Skip to content

Fixes #64576 : Allow command and commandfor on button elements for In…#11483

Open
PANawkar wants to merge 1 commit intoWordPress:trunkfrom
PANawkar:64576-local
Open

Fixes #64576 : Allow command and commandfor on button elements for In…#11483
PANawkar wants to merge 1 commit intoWordPress:trunkfrom
PANawkar:64576-local

Conversation

@PANawkar
Copy link
Copy Markdown

@PANawkar PANawkar commented Apr 9, 2026

Allow the Invoker Commands API attributes command and commandfor on in $allowedposttags so post content sanitization (wp_kses_post()) no longer strips them. This matches existing support for popovertarget / popovertargetaction from the Popover API work (#61959).

Adds a PHPUnit test that verifies a button with command / commandfor and a popover target survives wp_kses_post().

Trac ticket: https://core.trac.wordpress.org/ticket/64576

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 9, 2026

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @pratik.nawkar@xecurify.com.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant