Skip to content

Add post password length validation to Quick Edit and server-side processing #9776

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 8 commits into
base: trunk
Choose a base branch
from
Open

Add post password length validation to Quick Edit and server-side processing #9776

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
3ef55a2
Quick Edit: Add maxlength attribute to post password field
R1shabh-Gupta Sep 7, 2025
2b41e34
Posts: Add server-side validation for post password length
R1shabh-Gupta Sep 7, 2025
586b908
Tests: Add post password length validation tests
R1shabh-Gupta Sep 7, 2025
13b95e9
Posts: Update error code for post password length validation
R1shabh-Gupta Sep 8, 2025
e000f84
Tests: Simplify post password length validation test
R1shabh-Gupta Sep 8, 2025
6dddf7c
Tests: Refactor post password length validation test and update coverage
R1shabh-Gupta Sep 8, 2025
41d66ed
Tests: Expand password validation test coverage for _wp_translate_pos…
R1shabh-Gupta Sep 9, 2025
e29ecb9
Tests: Rename post password length validation test for clarity
R1shabh-Gupta Sep 9, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/wp-admin/includes/class-wp-posts-list-table.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1781,7 +1781,7 @@ public function inline_edit() {
<div class="inline-edit-group wp-clearfix">
<label class="alignleft">
<span class="title"><?php _e( 'Password' ); ?></span>
<span class="input-text-wrap"><input type="text" name="post_password" class="inline-edit-password-input" value="" /></span>
<span class="input-text-wrap"><input type="text" name="post_password" class="inline-edit-password-input" value="" maxlength="255" /></span>
</label>

<span class="alignleft inline-edit-or">
Expand Down
4 changes: 4 additions & 0 deletions src/wp-admin/includes/post.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,6 +156,10 @@ function _wp_translate_postdata( $update = false, $post_data = null ) {
unset( $post_data['post_password'] );
}

if ( isset( $post_data['post_password'] ) && strlen( $post_data['post_password'] ) > 255 ) {
return new WP_Error( 'invalid_post_password_length', __( 'Post passwords cannot be longer than 255 characters.' ) );
}

if ( ! isset( $post_data['comment_status'] ) ) {
$post_data['comment_status'] = 'closed';
}
Expand Down
54 changes: 54 additions & 0 deletions tests/phpunit/tests/admin/includesPost.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,9 @@ public static function wpSetUpBeforeClass( WP_UnitTest_Factory $factory ) {
self::$post_id = $factory->post->create();
}

/**
* @covers ::_wp_translate_postdata
*/
public function test__wp_translate_postdata_cap_checks_contributor() {
wp_set_current_user( self::$contributor_id );

Expand Down Expand Up @@ -1325,4 +1328,55 @@ public function test_user_get_refreshed_metabox_nonce() {
$this->assertNotEmpty( $response['wp-refresh-metabox-loader-nonces']['replace']['_wpnonce'] );
$this->assertNotEmpty( $response['wp-refresh-metabox-loader-nonces']['replace']['metabox_loader_nonce'] );
}

/**
* Test that _wp_translate_postdata() validates post password length.
*
* @ticket 63943
* @covers ::_wp_translate_postdata
*/
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add a @covers ::_wp_translate_postdata. We have to get used to add this

public function test_validity_post_password_length() {
wp_set_current_user( self::$editor_id );

// Test valid password within 255 character limit.
$valid_password = str_repeat( 'a', 255 );
$post_data = array(
'post_type' => 'post',
'post_password' => $valid_password,
);

$result = _wp_translate_postdata( false, $post_data );
$this->assertNotWPError( $result );
$this->assertSame( $valid_password, $result['post_password'] );

// Test password over 255 characters should fail.
$invalid_password = str_repeat( 'a', 256 );
$post_data = array(
'post_type' => 'post',
'post_password' => $invalid_password,
);

$result = _wp_translate_postdata( false, $post_data );
$this->assertWPError( $result );
$this->assertSame( 'invalid_post_password_length', $result->get_error_code() );
}

/**
* Test that _wp_translate_postdata() removes post password for users without publish_posts capability.
*
* @covers ::_wp_translate_postdata
*/
public function test_post_password_removed_for_users_without_publish_posts_cap() {
wp_set_current_user( self::$contributor_id );

// Contributors cannot publish posts, so password should be removed.
$post_data = array(
'post_type' => 'post',
'post_password' => 'test_password',
'post_status' => 'draft',
);

$result = _wp_translate_postdata( false, $post_data );
$this->assertArrayNotHasKey( 'post_password', $result );
}
}
Loading