Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BC issue with woocommerce_thankyou_order_received_text #40329

Closed
5 tasks done
websupporter opened this issue Sep 21, 2023 · 0 comments · Fixed by #40353
Closed
5 tasks done

BC issue with woocommerce_thankyou_order_received_text #40329

websupporter opened this issue Sep 21, 2023 · 0 comments · Fixed by #40353
Labels
focus: template Issue related to WooCommerce templates. team: Proton type: regression Issues that have been introduced by the code change that impacted existing functionality.

Comments

@websupporter
Copy link
Member

Prerequisites

  • I have carried out troubleshooting steps and I believe I have found a bug.
  • I have searched for similar bugs in both open and closed issues and cannot find a duplicate.

Describe the bug

In #39758 we introduced a new template for the order-received note: https://github.com/woocommerce/woocommerce/blob/trunk/plugins/woocommerce/templates/checkout/order-received.php

The new template escapes now the output of the woocommerce_thankyou_order_received_text filter, which was not escaped before: https://github.com/woocommerce/woocommerce/pull/39758/files#diff-564a2935633e7fbf95ba8f1cae13c198399275de26dfb1c994868b6e9a3437c1L42

This introduces a bc problems for integrations using this filter and returning HTML.

Expected behavior

The output should not be escaped. This would follow also how we treat other filters in the templates, for example here:

<h2><?php echo apply_filters( 'woocommerce_my_account_my_orders_title', esc_html__( 'Recent orders', 'woocommerce' ) ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped ?></h2>

or in this template https://github.com/woocommerce/woocommerce/blob/7f9322c85858a17f6e9e9e79eaa3aefeda1a0624/plugins/woocommerce/templates/myaccount/my-downloads.php

Actual behavior

The output gets escaped by using esc_html(), which converts HTML tags into text.

Steps to reproduce

  1. Write and activate a small plugin like `add_filter('woocommerce_thankyou_order_received_text', function(){ return '

    Thank you!

    '; });
  2. Create an order
  3. See the escaped output like <p><strong>Thank you!</strong></p>

WordPress Environment

WC Version: 8.1.0

Isolating the problem

  • I have deactivated other plugins and confirmed this bug occurs when only WooCommerce plugin is active.
  • This bug happens with a default WordPress theme active, or Storefront.
  • I can reproduce this bug consistently using the steps above.
@github-actions github-actions bot added the status: awaiting triage This is a newly created issue waiting for triage. label Sep 21, 2023
@rrennick rrennick added focus: template Issue related to WooCommerce templates. team: Proton type: regression Issues that have been introduced by the code change that impacted existing functionality. and removed status: awaiting triage This is a newly created issue waiting for triage. labels Sep 21, 2023
lsinger added a commit that referenced this issue Sep 25, 2023
…40353)

* Escape the default "Thank you" text instead of the filtered message

Closes: #40329 and #40352

* Update plugins/woocommerce/templates/checkout/order-received.php

Co-authored-by: Leif Singer <github.2017@singer.sh>

* Bump template version to 8.3.0

* Add changefile(s) from automation for the following project(s): woocommerce

---------

Co-authored-by: Leif Singer <github.2017@singer.sh>
Co-authored-by: github-actions <github-actions@github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
focus: template Issue related to WooCommerce templates. team: Proton type: regression Issues that have been introduced by the code change that impacted existing functionality.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants