Context Navigation

← Previous Ticket
Next Ticket →

#65456 closed defect (bug) (fixed)

Block Visibility: Content within a hidden wrapper block is exposed in the excerpt

Reported by:	wildworks	Owned by:	wildworks
Priority:	normal	Milestone:	7.1
Component:	Editor	Version:	6.9
Severity:	normal	Keywords:	has-patch has-unit-tests
Cc:		Focuses:

Description

Originally reported at https://github.com/WordPress/gutenberg/issues/79164 (props to @awetz583)

Blocks hidden via Block Visibility support should always be excluded from rendered content. This generally works as expected, but blocks marked as hidden may be exposed when generating excerpts.

The reason is that the wp_trim_excerpt() function intentionally removes `do_blocks` and instead processes blocks via `excerpt_remove_blocks()`.

The excerpt_remove_blocks() function renders the inner blocks of a wrapper block instead of the wrapper block itself if it's considered a wrapper block. For example, even if a Group block is set to hidden, its child blocks might be unintentionally rendered.

Because the wp_trim_excerpt() function is hooked to get_the_excerpt, this issue propagates to the results of functions get_the_content() and the_content(), as well as the excerpt field in RSS feeds.

Testing Instructions

This is one of the simplest ways to reproduce the issue.

Open the block editor and insert a Group block. Then, place a Paragraph block inside the Group block. The data should look like this:

<!-- wp:group {"metadata":{"blockVisibility":false},"layout":{"type":"constrained"}} -->
<div class="wp-block-group"><!-- wp:paragraph -->
<p>Hidden Paragraph</p>
<!-- /wp:paragraph --></div>
<!-- /wp:group -->

Insert an Excerpt block. Content within a hidden group block will be displayed.

Change History (7)

#1 @wildworks
5 weeks ago

Version → 6.9

This ticket was mentioned in PR #12167 on WordPress/wordpress-develop by @wildworks.

5 weeks ago #2

Keywords has-patch has-unit-tests added

Blocks hidden via the blockVisibility metadata are correctly stripped from rendered content, but their text still leaks into auto-generated excerpts.

The cause is that excerpt generation does not go through the render_block filter where the visibility block support runs. wp_trim_excerpt() unhooks do_blocks and instead walks the parsed blocks with excerpt_remove_blocks(). Wrapper blocks (group, columns, column) are handed to _excerpt_render_inner_blocks(), which renders their inner blocks directly and never evaluates the wrapper's own visibility — so a hidden wrapper's content ends up in the excerpt.

This fix skips blocks whose blockVisibility metadata is false in both excerpt_remove_blocks() and _excerpt_render_inner_blocks(), so excerpts match the rendered content. Tests cover hidden top-level blocks, hidden wrapper blocks, and hidden blocks nested inside a visible wrapper.

## Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Opus 4.8
Used for: Investigating the excerpt rendering path, implementing the fix, and drafting the tests. All changes were reviewed and edited by me.

#3 follow-up: ↓ 5 @n8finch
4 weeks ago

@wildworks thanks for the quick turnaround on this.

I tested this this pull request with WordPress Playground (https://playground.wordpress.net/wordpress.html?pr=12167), and also tested this locally, applying the patch.

Works as expected.

Noting that this will only work of the "Omit from published content" box is checked for the block visibility. If the only the Desktop, Tablet, or Mobile views are checked, then this would still show up in the excerpt.

Last edited 4 weeks ago by n8finch (previous) (diff)

@wildworks commented on PR #12167:

3 weeks ago #4

@ramonjd Thanks for the review!

Hidden blocks aren't rendered, whereas viewport block are and are in the HTML content, and therefore should be in the excerpt.

I agree. Since the content is dynamically controlled by CSS on the front end, the server cannot determine whether to hide the content. It is reasonable to always output the excerpt.

Do you think we'll need a GB patch as well?

This PR directly updates core functionality, so it may be difficult to apply compatible code to GB. When I tried asking an AI, it indicated that the following extensive code would be necessary 😅

<details><summary>Details</summary>

<?php
/**
 * Honor the visibility block support when generating excerpts.
 *
 * Backports https://github.com/WordPress/wordpress-develop/pull/12167 (Trac #65456).
 *
 * Core's excerpt_remove_blocks() / _excerpt_render_inner_blocks() are not
 * pluggable and have no per-block extension point, so the only way to inject
 * the visibility check is to replace wp_trim_excerpt() on the
 * `get_the_excerpt` filter with a Gutenberg copy that calls our excerpt
 * functions. Remove this file once the change ships in WordPress Core.
 *
 * @package gutenberg
 */

/**
 * Gutenberg copy of excerpt_remove_blocks() that skips blocks hidden via the
 * visibility block support (`metadata.blockVisibility === false`).
 *
 * @param string $content The content to filter.
 * @return string The filtered content.
 */
function gutenberg_excerpt_remove_blocks( $content ) {
        if ( ! has_blocks( $content ) ) {
                return $content;
        }

        $allowed_inner_blocks = array(
                // Classic blocks have their blockName set to null.
                null,
                'core/freeform',
                'core/heading',
                'core/html',
                'core/list',
                'core/media-text',
                'core/paragraph',
                'core/preformatted',
                'core/pullquote',
                'core/quote',
                'core/table',
                'core/verse',
        );

        $allowed_wrapper_blocks = array(
                'core/columns',
                'core/column',
                'core/group',
        );

        /** This filter is documented in wp-includes/blocks.php */
        $allowed_wrapper_blocks = apply_filters( 'excerpt_allowed_wrapper_blocks', $allowed_wrapper_blocks );

        $allowed_blocks = array_merge( $allowed_inner_blocks, $allowed_wrapper_blocks );

        /** This filter is documented in wp-includes/blocks.php */
        $allowed_blocks = apply_filters( 'excerpt_allowed_blocks', $allowed_blocks );
        $blocks         = parse_blocks( $content );
        $output         = '';

        foreach ( $blocks as $block ) {
                // Hide the block whenever the value is boolean false, regardless of the
                // block's current visibility support. This prevents blocks that previously
                // supported visibility from unintentionally appearing on the front end
                // after their support was disabled.
                if ( false === ( $block['attrs']['metadata']['blockVisibility'] ?? null ) ) {
                        continue;
                }

                if ( in_array( $block['blockName'], $allowed_blocks, true ) ) {
                        if ( ! empty( $block['innerBlocks'] ) ) {
                                if ( in_array( $block['blockName'], $allowed_wrapper_blocks, true ) ) {
                                        $output .= gutenberg_excerpt_render_inner_blocks( $block, $allowed_blocks );
                                        continue;
                                }

                                // Skip the block if it has disallowed or nested inner blocks.
                                foreach ( $block['innerBlocks'] as $inner_block ) {
                                        if (
                                                ! in_array( $inner_block['blockName'], $allowed_inner_blocks, true ) ||
                                                ! empty( $inner_block['innerBlocks'] )
                                        ) {
                                                continue 2;
                                        }
                                }
                        }

                        $output .= render_block( $block );
                }
        }

        return $output;
}

/**
 * Gutenberg copy of _excerpt_render_inner_blocks() that skips inner blocks
 * hidden via the visibility block support.
 *
 * @param array $parsed_block   The parsed block.
 * @param array $allowed_blocks The list of allowed inner blocks.
 * @return string The rendered inner blocks.
 */
function gutenberg_excerpt_render_inner_blocks( $parsed_block, $allowed_blocks ) {
        $output = '';

        foreach ( $parsed_block['innerBlocks'] as $inner_block ) {
                // Hide the block whenever the value is boolean false, regardless of the
                // block's current visibility support. This prevents blocks that previously
                // supported visibility from unintentionally appearing on the front end
                // after their support was disabled.
                if ( false === ( $inner_block['attrs']['metadata']['blockVisibility'] ?? null ) ) {
                        continue;
                }

                if ( ! in_array( $inner_block['blockName'], $allowed_blocks, true ) ) {
                        continue;
                }

                if ( empty( $inner_block['innerBlocks'] ) ) {
                        $output .= render_block( $inner_block );
                } else {
                        $output .= gutenberg_excerpt_render_inner_blocks( $inner_block, $allowed_blocks );
                }
        }

        return $output;
}

/**
 * Gutenberg copy of wp_trim_excerpt() that routes block removal through
 * gutenberg_excerpt_remove_blocks() so hidden blocks are stripped from
 * auto-generated excerpts.
 *
 * Identical to core wp_trim_excerpt() except for the excerpt_remove_blocks()
 * call, which is swapped for gutenberg_excerpt_remove_blocks().
 *
 * @param string      $text The trimmed text.
 * @param WP_Post|int $post The post.
 * @return string The trimmed excerpt.
 */
function gutenberg_trim_excerpt( $text = '', $post = null ) {
        $raw_excerpt = $text;

        if ( '' === trim( $text ) ) {
                $post = get_post( $post );
                $text = get_the_content( '', false, $post );

                $text = strip_shortcodes( $text );
                $text = gutenberg_excerpt_remove_blocks( $text );
                $text = excerpt_remove_footnotes( $text );

                /*
                 * Temporarily unhook wp_filter_content_tags() since any tags
                 * within the excerpt are stripped out. Modifying the tags here
                 * is wasteful and can lead to bugs in the image counting logic.
                 */
                $filter_image_removed = remove_filter( 'the_content', 'wp_filter_content_tags', 12 );

                /*
                 * Temporarily unhook do_blocks() since excerpt_remove_blocks( $text )
                 * handles block rendering needed for excerpt.
                 */
                $filter_block_removed = remove_filter( 'the_content', 'do_blocks', 9 );

                /** This filter is documented in wp-includes/post-template.php */
                $text = apply_filters( 'the_content', $text );
                $text = str_replace( ']]>', ']]&gt;', $text );

                // Restore the original filter if removed.
                if ( $filter_block_removed ) {
                        add_filter( 'the_content', 'do_blocks', 9 );
                }

                /*
                 * Only restore the filter callback if it was removed above. The logic
                 * to unhook and restore only applies on the default priority of 10,
                 * which is generally used for the filter callback in WordPress core.
                 */
                if ( $filter_image_removed ) {
                        add_filter( 'the_content', 'wp_filter_content_tags', 12 );
                }

                /* translators: Maximum number of words used in a post excerpt. */
                $excerpt_length = (int) _x( '55', 'excerpt_length' );

                /** This filter is documented in wp-includes/formatting.php */
                $excerpt_length = (int) apply_filters( 'excerpt_length', $excerpt_length );

                /** This filter is documented in wp-includes/formatting.php */
                $excerpt_more = apply_filters( 'excerpt_more', ' ' . '[&hellip;]' );
                $text         = wp_trim_words( $text, $excerpt_length, $excerpt_more );
        }

        /** This filter is documented in wp-includes/formatting.php */
        return apply_filters( 'wp_trim_excerpt', $text, $raw_excerpt );
}

// Replace core's excerpt trimmer with the visibility-aware version.
remove_filter( 'get_the_excerpt', 'wp_trim_excerpt', 10 );
add_filter( 'get_the_excerpt', 'gutenberg_trim_excerpt', 10, 2 );

</details>

#5 in reply to: ↑ 3 @wildworks
3 weeks ago

@n8finch Thanks for the testing.

Noting that this will only work of the "Omit from published content" box is checked for the block visibility. If the only the Desktop, Tablet, or Mobile views are checked, then this would still show up in the excerpt.

That's right. Please refer to this for the reason.

https://github.com/WordPress/wordpress-develop/pull/12167#issuecomment-4766054419

#6 @wildworks
3 weeks ago

Owner set to wildworks
Resolution → fixed
Status new → closed

In 62539:

Excerpt: Honor the block visibility metadata in generated excerpts.

When an excerpt is auto-generated, the metadata.blockVisibility attribute was ignored, so blocks marked as hidden still leaked their text into the excerpt even though they are not rendered on the front end.

Skip any block whose metadata.blockVisibility attribute is boolean false, for both top-level blocks and inner blocks.

Props n8finch, ramonopoly, wildworks.
Fixes #65456.

#7 @sabernhardt
3 weeks ago

Milestone Awaiting Review → 7.1

Note: See TracTickets for help on using tickets.

Download in other formats:

Make WordPress Core

Context Navigation

#65456 closed defect (bug) (fixed)

Block Visibility: Content within a hidden wrapper block is exposed in the excerpt

Description

Testing Instructions

Change History (7)

#1 @wildworks 5 weeks ago

This ticket was mentioned in ​PR #12167 on ​WordPress/wordpress-develop by ​@wildworks. 5 weeks ago #2

#3 follow-up: ↓ 5 @n8finch 4 weeks ago

​@wildworks commented on ​PR #12167: 3 weeks ago #4

#5 in reply to: ↑ 3 @wildworks 3 weeks ago

#6 @wildworks 3 weeks ago

#7 @sabernhardt 3 weeks ago