Skip to content

Fix: tighten smart tag resolution scope and meta-key access - #1667

Open
rajatgautam755421 wants to merge 2 commits into
pre-developfrom
fix/1231-post-meta-smart-tag-disclosure
Open

rajatgautam755421 wants to merge 2 commits into
pre-developfrom
fix/1231-post-meta-smart-tag-disclosure

Conversation

@rajatgautam755421

Copy link
Copy Markdown
Contributor

Summary

  • Restricts the submission-time smart tag re-resolution pass to hidden fields only, matching the original scope of that feature.
  • Adds a protected-meta-key check to the post_meta, posts_meta_current_page_id, and user_meta smart tags.

Test plan

  • Confirm hidden field default values with smart tags still resolve correctly on submission.
  • Confirm non-hidden fields (text, textarea, email, etc.) no longer re-resolve smart tag syntax typed into their values.
  • Confirm post_meta/user_meta/posts_meta_current_page_id smart tags still resolve for regular (non-protected) meta keys.
  • Confirm those same tags return empty for protected meta keys (e.g. keys prefixed with _).

Restrict submission-time smart tag re-resolution to hidden fields only,
matching the feature's original scope, and block post/user meta lookups
for protected meta keys via is_protected_meta().
@tg-autopilot
tg-autopilot requested a lite review from Copilot September 15, 2026 03:48
@github-actions

Copy link
Copy Markdown

QA suite — refused, no regression spec

This PR changes product source but adds no spec, so the suite was
refused before booting WordPress — running it just to report the same
thing at the end costs runner minutes for nothing. Run
/claudegrill:verify-fix locally and let write-spec add the guard
to this branch, then push again.

Source files changed with no matching spec
includes/class-evf-form-task.php
includes/class-evf-smart-tags.php

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

Non-hidden field values can still be re-resolved during entry saving.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR restricts smart-tag re-resolution to hidden fields and blocks protected metadata access.

Changes:

  • Adds protected-meta-key checks.
  • Limits the initial submission-time resolution pass to hidden fields.
  • A later save-time pass still re-resolves non-hidden values.
File summaries
File Summary
includes/class-evf-smart-tags.php Adds protected-meta-key checks.
includes/class-evf-form-task.php Restricts the initial pass, but a later pass still processes all string field values.
Review details
  • Files reviewed: 2/2 changed files
  • Comments generated: 1
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread includes/class-evf-form-task.php
The earlier submission-time pass was scoped to hidden fields, but a
second, independent resolution pass at entry-save time still ran
against every field type. Restrict that pass the same way so a
non-hidden field can no longer trigger tag resolution.
@rajatgautam755421

Copy link
Copy Markdown
Contributor Author

@tg-autopilot review

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The reviewed changes have no unresolved approval-blocking issues.

Review details
  • Files reviewed: 2/2 changed files
  • Comments generated: 0 new
  • Review effort level: Lite

@rajatgautam755421
rajatgautam755421 marked this pull request as ready for review September 15, 2026 04:03
@rajatgautam755421 rajatgautam755421 self-assigned this Sep 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants