Blocks: Add missing esc_url() to href output in post-author-name and post-date block renderers

[thisismyurl]

The post-author-name and post-date block render functions output URLs
directly into href attributes without esc_url().

post-author-name.php line 35: get_author_posts_url() is passed raw into
the sprintf href placeholder.

post-date.php line 87: get_the_permalink() is passed raw into the sprintf
href placeholder. This line also uses %1s/%2s format specifiers instead of
the positional %1$s/%2$s used consistently in all sibling block renderers.

Both sibling files (post-author.php, comment-author-name.php, post-title.php)
wrap their href values with esc_url(). These two files were missed.

Fix: wrap get_author_posts_url() and get_the_permalink() with esc_url() in
both files, and update the format specifiers in post-date.php for consistency.

## Summary

• Wraps get_author_posts_url() with esc_url() in post-author-name.php — it was passed directly into the sprintf href placeholder
• Wraps get_the_permalink() with esc_url() in post-date.php — same issue, plus corrects %1s/%2s to %1$s/%2$s to match the positional format specifiers used in all sibling block renderers

post-author.php, comment-author-name.php, and post-title.php all wrap their href values with esc_url(). These two files were missed.

## Testing

• php -l src/wp-includes/blocks/post-author-name.php
• php -l src/wp-includes/blocks/post-date.php
• vendor/bin/phpcs --standard=phpcs.xml.dist src/wp-includes/blocks/post-author-name.php src/wp-includes/blocks/post-date.php
• Enable the Post Author Name and Post Date blocks on a post; confirm author link and date link render correctly

Trac ticket: https://core.trac.wordpress.org/ticket/65396

(full disclosure, I used AI help with the testing and tweaks - Christopher)

[sabernhardt]

Hi and thanks for the report!

These will need to be fixed in the plugin first. Could you open a Gutenberg PR (and/or an issue)?

• ​Post Author Name
• ​Post Date
• ​Post Featured Image
• ​Read More

[ankitkumarshah]

Hi @sabernhardt,

Thanks for pointing that out. I've gone ahead and opened a Gutenberg PR for this: ​https://github.com/WordPress/gutenberg/pull/78912

When you have a chance, could you please take a look? Thank You

[sabernhardt]

Thanks for opening the PR

Closing this out. Trac #65396 was closed as reported-upstream since these renderers are synced from the Gutenberg block-library packages, and Gutenberg trunk now carries the fix: both post-author-name and post-date wrap their href values with esc_url() and use the positional %1$s specifiers. The change will reach core through the normal package sync, so there is nothing left for this PR to do.