Fix: tighten smart tag resolution scope and meta-key access - #1667
Open
rajatgautam755421 wants to merge 2 commits into
Open
rajatgautam755421 wants to merge 2 commits into
rajatgautam755421 wants to merge 2 commits into
Conversation
Restrict submission-time smart tag re-resolution to hidden fields only, matching the feature's original scope, and block post/user meta lookups for protected meta keys via is_protected_meta().
QA suite — refused, no regression specThis PR changes product source but adds no spec, so the suite was Source files changed with no matching spec |
There was a problem hiding this comment.
🟡 Changes recommended
Non-hidden field values can still be re-resolved during entry saving.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
This PR restricts smart-tag re-resolution to hidden fields and blocks protected metadata access.
Changes:
- Adds protected-meta-key checks.
- Limits the initial submission-time resolution pass to hidden fields.
- A later save-time pass still re-resolves non-hidden values.
File summaries
| File | Summary |
|---|---|
includes/class-evf-smart-tags.php |
Adds protected-meta-key checks. |
includes/class-evf-form-task.php |
Restricts the initial pass, but a later pass still processes all string field values. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
The earlier submission-time pass was scoped to hidden fields, but a second, independent resolution pass at entry-save time still ran against every field type. Restrict that pass the same way so a non-hidden field can no longer trigger tag resolution.
Contributor
Author
|
@tg-autopilot review |
rajatgautam755421
marked this pull request as ready for review
September 15, 2026 04:03
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
post_meta,posts_meta_current_page_id, anduser_metasmart tags.Test plan
post_meta/user_meta/posts_meta_current_page_idsmart tags still resolve for regular (non-protected) meta keys._).