Ticket #44238: 44238.1.diff

src/wp-includes/meta.php

@@ -952 +952 @@
 function is_protected_meta( $meta_key, $meta_type = null ) {
         $protected = ( '_' == $meta_key[0] );
 
+        if( $meta_type ) {
+                /**
+                 * Filters whether a meta key is considered protected.
+                 *
+                 * @since 5.0.0
+                 *
+                 * @param bool $protected Whether the key is considered protected.
+                 * @param string $meta_key Meta key.
+                 * @param string|null $meta_type Type of object metadata is for (e.g., comment, post, or user).
+                 */
+                $protected = apply_filters( "protected_{$meta_type}_meta_{$meta_key}", $protected, $meta_key, $meta_type );
+        }
         /**
          * Filters whether a meta key is considered protected.
          *
@@ -1026 +1038 @@
                 $wp_meta_keys = array();
         }
 
+        $protected = ( '_' == $meta_key[0] );
+
         $defaults = array(
                 'type'              => 'string',
                 'description'       => '',
                 'single'            => false,
+                'protected'         => $protected,
                 'sanitize_callback' => null,
                 'auth_callback'     => null,
                 'show_in_rest'      => false,
@@ -1067 +1082 @@
         $args = apply_filters( 'register_meta_args', $args, $defaults, $object_type, $meta_key );
         $args = wp_parse_args( $args, $defaults );
 
+        if ( $protected ) {
+                $protected_callback = "__return_true";
+        } else {
+                $protected_callback = "__return_false";
+        }
+
+        add_filter( "protected_{$meta_type}_meta_{$meta_key}", $protected_callback, 8, 1 );
+
+
         // If `auth_callback` is not provided, fall back to `is_protected_meta()`.
         if ( empty( $args['auth_callback'] ) ) {
                 if ( is_protected_meta( $meta_key, $object_type ) ) {
@@ -1149 +1173 @@
                 remove_filter( "auth_{$object_type}_meta_{$meta_key}", $args['auth_callback'] );
         }
 
+        if ( isset( $args['protected'] )  ) {
+                if ( $args['protected'] ) {
+                        $protected_callback = "__return_true";
+                } else {
+                        $protected_callback = "__return_false";
+                }
+                remove_filter( "protected_{$object_type}_meta_{$meta_key}", $protected_callback, 8 );
+        }
+
         unset( $wp_meta_keys[ $object_type ][ $meta_key ] );
 
         // Do some clean up