Changeset 62401 for trunk

Timestamp:

05/21/2026 10:27:38 AM (5 months ago)

Author:

gziolo

Message:

Abilities API: Stop HTML-escaping the ability name in WP_Error messages

Ability names are pattern-validated at registration, so esc_html() on them is always a no-op. Drop it from the WP_Error messages, which are commonly serialized to JSON where the escaping would be incorrect.

Follow-up to [62398].
See #64311.

File:

• trunk/src/wp-includes/abilities-api/class-wp-ability.php (modified) (4 diffs)

trunk/src/wp-includes/abilities-api/class-wp-ability.php

@@ -562 +562 @@
                                         /* translators: 1: Ability name, 2: Exception message. */
                                         __( 'Ability "%1$s" callback threw an exception: %2$s' ),
-                                        esc_html( $this->name ),
+                                        $this->name,
                                         esc_html( $e->getMessage() )
                                 )
@@ -591 +591 @@
                                 'ability_invalid_permission_callback',
                                 /* translators: %s ability name. */
-                                sprintf( __( 'Ability "%s" does not have a valid permission callback.' ), esc_html( $this->name ) )
+                                sprintf( __( 'Ability "%s" does not have a valid permission callback.' ), $this->name )
                         );
                 }
@@ -639 +639 @@
                                 'ability_invalid_execute_callback',
                                 /* translators: %s ability name. */
-                                sprintf( __( 'Ability "%s" does not have a valid execute callback.' ), esc_html( $this->name ) )
+                                sprintf( __( 'Ability "%s" does not have a valid execute callback.' ), $this->name )
                         );
                 } else {
@@ -784 +784 @@
                                 'ability_invalid_permissions',
                                 /* translators: %s ability name. */
-                                sprintf( __( 'Ability "%s" does not have necessary permission.' ), esc_html( $this->name ) )
+                                sprintf( __( 'Ability "%s" does not have necessary permission.' ), $this->name )
                         );
                 }