Footnotes: autosave is not slashing JSON (#53664)

* Footnotes: autosave saves decoded JSON * wp_slash * Curly quote * Slash on save and restore
WordPress · Aug 16, 2023 · 1180c17 · 1180c17
1 parent 574cc41
commit 1180c17
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 10 deletions.
diff --git a/packages/block-library/src/footnotes/index.php b/packages/block-library/src/footnotes/index.php
@@ -98,7 +98,7 @@ function wp_save_footnotes_meta( $revision_id ) {
 
 		if ( $footnotes ) {
 			// Can't use update_post_meta() because it doesn't allow revisions.
-			update_metadata( 'post', $revision_id, 'footnotes', $footnotes );
+			update_metadata( 'post', $revision_id, 'footnotes', wp_slash( $footnotes ) );
 		}
 	}
 }
@@ -154,7 +154,7 @@ function wp_add_footnotes_revisions_to_post_meta( $post ) {
 
 			if ( $footnotes ) {
 				// Can't use update_post_meta() because it doesn't allow revisions.
-				update_metadata( 'post', $wp_temporary_footnote_revision_id, 'footnotes', $footnotes );
+				update_metadata( 'post', $wp_temporary_footnote_revision_id, 'footnotes', wp_slash( $footnotes ) );
 			}
 		}
 	}
@@ -175,7 +175,7 @@ function wp_restore_footnotes_from_revision( $post_id, $revision_id ) {
 	$footnotes = get_post_meta( $revision_id, 'footnotes', true );
 
 	if ( $footnotes ) {
-		update_post_meta( $post_id, 'footnotes', $footnotes );
+		update_post_meta( $post_id, 'footnotes', wp_slash( $footnotes ) );
 	} else {
 		delete_post_meta( $post_id, 'footnotes' );
 	}
@@ -242,7 +242,7 @@ function _wp_rest_api_autosave_meta( $autosave ) {
 		return;
 	}
 
-	update_post_meta( $id, 'footnotes', $body['meta']['footnotes'] );
+	update_post_meta( $id, 'footnotes', wp_slash( $body['meta']['footnotes'] ) );
 }
 // See https://github.com/WordPress/wordpress-develop/blob/2103cb9966e57d452c94218bbc3171579b536a40/src/wp-includes/rest-api/endpoints/class-wp-rest-autosaves-controller.php#L391C1-L391C1.
 add_action( 'wp_creating_autosave', '_wp_rest_api_autosave_meta' );

diff --git a/test/e2e/specs/editor/various/footnotes.spec.js b/test/e2e/specs/editor/various/footnotes.spec.js
@@ -291,7 +291,8 @@ test.describe( 'Footnotes', () => {
 		await editor.clickBlockToolbarButton( 'More' );
 		await page.locator( 'button:text("Footnote")' ).click();
 
-		await page.keyboard.type( 'first footnote' );
+		// Check if content is correctly slashed on save and restore.
+		await page.keyboard.type( 'first footnote"' );
 
 		const id1 = await editor.canvas.evaluate( () => {
 			return document.activeElement.id;
@@ -316,7 +317,7 @@ test.describe( 'Footnotes', () => {
 				id: id2,
 			},
 			{
-				content: 'first footnote',
+				content: 'first footnote"',
 				id: id1,
 			},
 		] );
@@ -329,7 +330,7 @@ test.describe( 'Footnotes', () => {
 		// This also saves the post!
 		expect( await getFootnotes( page ) ).toMatchObject( [
 			{
-				content: 'first footnote',
+				content: 'first footnote"',
 				id: id1,
 			},
 			{
@@ -338,6 +339,16 @@ test.describe( 'Footnotes', () => {
 			},
 		] );
 
+		const editorPage = page;
+		const previewPage = await editor.openPreviewPage();
+
+		await expect(
+			previewPage.locator( 'ol.wp-block-footnotes' )
+		).toHaveText( 'first footnote” ↩︎second footnote ↩︎' );
+
+		await previewPage.close();
+		await editorPage.bringToFront();
+
 		// Open revisions.
 		await editor.openDocumentSettingsSidebar();
 		await page
@@ -355,10 +366,19 @@ test.describe( 'Footnotes', () => {
 				id: id2,
 			},
 			{
-				content: 'first footnote',
+				content: 'first footnote"',
 				id: id1,
 			},
 		] );
+
+		const previewPage2 = await editor.openPreviewPage();
+
+		await expect(
+			previewPage2.locator( 'ol.wp-block-footnotes' )
+		).toHaveText( 'second footnote ↩︎first footnote” ↩︎' );
+
+		await previewPage2.close();
+		await editorPage.bringToFront();
 	} );
 
 	test( 'can be previewed when published', async ( { editor, page } ) => {
@@ -392,12 +412,14 @@ test.describe( 'Footnotes', () => {
 		// path).
 		await editor.canvas.click( 'ol.wp-block-footnotes li span' );
 		await page.keyboard.press( 'End' );
-		await page.keyboard.type( '3' );
+		// Test slashing.
+		await page.keyboard.type( '3"' );
 
 		const previewPage2 = await editor.openPreviewPage();
 
+		// Note: quote will get curled by wptexturize.
 		await expect(
 			previewPage2.locator( 'ol.wp-block-footnotes li' )
-		).toHaveText( '123  ↩︎' );
+		).toHaveText( '123″  ↩︎' );
 	} );
 } );