Skip to content

Decodes plugin titles in email subjects and bodies#606

Closed
nimesh-xecurify wants to merge 1 commit intoWordPress:trunkfrom
nimesh-xecurify:8231-email-subject
Closed

Decodes plugin titles in email subjects and bodies#606
nimesh-xecurify wants to merge 1 commit intoWordPress:trunkfrom
nimesh-xecurify:8231-email-subject

Conversation

@nimesh-xecurify
Copy link
Copy Markdown

Introduces a helper method to ensure plugin titles are HTML entity decoded when used in email plain-text contexts. This prevents titles containing HTML entities from displaying incorrectly.

Updates all relevant email classes to utilize this new method for consistent output.

Trac Ticket : https://meta.trac.wordpress.org/ticket/8231

Introduces a helper method to ensure plugin titles are HTML entity decoded when used in email plain-text contexts. This prevents titles containing HTML entities from displaying incorrectly.

Updates all relevant email classes to utilize this new method for consistent output.
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 14, 2026

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props nimeshatxecurify, dd32.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

Copy link
Copy Markdown
Member

@dd32 dd32 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AI-assisted review (prompted by @dd32):

The change looks good — clean fix for HTML entities showing literally in email subjects/bodies. One suggestion:

Consider using wp_specialchars_decode( $this->plugin->post_title, ENT_QUOTES ) instead of html_entity_decode( ..., ENT_QUOTES | ENT_HTML5, 'UTF-8' ). It's the WordPress wrapper that only decodes the entities WordPress itself encodes (&, <, >, ", '), and is what get_the_title() uses internally.

We considered get_the_title() directly, but it runs the the_title filter which could add extra markup or decorations from themes/plugins — not safe for plain-text email context. Calling wp_specialchars_decode() directly on post_title is more predictable here.

@dd32
Copy link
Copy Markdown
Member

dd32 commented Apr 16, 2026

AI totally got this wrong :) We want to do a full decode here for Email, as plugin authors can put limited HTML into their plugin names in WordPress; Specifically entities, such as © or ®

@bazza bazza closed this in 35f8c57 Apr 16, 2026
dd32 added a commit to dd32/wordpress.org that referenced this pull request Apr 16, 2026
Covers the entity decoding scenarios added in WordPress#606, based on real
plugin titles observed in the database (®, ™, ©,
numeric entities, hex entities, HTML5-only ', etc).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants