htmlhint.js started linting correctly with 7.0 in Admin, exposing plugin code incorrectly calling it on non-plugin pages

[terraGirl]

Since WP 7.0 warnings have appeared in the theme file editor on functions.php triggered by chevrons.

How to reproduce

1. On a WP site with a classic theme go to Appearance > Theme File Editor
2. Select to edit the functions.php file

You will see a warning for every code using chevrons < > including the opening php tag

I would expect not see any warnings about chevrons in PHP files; and for the error message not to recommend escaping.

[ankitkumarshah]

Hi @terraGirl,
Thanks for reporting this issue.

I wasn't able to reproduce it on my end using the Twenty Eleven theme. Could you please share the exact theme you're using? That would help determine whether this is specific to a particular theme or a more general issue.

If possible, please also let us know whether the warnings appear only in functions.php or in other PHP files as well.

[terraGirl]

Sorry for wasting your time, I tracked this back to a plugin installed by the hosting provider that wrongly interacts with the Theme File Editor.

Source: BigScoots Helper 1.4.7
reported to plugin provider with a request to fix

I will go ahead and close this ticket as invalid.

[terraGirl]

@ankitkumarshah

I traced the issue back to a change in behaviour between v6.9 and v7.0.

This is the code that triggers the issue: calling wp_enqueue_code_editor() inside the wp_localize_script() function:

add_action( 'admin_enqueue_scripts', 'enqueue_admin_assets' );

function enqueue_admin_assets() {

	wp_register_script(
		'test-script',
		plugin_dir_url( __FILE__ ) . 'js/test-script.js',
		array(),
		'1.0.0',
		true
	);

	wp_localize_script( 'test-script', 'testScriptData', array(
		'code_editor' => wp_enqueue_code_editor(['type' => 'text/html']),
	) );

}

pre-7.0 this did not run the code_editor. Tested with 6.9.4
in 7.0+ it runs the code_editor

I'm unsure why this changed and what the preferred behaviour is. I'm documenting this in case other edge cases emerge.

[terraGirl]

Resolved:

The behaviour to load htmlhint.js when wp_enqueue_code_editor() is called inside wp_localize_script() is correct.

However, before 7.0, the linting was broken, and the loaded file was not detected. With 7.0, linting started working and exposed the incorrect code in the plugin.

6.9 loads wp-includes/js/codemirror/htmlhint.js?ver=0.9.14-xwp
7.0 loads wp-includes/js/codemirror/htmlhint.js?ver=1.8.0

Solution: update the plugin to guard wp_localize_script() against being called on every admin page.

An interesting case of a fix in WP Core exposing a previous silent bug in a plugin.