Skip to content

Fix sanitize_ids to reject negative values and fix translation files#118

Merged
erseco merged 6 commits intomainfrom
copilot/add-attachments-to-document-cpt
Mar 4, 2026
Merged

Fix sanitize_ids to reject negative values and fix translation files#118
erseco merged 6 commits intomainfrom
copilot/add-attachments-to-document-cpt

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Mar 4, 2026

absint('-1') returns 1 (absolute value), so negative input strings were incorrectly accepted as valid attachment IDs in sanitize_ids().

  • includes/document/meta/class-document-attachments-meta-box.php: Validate with is_numeric() and (int) $trimmed <= 0 before calling absint(), filtering out zero, negative, and non-numeric values.
// Before: absint('-1') === 1, passes the > 0 check
$id = absint( trim( $part ) );
if ( $id > 0 ) { ... }

// After: reject non-positive values before absint
$trimmed = trim( $part );
if ( ! is_numeric( $trimmed ) || (int) $trimmed <= 0 ) {
    continue;
}
$ids[] = absint( $trimmed );
  • languages/documentate-es_ES.po: Fixed missing blank line separator between "Add to document" and "(mandatory field)" entries that caused PO parsers to show an empty msgstr for "Add to document". Also removed a duplicate "Remove" entry and consolidated its source references.
  • languages/documentate.pot: Added missing attachment-related strings (Attachments, Add files, Select files, Add to document) with source references.
  • languages/documentate-es_ES.mo: Regenerated binary translation file.
Original prompt

This section details on the original issue you should resolve

<issue_title>Feature: Allow attachments in the document CPT for supporting files</issue_title>
<issue_description>#### Summary

Add support for attachments associated with the document custom post type (CPT).
This feature will allow users to upload and manage additional files related to a document, such as annexes, supporting materials, or complementary documentation.

Attachments should be stored as standard WordPress media files and linked to the corresponding document entry.

Motivation

Many documents require additional materials such as:

  • Annexes
  • Supporting documentation
  • Reference files
  • Supplementary forms
  • Images or diagrams related to the main document

Currently there is no structured way to associate these files with a document entry. Users must handle them separately in the Media Library, which makes management and discoverability difficult.

Providing native attachment support will improve document organization and simplify the workflow for users managing complex documentation.

Expected Behavior

Users should be able to:

  1. Open a document entry in the WordPress admin.
  2. Upload one or more attachment files related to that document.
  3. View the list of attached files inside the document editor.
  4. Reorder or remove attachments if necessary.

Attachments may include any file type allowed by WordPress, such as:

  • PDF
  • DOCX
  • XLSX
  • Images
  • ZIP files

Admin UI

A new metabox should be added to the document editor screen:

Metabox title: Attachments

Features inside the metabox:

  • Upload new files using the WordPress Media Library

  • Attach existing files from the Media Library

  • List attached files with:

    • filename
    • file type icon
    • file size (optional)
  • Remove attachments

  • Optional drag-and-drop ordering

Frontend Behavior

If a document has attachments, they should be displayed in a section such as:

Attachments
-----------
• Annex I – Technical specifications.pdf
• Budget details.xlsx
• Supporting diagram.png

Each item should be downloadable.

Data Storage

Possible approaches:

  • Store attachment IDs in post meta, for example:
_document_attachments = [34, 52, 91]
  • Use WordPress media attachments linked via post_parent or a custom meta field.

The implementation should keep compatibility with WordPress Media Library workflows.

Possible Implementation Steps

  1. Register the attachment metabox for the document CPT.
  2. Implement file selection using the WordPress media uploader.
  3. Store attachment IDs in post meta.
  4. Display attached files in the admin interface.
  5. Render attachments on the frontend template.

Considerations

  • Multiple attachments should be supported.
  • File ordering may be useful for annex numbering.
  • Permissions should follow the normal WordPress media capability system.
  • The feature should not interfere with the existing PDF generation workflow.

Example Use Case

A document called:

Environmental Impact Report

May include the following attachments:

  • Annex I – Satellite images
  • Annex II – Field measurements
  • Annex III – Budget spreadsheet

These files should appear grouped under the main document.
</issue_description>

<agent_instructions>Do the code and also the unit tests</agent_instructions>

Comments on the Issue (you are @copilot in this section)


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: erseco <1876752+erseco@users.noreply.github.com>
Copilot AI changed the title [WIP] Add support for attachments in document CPT Add attachments metabox to document CPT Mar 4, 2026
Comment on lines +109 to +153
public function save( $post_id, $post = null, $update = false ) {
unset( $update );

if ( ! isset( $_POST[ self::NONCE_NAME ] ) ) {
return;
}

$nonce = sanitize_text_field( wp_unslash( $_POST[ self::NONCE_NAME ] ) );
if ( ! wp_verify_nonce( $nonce, self::NONCE_ACTION ) ) {
return;
}

if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE ) {
return;
}

if ( wp_is_post_autosave( $post_id ) || wp_is_post_revision( $post_id ) ) {
return;
}

if ( ! current_user_can( 'edit_post', $post_id ) ) {
return;
}

if ( null === $post ) {
$post = get_post( $post_id );
}

if ( ! $post instanceof WP_Post ) {
return;
}

$raw = isset( $_POST['documentate_attachments'] )
? sanitize_text_field( wp_unslash( $_POST['documentate_attachments'] ) )
: '';

$ids = self::sanitize_ids( $raw );

if ( empty( $ids ) ) {
delete_post_meta( $post_id, self::META_KEY );
return;
}

update_post_meta( $post_id, self::META_KEY, $ids );
}

Check warning

Code scanning / PHPMD

Code Size Rules: NPathComplexity Warning

The method save() has an NPath complexity of 1152. The configured NPath complexity threshold is 500.
Co-authored-by: erseco <1876752+erseco@users.noreply.github.com>
Copilot AI changed the title Add attachments metabox to document CPT Fix sanitize_ids to reject negative values before absint conversion Mar 4, 2026
@codecov
Copy link
Copy Markdown

codecov bot commented Mar 4, 2026

Codecov Report

❌ Patch coverage is 75.22936% with 27 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
admin/class-documentate-admin.php 0.00% 25 Missing ⚠️
...ument/meta/class-document-attachments-meta-box.php 97.46% 2 Missing ⚠️

📢 Thoughts on this report? Let us know!

@erseco erseco marked this pull request as ready for review March 4, 2026 18:36
@erseco
Copy link
Copy Markdown
Collaborator

erseco commented Mar 4, 2026

@copilot can you fix this

msgid "Add to document"
msgstr ""

Co-authored-by: erseco <1876752+erseco@users.noreply.github.com>
Copy link
Copy Markdown
Contributor Author

Copilot AI commented Mar 4, 2026

@copilot can you fix this

msgid "Add to document"
...

Fixed in ab1967d. The issue was a missing blank line separator between the "Add to document" and "(mandatory field)" PO entries, which caused PO parsers to misparse the file. Also removed a duplicate "Remove" entry and added the missing attachment strings to the .pot file. Regenerated the .mo binary.

Copilot AI changed the title Fix sanitize_ids to reject negative values before absint conversion Fix sanitize_ids to reject negative values and fix translation files Mar 4, 2026
@erseco erseco merged commit a745795 into main Mar 4, 2026
4 checks passed
@erseco erseco deleted the copilot/add-attachments-to-document-cpt branch March 4, 2026 20:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Feature: Allow attachments in the document CPT for supporting files

3 participants