<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[60836] branches/5.0: Grouped backports for the 5.0 branch.</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { white-space: pre-line; overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta" style="font-size: 105%">
<dt style="float: left; width: 6em; font-weight: bold">Revision</dt> <dd><a style="font-weight: bold" href="https://core.trac.wordpress.org/changeset/60836">60836</a><script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","description":"Review this Commit","action":{"@type":"ViewAction","url":"https://core.trac.wordpress.org/changeset/60836","name":"Review Commit"}}</script></dd>
<dt style="float: left; width: 6em; font-weight: bold">Author</dt> <dd>desrosj</dd>
<dt style="float: left; width: 6em; font-weight: bold">Date</dt> <dd>2025-09-30 17:05:42 +0000 (Tue, 30 Sep 2025)</dd>
</dl>
<pre style='padding-left: 1em; margin: 2em 0; border-left: 2px solid #ccc; line-height: 1.25; font-size: 105%; font-family: sans-serif'>Grouped backports for the 5.0 branch.
- REST API: Increase the specificity of capability checks for collections when the `edit` context is in use.
- Menus: Prevent HTML in menu item titles from being rendered unexpectedly.
Merges <a href="https://core.trac.wordpress.org/changeset/60814">[60814]</a>, <a href="https://core.trac.wordpress.org/changeset/60815">[60815]</a>, <a href="https://core.trac.wordpress.org/changeset/60816">[60816]</a> to the 5.0 branch.
Props andraganescu, desrosj, ehti, hurayraiit, iandunn, joehoyle, johnbillion, jorbin, mnelson4, noisysocks, peterwilsoncc, phillsav, rmccue, timothyblynjacobs, vortfu, westonruter , whyisjake, zieladam.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#branches50srcwpadminjscustomizenavmenusjs">branches/5.0/src/wp-admin/js/customize-nav-menus.js</a></li>
<li><a href="#branches50srcwpadminjsnavmenujs">branches/5.0/src/wp-admin/js/nav-menu.js</a></li>
<li><a href="#branches50srcwpincludesclasswpcustomizenavmenusphp">branches/5.0/src/wp-includes/class-wp-customize-nav-menus.php</a></li>
<li><a href="#branches50srcwpincludescustomizeclasswpcustomizenavmenuitemsettingphp">branches/5.0/src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php</a></li>
<li><a href="#branches50srcwpincludesrestapiendpointsclasswprestpostscontrollerphp">branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php</a></li>
<li><a href="#branches50srcwpincludesrestapiendpointsclasswpresttermscontrollerphp">branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php</a></li>
<li><a href="#branches50srcwpincludesrestapiendpointsclasswprestuserscontrollerphp">branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php</a></li>
<li><a href="#branches50testsphpunittestscustomizenavmenuitemsettingphp">branches/5.0/tests/phpunit/tests/customize/nav-menu-item-setting.php</a></li>
<li><a href="#branches50testsphpunittestscustomizenavmenusphp">branches/5.0/tests/phpunit/tests/customize/nav-menus.php</a></li>
<li><a href="#branches50testsphpunittestsrestapirestuserscontrollerphp">branches/5.0/tests/phpunit/tests/rest-api/rest-users-controller.php</a></li>
</ul>
<h3>Property Changed</h3>
<ul>
<li><a href="#branches50">branches/5.0/</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<span class="cx" style="display: block; padding: 0 10px">Index: branches/5.0
</span><span class="cx" style="display: block; padding: 0 10px">===================================================================
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">--- branches/5.0 2025-09-30 17:05:30 UTC (rev 60835)
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+++ branches/5.0 2025-09-30 17:05:42 UTC (rev 60836)
</ins><a id="branches50"></a>
<div class="propset"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Property changes: branches/5.0</h4>
<pre class="diff"><span>
</span></pre></div>
<a id="svnmergeinfo"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: svn:mergeinfo</h4></div>
<span class="cx" style="display: block; padding: 0 10px"> /branches/4.8:42204
</span><span class="cx" style="display: block; padding: 0 10px"> /branches/4.9:43557,43622,44991
</span><span class="cx" style="display: block; padding: 0 10px"> /branches/5.5:49373-49379,49381
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-/trunk:42132,42134,42136,42138,42140,42144,42146,42148,42150,42152-42153,42155,42157,42159,42161,42163,42169,42171,42173,42175,42177,42181,42183,42185,42187,42189,42191,42193,42199,42203,42210,42214,42220,42222,42226,42242,42244,42247,42250-42251,42256-42261,42350,42354,42358,42362,42364-42368,42374,42388,42390,42401,42405,42417,42421,42423-42425,42430,42432-42433,42437,42441,42443-42444,42446-42447,42449,42451,42453,42457,42459,42462,42491,42521,42529,42531,42533,42536,42538,42541,42543,42545,42549,42566,42568,42570,42572,42574,42576,42579,42581-42582,42584-42585,42587-42588,42590,42592,42594-42595,42598-42599,42602,42604,42606,42611-42613,42615,42617,42624-42625,42639,42642,42648,42652-42653,42665,42676,42687,42695,42697,42701-42702,42711,42713,42719,42722,42726,42728,42733,42739-42740,42744,42758,42772,42791-42792,42801,42807,42812,42814-42815,42817-42819,42823,42830,42837,42839,42841
,42844,42851-42852,42860,42862,42864,42878-42879,42881,42888-42889,42892-42894,42930,42964-42965,42967,42971-42972,42977-42978,42980-42982,42985-42987,42989,42992,42994-42995,42998-42999,43001-43004,43007-43008,43011-43012,43014-43015,43025,43027,43030,43032,43034,43036,43039,43042,43044-43049,43051-43063,43065,43081,43085,43087-43089,43091,43104,43116,43118,43120-43121,43123,43125-43126,43131-43132,43135,43137,43139,43145-43148,43150,43154-43155,43158,43160,43162,43166,43168,43170,43172,43175,43180-43181,43183-43185,43189,43191,43193,43195,43197,43199,43201,43203,43206,43208,43210-43212,43216,43218,43220,43222-43223,43226,43228,43230,43232,43234,43236,43238,43242-43243,43245-43246,43248-43251,43256,43259-43260,43263,43265,43267,43269,43274-43275,43278-43279,43282,43284,43286,43290,43293,43299,43303-43304,43313,43315,43317,43331,43337,43343,43350,43353,43356,43361-43363,43365,43367,43370-43371,43373-43376,43379,43388,43390,43435,43437,43439-43440,43446-43447,43451,43454,43457,43460,
43462-43467,43469,43471,43475,43477-43478,43480,43486,43491,43493,43495,43499,43504,43506,43508,43511-43513,43518,43525,43527,43529,43531,43541,43550,43559,43561,43565,43567,43574,43578,43580,43584-43586,43589,43593,43597,43599,43601,43604-43605,43609,43636,43638,43645,43647,43653,43658-43659,43664,43673,44021,44048,44233,44322,44338,44368-44371,44376-44382,44389,44391,44398-44399,44402-44403,44406,44408,44418,44432,44435,44437-44439,44441-44442,44728,44833,44842,44993,45067,45321,45745,45762,45765,45783-45784,45800,45819,45826,45885,45936,45971,45990,45997,46094,46320,46403-46404,46408-46409,46474-46478,46483,46485,46682,46893-46896,46996,46999,47225,47341,47404,47633-47638,47867-47869,47872-47873,47912,47948-47951,47984,48121,48241,48338,48341,48705,48707,49162,49168-49169,49175,49204,49227-49228,49244,49264,49335,49358,49360,49362,49369,49371,49380,49382-49388,49548,49636,49781-49784,49786,49836,49876,49933,49937-49940,49983,49989,50017,50126,50176,50185,50192,50267-50268,50285,5
0298,50379,50387,50413,50416,50432,50435-50436,50444,50446,50473-50474,50476,50479,50485-50487,50545,50579,50590,50598,50704,50717,50796,50799,50930,50940-50941,50984-50985,51179,51341,51355,51426,51498,51511,51535,51673,51921,51924-51925,51937,52002,52040,52130,52179,52183,52233,52412,52454-52457,52844,53112,53552,53581-53582,53592,53736-53737,53895,53940,53947,53958-53960,54039,54096,54108,54293,54313,54322,54342-54343,54373,54511,54521-54530,54541,54650-54651,54674,54750,54852,54968,55152,55350,55487,56015-56016,56464,57124-57125,57249,57388-57389,57918,57931,58157,59740,59969,60320
</del><span class="cx" style="display: block; padding: 0 10px">\ No newline at end of property
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+/trunk:42132,42134,42136,42138,42140,42144,42146,42148,42150,42152-42153,42155,42157,42159,42161,42163,42169,42171,42173,42175,42177,42181,42183,42185,42187,42189,42191,42193,42199,42203,42210,42214,42220,42222,42226,42242,42244,42247,42250-42251,42256-42261,42350,42354,42358,42362,42364-42368,42374,42388,42390,42401,42405,42417,42421,42423-42425,42430,42432-42433,42437,42441,42443-42444,42446-42447,42449,42451,42453,42457,42459,42462,42491,42521,42529,42531,42533,42536,42538,42541,42543,42545,42549,42566,42568,42570,42572,42574,42576,42579,42581-42582,42584-42585,42587-42588,42590,42592,42594-42595,42598-42599,42602,42604,42606,42611-42613,42615,42617,42624-42625,42639,42642,42648,42652-42653,42665,42676,42687,42695,42697,42701-42702,42711,42713,42719,42722,42726,42728,42733,42739-42740,42744,42758,42772,42791-42792,42801,42807,42812,42814-42815,42817-42819,42823,42830,42837,42839,42841
,42844,42851-42852,42860,42862,42864,42878-42879,42881,42888-42889,42892-42894,42930,42964-42965,42967,42971-42972,42977-42978,42980-42982,42985-42987,42989,42992,42994-42995,42998-42999,43001-43004,43007-43008,43011-43012,43014-43015,43025,43027,43030,43032,43034,43036,43039,43042,43044-43049,43051-43063,43065,43081,43085,43087-43089,43091,43104,43116,43118,43120-43121,43123,43125-43126,43131-43132,43135,43137,43139,43145-43148,43150,43154-43155,43158,43160,43162,43166,43168,43170,43172,43175,43180-43181,43183-43185,43189,43191,43193,43195,43197,43199,43201,43203,43206,43208,43210-43212,43216,43218,43220,43222-43223,43226,43228,43230,43232,43234,43236,43238,43242-43243,43245-43246,43248-43251,43256,43259-43260,43263,43265,43267,43269,43274-43275,43278-43279,43282,43284,43286,43290,43293,43299,43303-43304,43313,43315,43317,43331,43337,43343,43350,43353,43356,43361-43363,43365,43367,43370-43371,43373-43376,43379,43388,43390,43435,43437,43439-43440,43446-43447,43451,43454,43457,43460,
43462-43467,43469,43471,43475,43477-43478,43480,43486,43491,43493,43495,43499,43504,43506,43508,43511-43513,43518,43525,43527,43529,43531,43541,43550,43559,43561,43565,43567,43574,43578,43580,43584-43586,43589,43593,43597,43599,43601,43604-43605,43609,43636,43638,43645,43647,43653,43658-43659,43664,43673,44021,44048,44233,44322,44338,44368-44371,44376-44382,44389,44391,44398-44399,44402-44403,44406,44408,44418,44432,44435,44437-44439,44441-44442,44728,44833,44842,44993,45067,45321,45745,45762,45765,45783-45784,45800,45819,45826,45885,45936,45971,45990,45997,46094,46320,46403-46404,46408-46409,46474-46478,46483,46485,46682,46893-46896,46996,46999,47225,47341,47404,47633-47638,47867-47869,47872-47873,47912,47948-47951,47984,48121,48241,48338,48341,48705,48707,49162,49168-49169,49175,49204,49227-49228,49244,49264,49335,49358,49360,49362,49369,49371,49380,49382-49388,49548,49636,49781-49784,49786,49836,49876,49933,49937-49940,49983,49989,50017,50126,50176,50185,50192,50267-50268,50285,5
0298,50379,50387,50413,50416,50432,50435-50436,50444,50446,50473-50474,50476,50479,50485-50487,50545,50579,50590,50598,50704,50717,50796,50799,50930,50940-50941,50984-50985,51179,51341,51355,51426,51498,51511,51535,51673,51921,51924-51925,51937,52002,52040,52130,52179,52183,52233,52412,52454-52457,52844,53112,53552,53581-53582,53592,53736-53737,53895,53940,53947,53958-53960,54039,54096,54108,54293,54313,54322,54342-54343,54373,54511,54521-54530,54541,54650-54651,54674,54750,54852,54968,55152,55350,55487,56015-56016,56464,57124-57125,57249,57388-57389,57918,57931,58157,59740,59969,60320,60814-60816
</ins><span class="cx" style="display: block; padding: 0 10px">\ No newline at end of property
</span><a id="branches50srcwpadminjscustomizenavmenusjs"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: branches/5.0/src/wp-admin/js/customize-nav-menus.js</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- branches/5.0/src/wp-admin/js/customize-nav-menus.js 2025-09-30 17:05:30 UTC (rev 60835)
+++ branches/5.0/src/wp-admin/js/customize-nav-menus.js 2025-09-30 17:05:42 UTC (rev 60836)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -517,8 +517,14 @@
</span><span class="cx" style="display: block; padding: 0 10px"> return;
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- this.currentMenuControl.addItemToMenu( menu_item.attributes );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ // Leave the title as empty to reuse the original title as a placeholder if set.
+ var nav_menu_item = Object.assign( {}, menu_item.attributes );
+ if ( nav_menu_item.title === nav_menu_item.original_title ) {
+ nav_menu_item.title = '';
+ }
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ this.currentMenuControl.addItemToMenu( nav_menu_item );
+
</ins><span class="cx" style="display: block; padding: 0 10px"> $( menuitemTpl ).find( '.menu-item-handle' ).addClass( 'item-added' );
</span><span class="cx" style="display: block; padding: 0 10px"> },
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -2971,7 +2977,6 @@
</span><span class="cx" style="display: block; padding: 0 10px"> item,
</span><span class="cx" style="display: block; padding: 0 10px"> {
</span><span class="cx" style="display: block; padding: 0 10px"> nav_menu_term_id: menuControl.params.menu_id,
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- original_title: item.title,
</del><span class="cx" style="display: block; padding: 0 10px"> position: position
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span></span></pre></div>
<a id="branches50srcwpadminjsnavmenujs"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: branches/5.0/src/wp-admin/js/nav-menu.js</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- branches/5.0/src/wp-admin/js/nav-menu.js 2025-09-30 17:05:30 UTC (rev 60835)
+++ branches/5.0/src/wp-admin/js/nav-menu.js 2025-09-30 17:05:42 UTC (rev 60836)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1168,20 +1168,27 @@
</span><span class="cx" style="display: block; padding: 0 10px"> },
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> eventOnClickMenuSave : function() {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- var locs = '',
- menuName = $('#menu-name'),
- menuNameVal = menuName.val();
- // Cancel and warn if invalid menu name
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ var menuName = $('#menu-name'),
+ menuNameVal = menuName.val();
+
+ // Cancel and warn if invalid menu name.
</ins><span class="cx" style="display: block; padding: 0 10px"> if( !menuNameVal || menuNameVal == menuName.attr('title') || !menuNameVal.replace(/\s+/, '') ) {
</span><span class="cx" style="display: block; padding: 0 10px"> menuName.parent().addClass('form-invalid');
</span><span class="cx" style="display: block; padding: 0 10px"> return false;
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- // Copy menu theme locations
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ // Copy menu theme locations.
+ // Note: This appears to be dead code since #nav-menu-theme-locations no longer exists, perhaps removed in r32842.
+ var $updateNavMenu = $('#update-nav-menu');
</ins><span class="cx" style="display: block; padding: 0 10px"> $('#nav-menu-theme-locations select').each(function() {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- locs += '<input type="hidden" name="' + this.name + '" value="' + $(this).val() + '" />';
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $updateNavMenu.append(
+ $( '<input>', {
+ type: 'hidden',
+ name: this.name,
+ value: $( this ).val()
+ } )
+ );
</ins><span class="cx" style="display: block; padding: 0 10px"> });
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $('#update-nav-menu').append( locs );
- // Update menu item position data
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ // Update menu item position data.
</ins><span class="cx" style="display: block; padding: 0 10px"> api.menuList.find('.menu-item-data-position').val( function(index) { return index + 1; } );
</span><span class="cx" style="display: block; padding: 0 10px"> window.onbeforeunload = null;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1221,7 +1228,10 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $item;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if( ! $items.length ) {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $('.categorychecklist', panel).html( '<li><p>' + navMenuL10n.noResultsFound + '</p></li>' );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ var li = $( '<li>' );
+ var p = $( '<p>', { text: navMenuL10n.noResultsFound } );
+ li.append( p );
+ $('.categorychecklist', panel).empty().append( li );
</ins><span class="cx" style="display: block; padding: 0 10px"> $( '.spinner', panel ).removeClass( 'is-active' );
</span><span class="cx" style="display: block; padding: 0 10px"> wrapper.addClass( 'has-no-menu-item' );
</span><span class="cx" style="display: block; padding: 0 10px"> return;
</span></span></pre></div>
<a id="branches50srcwpincludesclasswpcustomizenavmenusphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: branches/5.0/src/wp-includes/class-wp-customize-nav-menus.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- branches/5.0/src/wp-includes/class-wp-customize-nav-menus.php 2025-09-30 17:05:30 UTC (rev 60835)
+++ branches/5.0/src/wp-includes/class-wp-customize-nav-menus.php 2025-09-30 17:05:42 UTC (rev 60836)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -158,13 +158,15 @@
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> } elseif ( 'post' !== $object && 0 === $page && $post_type->has_archive ) {
</span><span class="cx" style="display: block; padding: 0 10px"> // Add a post type archive link.
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $title = $post_type->labels->archives;
</ins><span class="cx" style="display: block; padding: 0 10px"> $items[] = array(
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- 'id' => $object . '-archive',
- 'title' => $post_type->labels->archives,
- 'type' => 'post_type_archive',
- 'type_label' => __( 'Post Type Archive' ),
- 'object' => $object,
- 'url' => get_post_type_archive_link( $object ),
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'id' => $object_name . '-archive',
+ 'title' => $title,
+ 'original_title' => $title,
+ 'type' => 'post_type_archive',
+ 'type_label' => __( 'Post Type Archive' ),
+ 'object' => $object_name,
+ 'url' => get_post_type_archive_link( $object_name ),
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -193,14 +195,17 @@
</span><span class="cx" style="display: block; padding: 0 10px"> /* translators: %d: ID of a post */
</span><span class="cx" style="display: block; padding: 0 10px"> $post_title = sprintf( __( '#%d (no title)' ), $post->ID );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+
+ $title = html_entity_decode( $post_title, ENT_QUOTES, get_bloginfo( 'charset' ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> $items[] = array(
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- 'id' => "post-{$post->ID}",
- 'title' => html_entity_decode( $post_title, ENT_QUOTES, get_bloginfo( 'charset' ) ),
- 'type' => 'post_type',
- 'type_label' => get_post_type_object( $post->post_type )->labels->singular_name,
- 'object' => $post->post_type,
- 'object_id' => intval( $post->ID ),
- 'url' => get_permalink( intval( $post->ID ) ),
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'id' => "post-{$post->ID}",
+ 'title' => $title,
+ 'original_title' => $title,
+ 'type' => 'post_type',
+ 'type_label' => get_post_type_object( $post->post_type )->labels->singular_name,
+ 'object' => $post->post_type,
+ 'object_id' => (int) $post->ID,
+ 'url' => get_permalink( (int) $post->ID ),
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> } elseif ( 'taxonomy' === $type ) {
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -221,14 +226,16 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> foreach ( $terms as $term ) {
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $title = html_entity_decode( $term->name, ENT_QUOTES, get_bloginfo( 'charset' ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> $items[] = array(
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- 'id' => "term-{$term->term_id}",
- 'title' => html_entity_decode( $term->name, ENT_QUOTES, get_bloginfo( 'charset' ) ),
- 'type' => 'taxonomy',
- 'type_label' => get_taxonomy( $term->taxonomy )->labels->singular_name,
- 'object' => $term->taxonomy,
- 'object_id' => intval( $term->term_id ),
- 'url' => get_term_link( intval( $term->term_id ), $term->taxonomy ),
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'id' => "term-{$term->term_id}",
+ 'title' => $title,
+ 'original_title' => $title,
+ 'type' => 'taxonomy',
+ 'type_label' => get_taxonomy( $term->taxonomy )->labels->singular_name,
+ 'object' => $term->taxonomy,
+ 'object_id' => (int) $term->term_id,
+ 'url' => get_term_link( (int) $term->term_id, $term->taxonomy ),
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="branches50srcwpincludescustomizeclasswpcustomizenavmenuitemsettingphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: branches/5.0/src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- branches/5.0/src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php 2025-09-30 17:05:30 UTC (rev 60835)
+++ branches/5.0/src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php 2025-09-30 17:05:42 UTC (rev 60836)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -56,7 +56,6 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'classes' => '',
</span><span class="cx" style="display: block; padding: 0 10px"> 'xfn' => '',
</span><span class="cx" style="display: block; padding: 0 10px"> 'status' => 'publish',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- 'original_title' => '',
</del><span class="cx" style="display: block; padding: 0 10px"> 'nav_menu_term_id' => 0, // This will be supplied as the $menu_id arg for wp_update_nav_menu_item().
</span><span class="cx" style="display: block; padding: 0 10px"> '_invalid' => false,
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -211,7 +210,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @return array|false Instance data array, or false if the item is marked for deletion.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><span class="cx" style="display: block; padding: 0 10px"> public function value() {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( $this->is_previewed && $this->_previewed_blog_id === get_current_blog_id() ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $type_label = null;
+ if ( $this->is_previewed && get_current_blog_id() === $this->_previewed_blog_id ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> $undefined = new stdClass(); // Symbol.
</span><span class="cx" style="display: block; padding: 0 10px"> $post_value = $this->post_value( $undefined );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -220,9 +220,6 @@
</span><span class="cx" style="display: block; padding: 0 10px"> } else {
</span><span class="cx" style="display: block; padding: 0 10px"> $value = $post_value;
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( ! empty( $value ) && empty( $value['original_title'] ) ) {
- $value['original_title'] = $this->get_original_title( (object) $value );
- }
</del><span class="cx" style="display: block; padding: 0 10px"> } elseif ( isset( $this->value ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $value = $this->value;
</span><span class="cx" style="display: block; padding: 0 10px"> } else {
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -234,6 +231,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> if ( $post && self::POST_TYPE === $post->post_type ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $is_title_empty = empty( $post->post_title );
</span><span class="cx" style="display: block; padding: 0 10px"> $value = (array) wp_setup_nav_menu_item( $post );
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( isset( $value['type_label'] ) ) {
+ $type_label = $value['type_label'];
+ }
</ins><span class="cx" style="display: block; padding: 0 10px"> if ( $is_title_empty ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $value['title'] = '';
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -250,8 +250,11 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $value = $this->value;
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( ! empty( $value ) && empty( $value['type_label'] ) ) {
- $value['type_label'] = $this->get_type_label( (object) $value );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ // These properties are read-only and are part of the setting for use in the Customizer UI.
+ if ( is_array( $value ) ) {
+ $value_obj = (object) $value;
+ $value['type_label'] = isset( $type_label ) ? $type_label : $this->get_type_label( $value_obj );
+ $value['original_title'] = $this->get_original_title( $value_obj );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> return $value;
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -258,12 +261,28 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ * Prepares the value for editing on the client.
+ *
+ * @since 6.8.3
+ *
+ * @return array|false Value prepared for the client.
+ */
+ public function js_value() {
+ $value = parent::js_value();
+ if ( is_array( $value ) && isset( $value['original_title'] ) ) {
+ // Decode entities for the sake of displaying the original title as a placeholder.
+ $value['original_title'] = html_entity_decode( $value['original_title'], ENT_QUOTES, get_bloginfo( 'charset' ) );
+ }
+ return $value;
+ }
+
+ /**
</ins><span class="cx" style="display: block; padding: 0 10px"> * Get original title.
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><span class="cx" style="display: block; padding: 0 10px"> * @since 4.7.0
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><span class="cx" style="display: block; padding: 0 10px"> * @param object $item Nav menu item.
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- * @return string The original title.
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ * @return string The original title, without entity decoding.
</ins><span class="cx" style="display: block; padding: 0 10px"> */
</span><span class="cx" style="display: block; padding: 0 10px"> protected function get_original_title( $item ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $original_title = '';
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -289,7 +308,6 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $original_title = $original_object->labels->archives;
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $original_title = html_entity_decode( $original_title, ENT_QUOTES, get_bloginfo( 'charset' ) );
</del><span class="cx" style="display: block; padding: 0 10px"> return $original_title;
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -347,10 +365,6 @@
</span><span class="cx" style="display: block; padding: 0 10px"> unset( $this->value['post_status'] );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( ! isset( $this->value['original_title'] ) ) {
- $this->value['original_title'] = $this->get_original_title( (object) $this->value );
- }
-
</del><span class="cx" style="display: block; padding: 0 10px"> if ( ! isset( $this->value['nav_menu_term_id'] ) && $this->post_id > 0 ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $menus = wp_get_post_terms( $this->post_id, WP_Customize_Nav_Menu_Setting::TAXONOMY, array(
</span><span class="cx" style="display: block; padding: 0 10px"> 'fields' => 'ids',
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -586,11 +600,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $item->menu_order = $item->position;
</span><span class="cx" style="display: block; padding: 0 10px"> unset( $item->position );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( empty( $item->original_title ) ) {
- $item->original_title = $this->get_original_title( $item );
- }
</del><span class="cx" style="display: block; padding: 0 10px"> if ( empty( $item->title ) && ! empty( $item->original_title ) ) {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $item->title = $item->original_title;
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $item->title = $item->original_title; // This is NOT entity-decoded. It comes from self::get_original_title().
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> if ( $item->title ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $item->post_title = $item->title;
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -640,7 +651,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><span class="cx" style="display: block; padding: 0 10px"> * @since 4.3.0
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- * @param array $menu_item_value The value to sanitize.
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ * @param array|false $value The menu item value to sanitize.
</ins><span class="cx" style="display: block; padding: 0 10px"> * @return array|false|null|WP_Error Null or WP_Error if an input isn't valid. False if it is marked for deletion.
</span><span class="cx" style="display: block; padding: 0 10px"> * Otherwise the sanitized value.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -694,8 +705,6 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $menu_item_value[ $key ] = implode( ' ', array_map( 'sanitize_html_class', $value ) );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $menu_item_value['original_title'] = sanitize_text_field( $menu_item_value['original_title'] );
-
</del><span class="cx" style="display: block; padding: 0 10px"> // Apply the same filters as when calling wp_insert_post().
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /** This filter is documented in wp-includes/post.php */
</span></span></pre></div>
<a id="branches50srcwpincludesrestapiendpointsclasswprestpostscontrollerphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php 2025-09-30 17:05:30 UTC (rev 60835)
+++ branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php 2025-09-30 17:05:42 UTC (rev 60836)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -338,7 +338,13 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $posts = array();
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> foreach ( $query_result as $post ) {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( ! $this->check_read_permission( $post ) ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( 'edit' === $request['context'] ) {
+ $permission = $this->check_update_permission( $post );
+ } else {
+ $permission = $this->check_read_permission( $post );
+ }
+
+ if ( ! $permission ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> continue;
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="branches50srcwpincludesrestapiendpointsclasswpresttermscontrollerphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php 2025-09-30 17:05:30 UTC (rev 60835)
+++ branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php 2025-09-30 17:05:42 UTC (rev 60836)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -318,6 +318,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $response = array();
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> foreach ( $query_result as $term ) {
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( 'edit' === $request['context'] && ! current_user_can( 'edit_term', $term->term_id ) ) {
+ continue;
+ }
</ins><span class="cx" style="display: block; padding: 0 10px"> $data = $this->prepare_item_for_response( $term, $request );
</span><span class="cx" style="display: block; padding: 0 10px"> $response[] = $this->prepare_response_for_collection( $data );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="branches50srcwpincludesrestapiendpointsclasswprestuserscontrollerphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php 2025-09-30 17:05:30 UTC (rev 60835)
+++ branches/5.0/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php 2025-09-30 17:05:42 UTC (rev 60836)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -179,7 +179,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( 'edit' === $request['context'] && ! current_user_can( 'list_users' ) ) {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to list users.' ), array( 'status' => rest_authorization_required_code() ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit users.' ), array( 'status' => rest_authorization_required_code() ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( in_array( $request['orderby'], array( 'email', 'registered_date' ), true ) && ! current_user_can( 'list_users' ) ) {
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -293,6 +293,10 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $users = array();
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> foreach ( $query->results as $user ) {
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( 'edit' === $request['context'] && ! current_user_can( 'edit_user', $user->ID ) ) {
+ continue;
+ }
+
</ins><span class="cx" style="display: block; padding: 0 10px"> $data = $this->prepare_item_for_response( $user, $request );
</span><span class="cx" style="display: block; padding: 0 10px"> $users[] = $this->prepare_response_for_collection( $data );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -387,10 +391,12 @@
</span><span class="cx" style="display: block; padding: 0 10px"> return true;
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( 'edit' === $request['context'] && ! current_user_can( 'list_users' ) ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( 'edit' === $request['context'] && ! current_user_can( 'edit_user', $user->ID ) ) {
+ return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit this user.' ), array( 'status' => rest_authorization_required_code() ) );
+ }
+
+ if ( ! current_user_can( 'edit_user', $user->ID ) && ! current_user_can( 'list_users' ) && ! count_user_posts( $user->ID, $types ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you are not allowed to list users.' ), array( 'status' => rest_authorization_required_code() ) );
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- } elseif ( ! count_user_posts( $user->ID, $types ) && ! current_user_can( 'edit_user', $user->ID ) && ! current_user_can( 'list_users' ) ) {
- return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you are not allowed to list users.' ), array( 'status' => rest_authorization_required_code() ) );
</del><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> return true;
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -904,7 +910,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $data['slug'] = $user->user_nicename;
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( in_array( 'roles', $fields, true ) ) {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( in_array( 'roles', $fields, true ) && ( current_user_can( 'list_users' ) || current_user_can( 'edit_user', $user->ID ) ) ) {
</ins><span class="cx" style="display: block; padding: 0 10px"> // Defensively call array_values() to ensure an array is returned.
</span><span class="cx" style="display: block; padding: 0 10px"> $data['roles'] = array_values( $user->roles );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="branches50testsphpunittestscustomizenavmenuitemsettingphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: branches/5.0/tests/phpunit/tests/customize/nav-menu-item-setting.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- branches/5.0/tests/phpunit/tests/customize/nav-menu-item-setting.php 2025-09-30 17:05:30 UTC (rev 60835)
+++ branches/5.0/tests/phpunit/tests/customize/nav-menu-item-setting.php 2025-09-30 17:05:42 UTC (rev 60836)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -89,7 +89,6 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'classes' => '',
</span><span class="cx" style="display: block; padding: 0 10px"> 'xfn' => '',
</span><span class="cx" style="display: block; padding: 0 10px"> 'status' => 'publish',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- 'original_title' => '',
</del><span class="cx" style="display: block; padding: 0 10px"> 'nav_menu_term_id' => 0,
</span><span class="cx" style="display: block; padding: 0 10px"> '_invalid' => false,
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -543,7 +542,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'classes' => 'hello inject',
</span><span class="cx" style="display: block; padding: 0 10px"> 'xfn' => 'hello inject',
</span><span class="cx" style="display: block; padding: 0 10px"> 'status' => 'draft',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- 'original_title' => 'Hi',
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'original_title' => 'Hi<script>unfilteredHtml()</script>',
</ins><span class="cx" style="display: block; padding: 0 10px"> 'nav_menu_term_id' => 0,
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -841,7 +840,6 @@
</span><span class="cx" style="display: block; padding: 0 10px"> 'classes' => '',
</span><span class="cx" style="display: block; padding: 0 10px"> 'xfn' => '',
</span><span class="cx" style="display: block; padding: 0 10px"> 'status' => 'publish',
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- 'original_title' => '',
</del><span class="cx" style="display: block; padding: 0 10px"> 'nav_menu_term_id' => 0,
</span><span class="cx" style="display: block; padding: 0 10px"> '_invalid' => false,
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span></span></pre></div>
<a id="branches50testsphpunittestscustomizenavmenusphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: branches/5.0/tests/phpunit/tests/customize/nav-menus.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- branches/5.0/tests/phpunit/tests/customize/nav-menus.php 2025-09-30 17:05:30 UTC (rev 60835)
+++ branches/5.0/tests/phpunit/tests/customize/nav-menus.php 2025-09-30 17:05:42 UTC (rev 60836)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -170,6 +170,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $expected = array(
</span><span class="cx" style="display: block; padding: 0 10px"> 'id' => "post-{$post_id}",
</span><span class="cx" style="display: block; padding: 0 10px"> 'title' => 'Post Title',
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'original_title' => 'Post Title',
</ins><span class="cx" style="display: block; padding: 0 10px"> 'type' => 'post_type',
</span><span class="cx" style="display: block; padding: 0 10px"> 'type_label' => 'Post',
</span><span class="cx" style="display: block; padding: 0 10px"> 'object' => 'post',
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -197,6 +198,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $expected = array(
</span><span class="cx" style="display: block; padding: 0 10px"> 'id' => "post-{$page_id}",
</span><span class="cx" style="display: block; padding: 0 10px"> 'title' => 'Page Title',
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'original_title' => 'Page Title',
</ins><span class="cx" style="display: block; padding: 0 10px"> 'type' => 'post_type',
</span><span class="cx" style="display: block; padding: 0 10px"> 'type_label' => 'Page',
</span><span class="cx" style="display: block; padding: 0 10px"> 'object' => 'page',
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -223,6 +225,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $expected = array(
</span><span class="cx" style="display: block; padding: 0 10px"> 'id' => "post-{$post_id}",
</span><span class="cx" style="display: block; padding: 0 10px"> 'title' => 'Post Title',
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'original_title' => 'Post Title',
</ins><span class="cx" style="display: block; padding: 0 10px"> 'type' => 'post_type',
</span><span class="cx" style="display: block; padding: 0 10px"> 'type_label' => 'Post',
</span><span class="cx" style="display: block; padding: 0 10px"> 'object' => 'post',
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -249,6 +252,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $expected = array(
</span><span class="cx" style="display: block; padding: 0 10px"> 'id' => "term-{$term_id}",
</span><span class="cx" style="display: block; padding: 0 10px"> 'title' => 'Term Title',
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'original_title' => 'Term Title',
</ins><span class="cx" style="display: block; padding: 0 10px"> 'type' => 'taxonomy',
</span><span class="cx" style="display: block; padding: 0 10px"> 'type_label' => 'Category',
</span><span class="cx" style="display: block; padding: 0 10px"> 'object' => 'category',
</span></span></pre></div>
<a id="branches50testsphpunittestsrestapirestuserscontrollerphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: branches/5.0/tests/phpunit/tests/rest-api/rest-users-controller.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- branches/5.0/tests/phpunit/tests/rest-api/rest-users-controller.php 2025-09-30 17:05:30 UTC (rev 60835)
+++ branches/5.0/tests/phpunit/tests/rest-api/rest-users-controller.php 2025-09-30 17:05:42 UTC (rev 60836)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -933,7 +933,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/users/%d', $this->author_id ) );
</span><span class="cx" style="display: block; padding: 0 10px"> $request->set_param( 'context', 'edit' );
</span><span class="cx" style="display: block; padding: 0 10px"> $response = $this->server->dispatch( $request );
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $this->assertErrorResponse( 'rest_user_cannot_view', $response, 401 );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $this->assertErrorResponse( 'rest_forbidden_context', $response, 401 );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> public function test_get_current_user() {
</span></span></pre>
</div>
</div>
</body>
</html>