Dismiss Button in Media Upload Error Message Not Working

[sukhendu2002]

When an unsupported file is uploaded via the "Upload New Media" section, an error message is displayed. However, the "Dismiss" button on the error message does not function as expected.

The issue occurs because the onclick attribute on the dismiss button is stripped out due to wp_admin_notice() using wp_kses_post() internally.

Steps to Reproduce:

• Navigate to Media > Add New Media File in the admin dashboard.
• Attempt to upload an unsupported file type (e.g., a .exe file).
• Observe that an error message appears.
• Click the "Dismiss" button on the error message.

This PR fixes an issue where the dismiss button in the media upload error messages was not working.

Trac ticket: https://core.trac.wordpress.org/ticket/62606

​https://github.com/user-attachments/assets/edf67b4b-2c3b-4df0-89f0-da6c7997dc87

[abcd95]

Reproduction Report

Description

This report validates that the issue can be reproduced.

Environment

• WordPress: 6.7.1
• PHP: 8.1.29
• Server: nginx/1.16.0
• Database: mysqli (Server: 8.0.16 / Client: mysqlnd 8.1.29)
• Browser: Chrome 131.0.0.0
• OS: macOS
• Theme: Twenty Twenty-Five 1.0

Actual Results

✅ Error condition occurs.

Supplemental Artifacts

Screencast - ​https://utfs.io/f/vtiKpIr2gd0c32cyGIoXiUKalkW6HNjG2YsI0Jq4mdVb1EfM

[azaozz]

As far as I see the PR will fix this. However there is already a way to make admin notices dismissable, see `makeNoticesDismissible()` in common.js. Could that be used instead?

[rinkalpagdar]

Reproduction Report

Description

This report validates whether the issue can be reproduced.

Environment

• WordPress: 6.8-alpha-59274-src
• PHP: 8.2.25
• Server: nginx/1.27.2
• Database: mysqli (Server: 8.0.40 / Client: mysqlnd 8.2.25)
• Browser: Chrome 131.0.0.0
• OS: macOS
• Theme: Twenty Twenty-Five 1.0
• MU Plugins: None activated
• Plugins:
  • Test Reports 1.2.0

Actual Results

1. ❌ Error condition does not occur (not reproduced).

Additional Notes

• I have added a screencast for this.

Supplemental Artifacts

[sabernhardt]

alternative option: echo wp_get_admin_notice()

[sabernhardt]

The async upload already escapes the filename and error message, so it could switch to echo wp_get_admin_notice(). It would not need the action or further sanitization in wp_admin_notice().

I was not successful at making the notice consistent with other dismissible notices (comment:3), but if someone else can, that could be an improvement to replace the onclick attribute.