escaped shortcodes should not be expanded during 'get_the_excerpt'

[bobbingwide]

It is possible for "the_content" filter to be invoked while processing "get_the_excerpt".

If the do_shortcodes() filter hook is attached to both "the_content" and "get_the_excerpt" then this can lead to an unexpected expansion of an escaped shortcode.

This can lead to unwanted side effects, as reported here.
​http://www.oik-plugins.com/2013/12/escaped-shortcodes-unexpectedly-expanded-get_the_excerpt/

This minor problem can be alleviated by a simple change to strip_shortcode_tag(), returning the HTML code [ as the first character rather than the left square bracket.

function strip_shortcode_tag( $m ) {
	// allow [[foo]] syntax for escaping a tag
	if ( $m[1] == '[' && $m[6] == ']' ) {
		return "[" . substr($m[0], 2, -1) ;
	}
	return $m[1] . $m[6];
}

I don't believe that it's necessary to make the same change in do_shortcode_tag().

[bobbingwide]

patch for 26649

[SergeyBiryukov]

Duplicate of #19927.

[bobbingwide]

Hi Sergey. Thanks for finding 19927 for me. I wondered why my patch had two changes.
The change in 19927 is for do_shortcode_tag()
The second part of the change, in 26649, is for strip_shortcode_tag().

The problem is not exactly a duplicate as the fix for 26649 handles the situation where shortcodes are being removed.

The patch for 26649 will work for 19927 but not vice-versa.
How should this be addressed?

[SergeyBiryukov]

Replying to bobbingwide:

The patch for 26649 will work for 19927 but not vice-versa.

I see, thanks for the clarification. Let's close #19927 in favor if this ticket then.

[SergeyBiryukov]

#19927 was marked as a duplicate.

[SergeyBiryukov]

Related: #12760, #25820.

[dd32]

I tend to agree that simply encoding the shortcode as text makes sense, as that's what the string is after strip_shortcodes() has run.

I would not expect the encoded shortcode to be completely removed, nor would I expect it to be escaped still, so encoding it such that do_shortcode( strip_shortcode( '[[example]]' ) ) doesn't execute the example shortcode makes sense to me.

Trac ticket: https://core.trac.wordpress.org/ticket/26649

Converts escaped shortcodes [[example]] into [example] to prevent do_shortcode from ever executing the shortcode.

Trac ticket: https://core.trac.wordpress.org/ticket/26649

[michaelwp85]

I've created a pull request with a fix and updated unit tests.

There is one scenario in which I revert the html entities back into brackets, this is when an escaped shortcode is used inside an attribute. Specifically for this test scenario: <div style="selector:url([[gallery]])">
If I do not revert the HTML entities will interfere with the processing of safecss_filter_attr stripping the code.

[michaelwp85]

All builds passed so I guess this can be tested :)
This is my first core contribution so any feedback is welcome.