksrcwpincludesthemephp">trunk/src/wp-includes/theme.php</a></li>
<li><a href="#trunksrcwpincludeswidgetsclasswpwidgetcustomhtmlphp">trunk/src/wp-includes/widgets/class-wp-widget-custom-html.php</a></li>
<li><a href="#trunksrcwpincludeswidgetsclasswpwidgetmediaaudiophp">trunk/src/wp-includes/widgets/class-wp-widget-media-audio.php</a></li>
<li><a href="#trunksrcwpincludeswidgetsclasswpwidgetmediagalleryphp">trunk/src/wp-includes/widgets/class-wp-widget-media-gallery.php</a></li>
<li><a href="#trunksrcwpincludeswidgetsclasswpwidgetmediaimagephp">trunk/src/wp-includes/widgets/class-wp-widget-media-image.php</a></li>
<li><a href="#trunksrcwpincludeswidgetsclasswpwidgetmediavideophp">trunk/src/wp-includes/widgets/class-wp-widget-media-video.php</a></li>
<li><a href="#trunksrcwpincludeswidgetsclasswpwidgettextphp">trunk/src/wp-includes/widgets/class-wp-widget-text.php</a></li>
<li><a href="#trunktestsphpunittestsdependencieswpLocalizeScriptphp">trunk/tests/phpunit/tests/dependencies/wpLocalizeScript.php</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunksrcwpadminasyncuploadphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/async-upload.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/async-upload.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/async-upload.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -145,7 +145,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $_FILES['async-upload']['name']
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- echo '<script>_.delay(function() {wp.a11y.speak(' . wp_json_encode( $speak_message ) . ");}, 1500);jQuery( 'button#{$button_unique_id}' ).on( 'click', function() {jQuery(this).parents('div.media-item').slideUp(200, function(){jQuery(this).remove();wp.a11y.speak( wp.i18n.__( 'Error dismissed.' ) );jQuery( '#plupload-browse-button' ).trigger( 'focus' );})});</script>\n";
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ echo '<script>_.delay(function() {wp.a11y.speak(' . wp_json_encode( $speak_message, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ");}, 1500);jQuery( 'button#{$button_unique_id}' ).on( 'click', function() {jQuery(this).parents('div.media-item').slideUp(200, function(){jQuery(this).remove();wp.a11y.speak( wp.i18n.__( 'Error dismissed.' ) );jQuery( '#plupload-browse-button' ).trigger( 'focus' );})});</script>\n";
</ins><span class="cx" style="display: block; padding: 0 10px"> exit;
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="trunksrcwpadmincustomizephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/customize.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/customize.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/customize.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -62,7 +62,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> ?>
</span><span class="cx" style="display: block; padding: 0 10px"> <?php wp_print_scripts( array( 'wp-util' ) ); ?>
</span><span class="cx" style="display: block; padding: 0 10px"> <script>
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp.ajax.post( 'customize_save', <?php echo wp_json_encode( $request_args ); ?> );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp.ajax.post( 'customize_save', <?php echo wp_json_encode( $request_args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> );
</ins><span class="cx" style="display: block; padding: 0 10px"> </script>
</span><span class="cx" style="display: block; padding: 0 10px"> <?php
</span><span class="cx" style="display: block; padding: 0 10px"> $script = ob_get_clean();
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -158,7 +158,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> <title><?php echo esc_html( $admin_title ); ?></title>
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> <script type="text/javascript">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-var ajaxurl = <?php echo wp_json_encode( admin_url( 'admin-ajax.php', 'relative' ) ); ?>,
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+var ajaxurl = <?php echo wp_json_encode( admin_url( 'admin-ajax.php', 'relative' ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>,
</ins><span class="cx" style="display: block; padding: 0 10px"> pagenow = 'customize';
</span><span class="cx" style="display: block; padding: 0 10px"> </script>
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="trunksrcwpadmineditformblocksphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/edit-form-blocks.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/edit-form-blocks.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/edit-form-blocks.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -115,7 +115,7 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp-blocks',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $post ) ) ),
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $post ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
</ins><span class="cx" style="display: block; padding: 0 10px"> 'after'
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -144,7 +144,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> // Preload server-registered block schemas.
</span><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp-blocks',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- 'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings() ) . ');'
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // Preload server-registered block bindings sources.
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -158,7 +158,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'usesContext' => $source->uses_context,
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp-blocks',
</span><span class="cx" style="display: block; padding: 0 10px"> $script
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -178,7 +178,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp-editor',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- sprintf( 'var _wpMetaBoxUrl = %s;', wp_json_encode( $meta_box_url ) ),
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ sprintf( 'var _wpMetaBoxUrl = %s;', wp_json_encode( $meta_box_url, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
</ins><span class="cx" style="display: block; padding: 0 10px"> 'before'
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -364,8 +364,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $init_script,
</span><span class="cx" style="display: block; padding: 0 10px"> $post->post_type,
</span><span class="cx" style="display: block; padding: 0 10px"> $post->ID,
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $editor_settings ),
- wp_json_encode( $initial_edits )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $editor_settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $initial_edits, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script( 'wp-edit-post', $script );
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="trunksrcwpadminincludesclasswpinternalpointersphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-wp-internal-pointers.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-wp-internal-pointers.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/includes/class-wp-internal-pointers.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -120,7 +120,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> ?>
</span><span class="cx" style="display: block; padding: 0 10px"> <script type="text/javascript">
</span><span class="cx" style="display: block; padding: 0 10px"> (function($){
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- var options = <?php echo wp_json_encode( $args ); ?>, setup;
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ var options = <?php echo wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>, setup;
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! options )
</span><span class="cx" style="display: block; padding: 0 10px"> return;
</span></span></pre></div>
<a id="trunksrcwpadminincludesclasswplisttablephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-wp-list-table.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-wp-list-table.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/includes/class-wp-list-table.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1871,6 +1871,6 @@
</span><span class="cx" style="display: block; padding: 0 10px"> ),
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- printf( "<script type='text/javascript'>list_args = %s;</script>\n", wp_json_encode( $args ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ printf( "<script type='text/javascript'>list_args = %s;</script>\n", wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcwpadminincludesclasswpprivacypolicycontentphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-wp-privacy-policy-content.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-wp-privacy-policy-content.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/includes/class-wp-privacy-policy-content.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -348,7 +348,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> sprintf(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp.data.dispatch( "core/notices" ).createWarningNotice( "%s", { actions: [ %s ], isDismissible: false } )',
</span><span class="cx" style="display: block; padding: 0 10px"> $message,
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $action )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $action, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> ),
</span><span class="cx" style="display: block; padding: 0 10px"> 'after'
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span></span></pre></div>
<a id="trunksrcwpadminincludesclasswpthemeslisttablephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-wp-themes-list-table.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-wp-themes-list-table.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/includes/class-wp-themes-list-table.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -357,7 +357,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $args = array_merge( $args, $extra_args );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- printf( "<script type='text/javascript'>var theme_list_args = %s;</script>\n", wp_json_encode( $args ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ printf( "<script type='text/javascript'>var theme_list_args = %s;</script>\n", wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> parent::_js_vars();
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcwpadminincludesmediaphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/media.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/media.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/includes/media.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -274,7 +274,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> ?>
</span><span class="cx" style="display: block; padding: 0 10px"> <script type="text/javascript">
</span><span class="cx" style="display: block; padding: 0 10px"> var win = window.dialogArguments || opener || parent || top;
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- win.send_to_editor( <?php echo wp_json_encode( $html ); ?> );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ win.send_to_editor( <?php echo wp_json_encode( $html, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> );
</ins><span class="cx" style="display: block; padding: 0 10px"> </script>
</span><span class="cx" style="display: block; padding: 0 10px"> <?php
</span><span class="cx" style="display: block; padding: 0 10px"> exit;
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -2236,7 +2236,7 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> ?>
</span><span class="cx" style="display: block; padding: 0 10px"> var resize_height = <?php echo $large_size_h; ?>, resize_width = <?php echo $large_size_w; ?>,
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wpUploaderInit = <?php echo wp_json_encode( $plupload_init ); ?>;
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wpUploaderInit = <?php echo wp_json_encode( $plupload_init, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
</ins><span class="cx" style="display: block; padding: 0 10px"> </script>
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> <div id="plupload-upload-ui" class="hide-if-no-js">
</span></span></pre></div>
<a id="trunksrcwpadminincludesmiscphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/misc.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/misc.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/includes/misc.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1085,7 +1085,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- echo '<script type="text/javascript">var _wpColorScheme = ' . wp_json_encode( array( 'icons' => $icon_colors ) ) . ";</script>\n";
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ echo '<script type="text/javascript">var _wpColorScheme = ' . wp_json_encode( array( 'icons' => $icon_colors ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ";</script>\n";
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span></span></pre></div>
<a id="trunksrcwpadminincludesoptionsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/options.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/options.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/includes/options.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -37,7 +37,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> jQuery( function($) {
</span><span class="cx" style="display: block; padding: 0 10px"> var $siteName = $( '#wp-admin-bar-site-name' ).children( 'a' ).first(),
</span><span class="cx" style="display: block; padding: 0 10px"> $siteIconPreview = $('#site-icon-preview-site-title'),
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- homeURL = ( <?php echo wp_json_encode( get_home_url() ); ?> || '' ).replace( /^(https?:\/\/)?(www\.)?/, '' );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ homeURL = ( <?php echo wp_json_encode( get_home_url(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> || '' ).replace( /^(https?:\/\/)?(www\.)?/, '' );
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $( '#blogname' ).on( 'input', function() {
</span><span class="cx" style="display: block; padding: 0 10px"> var title = $.trim( $( this ).val() ) || homeURL;
</span></span></pre></div>
<a id="trunksrcwpadminincludespostphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/post.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/post.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/includes/post.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -2442,7 +2442,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * our editor instance.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><span class="cx" style="display: block; padding: 0 10px"> $script = 'window._wpLoadBlockEditor.then( function() {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp.data.dispatch( \'core/edit-post\' ).setAvailableMetaBoxesPerLocation( ' . wp_json_encode( $meta_boxes_per_location ) . ' );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp.data.dispatch( \'core/edit-post\' ).setAvailableMetaBoxesPerLocation( ' . wp_json_encode( $meta_boxes_per_location, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ' );
</ins><span class="cx" style="display: block; padding: 0 10px"> } );';
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script( 'wp-edit-post', $script );
</span></span></pre></div>
<a id="trunksrcwpadminincludestemplatephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/template.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/template.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/includes/template.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -2479,7 +2479,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> function compression_test() {
</span><span class="cx" style="display: block; padding: 0 10px"> ?>
</span><span class="cx" style="display: block; padding: 0 10px"> <script type="text/javascript">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- var compressionNonce = <?php echo wp_json_encode( wp_create_nonce( 'update_can_compress_scripts' ) ); ?>;
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ var compressionNonce = <?php echo wp_json_encode( wp_create_nonce( 'update_can_compress_scripts' ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
</ins><span class="cx" style="display: block; padding: 0 10px"> var testCompression = {
</span><span class="cx" style="display: block; padding: 0 10px"> get : function(test) {
</span><span class="cx" style="display: block; padding: 0 10px"> var x;
</span></span></pre></div>
<a id="trunksrcwpadminplugineditorphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/plugin-editor.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/plugin-editor.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/plugin-editor.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -160,7 +160,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'codeEditor' => wp_enqueue_code_editor( array( 'file' => $real_file ) ),
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> wp_enqueue_script( 'wp-theme-plugin-editor' );
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'jQuery( function( $ ) { wp.themePluginEditor.init( $( "#template" ), %s ); } )', wp_json_encode( $settings ) ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'jQuery( function( $ ) { wp.themePluginEditor.init( $( "#template" ), %s ); } )', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'wp.themePluginEditor.themeOrPlugin = "plugin";' ) );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> require_once ABSPATH . 'wp-admin/admin-header.php';
</span></span></pre></div>
<a id="trunksrcwpadminsiteeditorphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/site-editor.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/site-editor.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/site-editor.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -257,7 +257,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp.domReady( function() {
</span><span class="cx" style="display: block; padding: 0 10px"> wp.editSite.initializeEditor( "site-editor", %s );
</span><span class="cx" style="display: block; padding: 0 10px"> } );',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $editor_settings )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $editor_settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -264,7 +264,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> // Preload server-registered block schemas.
</span><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp-blocks',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- 'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings() ) . ');'
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // Preload server-registered block bindings sources.
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -278,7 +278,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'usesContext' => $source->uses_context,
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp-blocks',
</span><span class="cx" style="display: block; padding: 0 10px"> $script
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -287,7 +287,7 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp-blocks',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( isset( $editor_settings['blockCategories'] ) ? $editor_settings['blockCategories'] : array() ) ),
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( isset( $editor_settings['blockCategories'] ) ? $editor_settings['blockCategories'] : array(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
</ins><span class="cx" style="display: block; padding: 0 10px"> 'after'
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="trunksrcwpadminthemeeditorphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/theme-editor.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/theme-editor.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/theme-editor.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -146,7 +146,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'codeEditor' => wp_enqueue_code_editor( compact( 'file' ) ),
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> wp_enqueue_script( 'wp-theme-plugin-editor' );
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'jQuery( function( $ ) { wp.themePluginEditor.init( $( "#template" ), %s ); } )', wp_json_encode( $settings ) ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+wp_add_inline_script( 'wp-theme-plugin-editor', sprintf( 'jQuery( function( $ ) { wp.themePluginEditor.init( $( "#template" ), %s ); } )', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script( 'wp-theme-plugin-editor', 'wp.themePluginEditor.themeOrPlugin = "theme";' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> require_once ABSPATH . 'wp-admin/admin-header.php';
</span></span></pre></div>
<a id="trunksrcwpadminwidgetsformblocksphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/widgets-form-blocks.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/widgets-form-blocks.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-admin/widgets-form-blocks.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -41,7 +41,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp.domReady( function() {
</span><span class="cx" style="display: block; padding: 0 10px"> wp.editWidgets.initialize( "widgets-editor", %s );
</span><span class="cx" style="display: block; padding: 0 10px"> } );',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $editor_settings )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $editor_settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -48,7 +48,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> // Preload server-registered block schemas.
</span><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp-blocks',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- 'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings() ) . ');'
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // Preload server-registered block bindings sources.
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -62,7 +62,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'usesContext' => $source->uses_context,
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp-blocks',
</span><span class="cx" style="display: block; padding: 0 10px"> $script
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -71,7 +71,7 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp-blocks',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $block_editor_context ) ) ),
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $block_editor_context ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
</ins><span class="cx" style="display: block; padding: 0 10px"> 'after'
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="trunksrcwpcontentthemestwentytwentyfunctionsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-content/themes/twentytwenty/functions.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-content/themes/twentytwenty/functions.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-content/themes/twentytwenty/functions.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -684,8 +684,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'twentytwenty-customize-preview',
</span><span class="cx" style="display: block; padding: 0 10px"> sprintf(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp.customize.selectiveRefresh.partialConstructor[ %1$s ].prototype.attrs = %2$s;',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( 'cover_opacity' ),
- wp_json_encode( twentytwenty_customize_opacity_range() )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( 'cover_opacity', JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( twentytwenty_customize_opacity_range(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcwpincludesclasswpcustomizemanagerphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/class-wp-customize-manager.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/class-wp-customize-manager.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/class-wp-customize-manager.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -476,7 +476,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> ( function( api, settings ) {
</span><span class="cx" style="display: block; padding: 0 10px"> var preview = new api.Messenger( settings.messengerArgs );
</span><span class="cx" style="display: block; padding: 0 10px"> preview.send( 'iframe-loading-error', settings.error );
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- } )( wp.customize, <?php echo wp_json_encode( $settings ); ?> );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ } )( wp.customize, <?php echo wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> );
</ins><span class="cx" style="display: block; padding: 0 10px"> </script>
</span><span class="cx" style="display: block; padding: 0 10px"> <?php
</span><span class="cx" style="display: block; padding: 0 10px"> $message .= wp_get_inline_script_tag( wp_remove_surrounding_empty_script_tags( ob_get_clean() ) );
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -2205,7 +2205,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> ob_start();
</span><span class="cx" style="display: block; padding: 0 10px"> ?>
</span><span class="cx" style="display: block; padding: 0 10px"> <script>
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- var _wpCustomizeSettings = <?php echo wp_json_encode( $settings ); ?>;
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ var _wpCustomizeSettings = <?php echo wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
</ins><span class="cx" style="display: block; padding: 0 10px"> _wpCustomizeSettings.values = {};
</span><span class="cx" style="display: block; padding: 0 10px"> (function( v ) {
</span><span class="cx" style="display: block; padding: 0 10px"> <?php
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -2218,8 +2218,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> if ( $setting->check_capabilities() ) {
</span><span class="cx" style="display: block; padding: 0 10px"> printf(
</span><span class="cx" style="display: block; padding: 0 10px"> "v[%s] = %s;\n",
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $id ),
- wp_json_encode( $setting->js_value() )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $id, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $setting->js_value(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -4988,7 +4988,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> ob_start();
</span><span class="cx" style="display: block; padding: 0 10px"> ?>
</span><span class="cx" style="display: block; padding: 0 10px"> <script>
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- var _wpCustomizeSettings = <?php echo wp_json_encode( $settings ); ?>;
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ var _wpCustomizeSettings = <?php echo wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
</ins><span class="cx" style="display: block; padding: 0 10px"> _wpCustomizeSettings.initialClientTimestamp = _.now();
</span><span class="cx" style="display: block; padding: 0 10px"> _wpCustomizeSettings.controls = {};
</span><span class="cx" style="display: block; padding: 0 10px"> _wpCustomizeSettings.settings = {};
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -5000,8 +5000,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> if ( $setting->check_capabilities() ) {
</span><span class="cx" style="display: block; padding: 0 10px"> printf(
</span><span class="cx" style="display: block; padding: 0 10px"> "s[%s] = %s;\n",
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $setting->id ),
- wp_json_encode( $setting->json() )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $setting->id, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $setting->json(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -5013,8 +5013,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> if ( $control->check_capabilities() ) {
</span><span class="cx" style="display: block; padding: 0 10px"> printf(
</span><span class="cx" style="display: block; padding: 0 10px"> "c[%s] = %s;\n",
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $control->id ),
- wp_json_encode( $control->json() )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $control->id, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $control->json(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcwpincludesclasswpcustomizenavmenusphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/class-wp-customize-nav-menus.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/class-wp-customize-nav-menus.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/class-wp-customize-nav-menus.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -545,7 +545,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'locationSlugMappedToName' => get_registered_nav_menus(),
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $data = sprintf( 'var _wpCustomizeNavMenusSettings = %s;', wp_json_encode( $settings ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $data = sprintf( 'var _wpCustomizeNavMenusSettings = %s;', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> wp_scripts()->add_data( 'customize-nav-menus', 'data', $data );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // This is copied from nav-menus.php, and it has an unfortunate object name of `menus`.
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1548,7 +1548,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $exports = array(
</span><span class="cx" style="display: block; padding: 0 10px"> 'navMenuInstanceArgs' => $this->preview_nav_menu_instance_args,
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_print_inline_script_tag( sprintf( 'var _wpCustomizePreviewNavMenusExports = %s;', wp_json_encode( $exports ) ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_print_inline_script_tag( sprintf( 'var _wpCustomizePreviewNavMenusExports = %s;', wp_json_encode( $exports, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span></span></pre></div>
<a id="trunksrcwpincludesclasswpcustomizewidgetsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/class-wp-customize-widgets.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/class-wp-customize-widgets.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/class-wp-customize-widgets.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -832,7 +832,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $wp_scripts->add_data(
</span><span class="cx" style="display: block; padding: 0 10px"> 'customize-widgets',
</span><span class="cx" style="display: block; padding: 0 10px"> 'data',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- sprintf( 'var _wpCustomizeWidgetsSettings = %s;', wp_json_encode( $settings ) )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ sprintf( 'var _wpCustomizeWidgetsSettings = %s;', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) )
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /*
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -859,7 +859,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp.domReady( function() {
</span><span class="cx" style="display: block; padding: 0 10px"> wp.customizeWidgets.initialize( "widgets-customizer", %s );
</span><span class="cx" style="display: block; padding: 0 10px"> } );',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $editor_settings )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $editor_settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -866,7 +866,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> // Preload server-registered block schemas.
</span><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp-blocks',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- 'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings() ) . ');'
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'wp.blocks.unstable__bootstrapServerSideBlockDefinitions(' . wp_json_encode( get_block_editor_server_block_settings(), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ');'
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // Preload server-registered block bindings sources.
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -880,7 +880,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'usesContext' => $source->uses_context,
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $script = sprintf( 'for ( const source of %s ) { wp.blocks.registerBlockBindingsSource( source ); }', wp_json_encode( $filtered_sources, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp-blocks',
</span><span class="cx" style="display: block; padding: 0 10px"> $script
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -889,7 +889,7 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp-blocks',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $block_editor_context ) ) ),
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ sprintf( 'wp.blocks.setCategories( %s );', wp_json_encode( get_block_categories( $block_editor_context ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ),
</ins><span class="cx" style="display: block; padding: 0 10px"> 'after'
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1334,7 +1334,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> unset( $registered_widget['callback'] ); // May not be JSON-serializable.
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> wp_print_inline_script_tag(
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- sprintf( 'var _wpWidgetCustomizerPreviewSettings = %s;', wp_json_encode( $settings ) )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ sprintf( 'var _wpWidgetCustomizerPreviewSettings = %s;', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) )
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="trunksrcwpincludesclasswpscriptmodulesphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/class-wp-script-modules.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/class-wp-script-modules.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/class-wp-script-modules.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -248,7 +248,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $import_map = $this->get_import_map();
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! empty( $import_map['imports'] ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> wp_print_inline_script_tag(
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $import_map, JSON_HEX_TAG | JSON_HEX_AMP ),
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $import_map, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
</ins><span class="cx" style="display: block; padding: 0 10px"> array(
</span><span class="cx" style="display: block; padding: 0 10px"> 'type' => 'importmap',
</span><span class="cx" style="display: block; padding: 0 10px"> 'id' => 'wp-importmap',
</span></span></pre></div>
<a id="trunksrcwpincludesclasswpscriptsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/class-wp-scripts.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/class-wp-scripts.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/class-wp-scripts.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -596,7 +596,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $script = "var $object_name = " . wp_json_encode( $l10n ) . ';';
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $script = "var $object_name = " . wp_json_encode( $l10n, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ';';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! empty( $after ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $script .= "\n$after;";
</span></span></pre></div>
<a id="trunksrcwpincludescustomizeclasswpcustomizeselectiverefreshphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/customize/class-wp-customize-selective-refresh.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/customize/class-wp-customize-selective-refresh.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/customize/class-wp-customize-selective-refresh.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -193,7 +193,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // Export data to JS.
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_print_inline_script_tag( sprintf( 'var _customizePartialRefreshExports = %s;', wp_json_encode( $exports ) ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_print_inline_script_tag( sprintf( 'var _customizePartialRefreshExports = %s;', wp_json_encode( $exports, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span></span></pre></div>
<a id="trunksrcwpincludesgeneraltemplatephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/general-template.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/general-template.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/general-template.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -4066,7 +4066,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_add_inline_script( 'code-editor', sprintf( 'jQuery.extend( wp.codeEditor.defaultSettings, %s );', wp_json_encode( $settings ) ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_add_inline_script( 'code-editor', sprintf( 'jQuery.extend( wp.codeEditor.defaultSettings, %s );', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="cx" style="display: block; padding: 0 10px"> * Fires when scripts and styles are enqueued for the code editor.
</span></span></pre></div>
<a id="trunksrcwpincludesmediaphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/media.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/media.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/media.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -3274,7 +3274,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> ?>
</span><span class="cx" style="display: block; padding: 0 10px"> </ol>
</span><span class="cx" style="display: block; padding: 0 10px"> </noscript>
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- <script type="application/json" class="wp-playlist-script"><?php echo wp_json_encode( $data ); ?></script>
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ <script type="application/json" class="wp-playlist-script"><?php echo wp_json_encode( $data, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?></script>
</ins><span class="cx" style="display: block; padding: 0 10px"> </div>
</span><span class="cx" style="display: block; padding: 0 10px"> <?php
</span><span class="cx" style="display: block; padding: 0 10px"> return ob_get_clean();
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -4435,7 +4435,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'limitExceeded' => is_multisite() && ! is_upload_space_available(),
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $script = 'var _wpPluploadSettings = ' . wp_json_encode( $settings ) . ';';
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $script = 'var _wpPluploadSettings = ' . wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ';';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( $data ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $script = "$data\n$script";
</span></span></pre></div>
<a id="trunksrcwpincludesscriptloaderphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/script-loader.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/script-loader.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/script-loader.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -159,7 +159,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'LLL' => __( 'F j, Y g:i a' ),
</span><span class="cx" style="display: block; padding: 0 10px"> 'LLLL' => null,
</span><span class="cx" style="display: block; padding: 0 10px"> ),
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ ),
+ JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> ),
</span><span class="cx" style="display: block; padding: 0 10px"> 'after'
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -384,7 +385,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> var preferencesStore = wp.preferences.store;
</span><span class="cx" style="display: block; padding: 0 10px"> wp.data.dispatch( preferencesStore ).setPersistenceLayer( persistenceLayer );
</span><span class="cx" style="display: block; padding: 0 10px"> } ) ();',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $preload_data ),
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $preload_data, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
</ins><span class="cx" style="display: block; padding: 0 10px"> $user_id
</span><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -477,7 +478,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'string' => $timezone_string,
</span><span class="cx" style="display: block; padding: 0 10px"> 'abbr' => $timezone_abbr,
</span><span class="cx" style="display: block; padding: 0 10px"> ),
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ ),
+ JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> ),
</span><span class="cx" style="display: block; padding: 0 10px"> 'after'
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -640,7 +642,7 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $script = 'window.wpEditorL10n = {
</span><span class="cx" style="display: block; padding: 0 10px"> tinymce: {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- baseURL: ' . wp_json_encode( includes_url( 'js/tinymce' ) ) . ',
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ baseURL: ' . wp_json_encode( includes_url( 'js/tinymce' ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ',
</ins><span class="cx" style="display: block; padding: 0 10px"> suffix: ' . ( SCRIPT_DEBUG ? '""' : '".min"' ) . ',
</span><span class="cx" style="display: block; padding: 0 10px"> settings: ' . $init_obj . ',
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1155,7 +1157,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'mejs.welsh' => __( 'Welsh' ),
</span><span class="cx" style="display: block; padding: 0 10px"> 'mejs.yiddish' => __( 'Yiddish' ),
</span><span class="cx" style="display: block; padding: 0 10px"> ),
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ ),
+ JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> ),
</span><span class="cx" style="display: block; padding: 0 10px"> 'before'
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1999,7 +2002,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'dateFormat' => $datepicker_date_format,
</span><span class="cx" style="display: block; padding: 0 10px"> 'firstDay' => absint( get_option( 'start_of_week' ) ),
</span><span class="cx" style="display: block; padding: 0 10px"> 'isRTL' => $wp_locale->is_rtl(),
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ ),
+ JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script( 'jquery-ui-datepicker', "jQuery(function(jQuery){jQuery.datepicker.setDefaults({$datepicker_defaults});});" );
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -2809,7 +2813,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $register_script_lines[] = sprintf(
</span><span class="cx" style="display: block; padding: 0 10px"> ' wp.blocks.registerBlockStyle( \'%s\', %s );',
</span><span class="cx" style="display: block; padding: 0 10px"> $block_name,
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $block_style )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $block_style, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcwpincludesspeculativeloadingphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/speculative-loading.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/speculative-loading.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/speculative-loading.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -247,7 +247,8 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> wp_print_inline_script_tag(
</span><span class="cx" style="display: block; padding: 0 10px"> (string) wp_json_encode(
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $speculation_rules
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $speculation_rules,
+ JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
</ins><span class="cx" style="display: block; padding: 0 10px"> ),
</span><span class="cx" style="display: block; padding: 0 10px"> array( 'type' => 'speculationrules' )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span></span></pre></div>
<a id="trunksrcwpincludesthemepreviewsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/theme-previews.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/theme-previews.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/theme-previews.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -49,7 +49,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp-api-fetch',
</span><span class="cx" style="display: block; padding: 0 10px"> sprintf(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp.apiFetch.use( wp.apiFetch.createThemePreviewMiddleware( %s ) );',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( sanitize_text_field( wp_unslash( $_GET['wp_theme_preview'] ) ) )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( sanitize_text_field( wp_unslash( $_GET['wp_theme_preview'] ) ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> ),
</span><span class="cx" style="display: block; padding: 0 10px"> 'after'
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -70,7 +70,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $nonce_handle = 'switch-theme_' . wp_get_theme_preview_path();
</span><span class="cx" style="display: block; padding: 0 10px"> ?>
</span><span class="cx" style="display: block; padding: 0 10px"> <script type="text/javascript">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- window.WP_BLOCK_THEME_ACTIVATE_NONCE = <?php echo wp_json_encode( wp_create_nonce( $nonce_handle ) ); ?>;
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ window.WP_BLOCK_THEME_ACTIVATE_NONCE = <?php echo wp_json_encode( wp_create_nonce( $nonce_handle ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
</ins><span class="cx" style="display: block; padding: 0 10px"> </script>
</span><span class="cx" style="display: block; padding: 0 10px"> <?php
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcwpincludesthemephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/theme.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/theme.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/theme.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -3748,7 +3748,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> ),
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $script = 'var _wpCustomizeLoaderSettings = ' . wp_json_encode( $settings ) . ';';
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $script = 'var _wpCustomizeLoaderSettings = ' . wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ';';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $wp_scripts = wp_scripts();
</span><span class="cx" style="display: block; padding: 0 10px"> $data = $wp_scripts->get_data( 'customize-loader', 'data' );
</span></span></pre></div>
<a id="trunksrcwpincludeswidgetsclasswpwidgetcustomhtmlphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/widgets/class-wp-widget-custom-html.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/widgets/class-wp-widget-custom-html.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/widgets/class-wp-widget-custom-html.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -215,7 +215,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> wp_enqueue_script( 'custom-html-widgets' );
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_add_inline_script( 'custom-html-widgets', sprintf( 'wp.customHtmlWidgets.idBases.push( %s );', wp_json_encode( $this->id_base ) ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_add_inline_script( 'custom-html-widgets', sprintf( 'wp.customHtmlWidgets.idBases.push( %s );', wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( empty( $settings ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $settings = array(
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -222,7 +222,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'disabled' => true,
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_add_inline_script( 'custom-html-widgets', sprintf( 'wp.customHtmlWidgets.init( %s );', wp_json_encode( $settings ) ), 'after' );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_add_inline_script( 'custom-html-widgets', sprintf( 'wp.customHtmlWidgets.init( %s );', wp_json_encode( $settings, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ), 'after' );
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $l10n = array(
</span><span class="cx" style="display: block; padding: 0 10px"> 'errorNotice' => array(
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -233,7 +233,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> // @todo This is lacking, as some languages have a dedicated dual form. For proper handling of plurals in JS, see #20491.
</span><span class="cx" style="display: block; padding: 0 10px"> ),
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_add_inline_script( 'custom-html-widgets', sprintf( 'jQuery.extend( wp.customHtmlWidgets.l10n, %s );', wp_json_encode( $l10n ) ), 'after' );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_add_inline_script( 'custom-html-widgets', sprintf( 'jQuery.extend( wp.customHtmlWidgets.l10n, %s );', wp_json_encode( $l10n, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ), 'after' );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span></span></pre></div>
<a id="trunksrcwpincludeswidgetsclasswpwidgetmediaaudiophp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/widgets/class-wp-widget-media-audio.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/widgets/class-wp-widget-media-audio.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/widgets/class-wp-widget-media-audio.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -160,8 +160,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $handle,
</span><span class="cx" style="display: block; padding: 0 10px"> sprintf(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp.mediaWidgets.modelConstructors[ %s ].prototype.schema = %s;',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $this->id_base ),
- wp_json_encode( $exported_schema )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $exported_schema, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -172,9 +172,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> wp.mediaWidgets.controlConstructors[ %1$s ].prototype.mime_type = %2$s;
</span><span class="cx" style="display: block; padding: 0 10px"> wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n = _.extend( {}, wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n, %3$s );
</span><span class="cx" style="display: block; padding: 0 10px"> ',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $this->id_base ),
- wp_json_encode( $this->widget_options['mime_type'] ),
- wp_json_encode( $this->l10n )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $this->widget_options['mime_type'], JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $this->l10n, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcwpincludeswidgetsclasswpwidgetmediagalleryphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/widgets/class-wp-widget-media-gallery.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/widgets/class-wp-widget-media-gallery.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/widgets/class-wp-widget-media-gallery.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -148,8 +148,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $handle,
</span><span class="cx" style="display: block; padding: 0 10px"> sprintf(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp.mediaWidgets.modelConstructors[ %s ].prototype.schema = %s;',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $this->id_base ),
- wp_json_encode( $exported_schema )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $exported_schema, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -160,9 +160,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> wp.mediaWidgets.controlConstructors[ %1$s ].prototype.mime_type = %2$s;
</span><span class="cx" style="display: block; padding: 0 10px"> _.extend( wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n, %3$s );
</span><span class="cx" style="display: block; padding: 0 10px"> ',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $this->id_base ),
- wp_json_encode( $this->widget_options['mime_type'] ),
- wp_json_encode( $this->l10n )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $this->widget_options['mime_type'], JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $this->l10n, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcwpincludeswidgetsclasswpwidgetmediaimagephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/widgets/class-wp-widget-media-image.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/widgets/class-wp-widget-media-image.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/widgets/class-wp-widget-media-image.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -323,8 +323,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $handle,
</span><span class="cx" style="display: block; padding: 0 10px"> sprintf(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp.mediaWidgets.modelConstructors[ %s ].prototype.schema = %s;',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $this->id_base ),
- wp_json_encode( $exported_schema )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $exported_schema, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -335,9 +335,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> wp.mediaWidgets.controlConstructors[ %1$s ].prototype.mime_type = %2$s;
</span><span class="cx" style="display: block; padding: 0 10px"> wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n = _.extend( {}, wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n, %3$s );
</span><span class="cx" style="display: block; padding: 0 10px"> ',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $this->id_base ),
- wp_json_encode( $this->widget_options['mime_type'] ),
- wp_json_encode( $this->l10n )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $this->widget_options['mime_type'], JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $this->l10n, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcwpincludeswidgetsclasswpwidgetmediavideophp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/widgets/class-wp-widget-media-video.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/widgets/class-wp-widget-media-video.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/widgets/class-wp-widget-media-video.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -199,8 +199,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $handle,
</span><span class="cx" style="display: block; padding: 0 10px"> sprintf(
</span><span class="cx" style="display: block; padding: 0 10px"> 'wp.mediaWidgets.modelConstructors[ %s ].prototype.schema = %s;',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $this->id_base ),
- wp_json_encode( $exported_schema )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $exported_schema, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -211,9 +211,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> wp.mediaWidgets.controlConstructors[ %1$s ].prototype.mime_type = %2$s;
</span><span class="cx" style="display: block; padding: 0 10px"> wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n = _.extend( {}, wp.mediaWidgets.controlConstructors[ %1$s ].prototype.l10n, %3$s );
</span><span class="cx" style="display: block; padding: 0 10px"> ',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_json_encode( $this->id_base ),
- wp_json_encode( $this->widget_options['mime_type'] ),
- wp_json_encode( $this->l10n )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $this->widget_options['mime_type'], JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+ wp_json_encode( $this->l10n, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
</ins><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcwpincludeswidgetsclasswpwidgettextphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/widgets/class-wp-widget-text.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/widgets/class-wp-widget-text.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/src/wp-includes/widgets/class-wp-widget-text.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -435,7 +435,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> wp_enqueue_editor();
</span><span class="cx" style="display: block; padding: 0 10px"> wp_enqueue_media();
</span><span class="cx" style="display: block; padding: 0 10px"> wp_enqueue_script( 'text-widgets' );
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_add_inline_script( 'text-widgets', sprintf( 'wp.textWidgets.idBases.push( %s );', wp_json_encode( $this->id_base ) ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ wp_add_inline_script( 'text-widgets', sprintf( 'wp.textWidgets.idBases.push( %s );', wp_json_encode( $this->id_base, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> wp_add_inline_script( 'text-widgets', 'wp.textWidgets.init();', 'after' );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="trunktestsphpunittestsdependencieswpLocalizeScriptphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/tests/phpunit/tests/dependencies/wpLocalizeScript.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/tests/phpunit/tests/dependencies/wpLocalizeScript.php 2025-08-27 00:01:59 UTC (rev 60680)
+++ trunk/tests/phpunit/tests/dependencies/wpLocalizeScript.php 2025-08-27 10:32:57 UTC (rev 60681)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -3,7 +3,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @group dependencies
</span><span class="cx" style="display: block; padding: 0 10px"> * @group scripts
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-class Tests_Dependencies_LocalizeScript extends WP_UnitTestCase {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+class Tests_Dependencies_wpLocalizeScript extends WP_UnitTestCase {
</ins><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="cx" style="display: block; padding: 0 10px"> * @var WP_Scripts
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -38,4 +38,27 @@
</span><span class="cx" style="display: block; padding: 0 10px"> )
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+
+ /**
+ * Verifies that wp_localize_script() outputs safe JSON whe harmful data is provided.
+ *
+ * @ticket 63851
+ * @covers ::wp_localize_script
+ */
+ public function test_wp_localize_script_outputs_safe_json() {
+ add_theme_support( 'html5', array( 'script' ) );
+
+ $path = '/test.js';
+ $base_url = site_url( $path );
+
+ wp_enqueue_script( 'test-script', $path, array(), null );
+ wp_localize_script( 'test-script', 'testData', array( '<!--' => '<script>' ) );
+
+ $output = get_echo( 'wp_print_scripts' );
+
+ $expected = "<script id=\"test-script-js-extra\">\nvar testData = {\"\\u003C!--\":\"\\u003Cscript\\u003E\"};\n</script>\n";
+ $expected .= "<script src=\"{$base_url}\" id=\"test-script-js\"></script>\n";
+
+ $this->assertEqualHTML( $expected, $output );
+ }
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre>
</div>
</div>
</body>
</html>