Commit 626390ed9b for wordpress.org

commit 626390ed9b90b00dc564ca17d28a2a4f7d04c088
Author: westonruter <westonruter@git.wordpress.org>
Date:   Sat Sep 26 19:38:47 2026 +0000

    Administration: Use script helper for bulk update JS.

    The four raw inline SCRIPT tags in `Bulk_Upgrader_Skin::error()`, `::before()`, and `::after()`, which toggle the spinner and progress messages during bulk plugin and theme updates, now print through `wp_print_inline_script_tag()`, so `wp_inline_script_attributes` can attach a per-request nonce to them.

    The selector is now passed to each script as a `wp_json_encode()` argument using `JSON_HEX_TAG | JSON_UNESCAPED_SLASHES` rather than being concatenated into the JavaScript string with `esc_js()`. Each function body is a nowdoc heredoc so that editors can syntax-check the JavaScript.

    Developed in https://github.com/WordPress/wordpress-develop/pull/13492.
    Follow-up to r56687, r63481, r63545, r63902.

    Props haritpanchal, westonruter.
    See #59446, #59444.

    Built from https://develop.svn.wordpress.org/trunk@63947


    git-svn-id: http://core.svn.wordpress.org/trunk@63113 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-admin/includes/class-bulk-upgrader-skin.php b/wp-admin/includes/class-bulk-upgrader-skin.php
index f406d160e4..d81eba885d 100644
--- a/wp-admin/includes/class-bulk-upgrader-skin.php
+++ b/wp-admin/includes/class-bulk-upgrader-skin.php
@@ -141,7 +141,18 @@ class Bulk_Upgrader_Skin extends WP_Upgrader_Skin {
 			}
 			$this->error = implode( ', ', $messages );
 		}
-		echo '<script>jQuery(\'.waiting-' . esc_js( $this->upgrader->update_current ) . '\').hide();</script>';
+		$js_function = <<<'JS'
+			( selector ) => {
+				jQuery( selector ).hide();
+			}
+			JS;
+		wp_print_inline_script_tag(
+			sprintf(
+				'( %s )( %s );',
+				$js_function,
+				wp_json_encode( '.waiting-' . $this->upgrader->update_current, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
+			)
+		);
 	}

 	/**
@@ -172,7 +183,18 @@ class Bulk_Upgrader_Skin extends WP_Upgrader_Skin {
 	public function before( $title = '' ) {
 		$this->in_loop = true;
 		printf( '<h2>' . $this->upgrader->strings['skin_before_update_header'] . ' <span class="spinner waiting-' . $this->upgrader->update_current . '"></span></h2>', $title, $this->upgrader->update_current, $this->upgrader->update_count );
-		echo '<script>jQuery(\'.waiting-' . esc_js( $this->upgrader->update_current ) . '\').css("display", "inline-block");</script>';
+		$js_function = <<<'JS'
+			( selector ) => {
+				jQuery( selector ).css( 'display', 'inline-block' );
+			}
+			JS;
+		wp_print_inline_script_tag(
+			sprintf(
+				'( %s )( %s );',
+				$js_function,
+				wp_json_encode( '.waiting-' . $this->upgrader->update_current, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
+			)
+		);
 		// This progress messages div gets moved via JavaScript when clicking on "More details.".
 		echo '<div class="update-messages hide-if-js" id="progress-' . esc_attr( $this->upgrader->update_current ) . '"><p>';
 		$this->flush_output();
@@ -200,7 +222,18 @@ class Bulk_Upgrader_Skin extends WP_Upgrader_Skin {
 				)
 			);

-			echo '<script>jQuery(\'#progress-' . esc_js( $this->upgrader->update_current ) . '\').show();</script>';
+			$js_function = <<<'JS'
+				( selector ) => {
+					jQuery( selector ).show();
+				}
+				JS;
+			wp_print_inline_script_tag(
+				sprintf(
+					'( %s )( %s );',
+					$js_function,
+					wp_json_encode( '#progress-' . $this->upgrader->update_current, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
+				)
+			);
 		}
 		if ( $this->result && ! is_wp_error( $this->result ) ) {
 			if ( ! $this->error ) {
@@ -210,7 +243,18 @@ class Bulk_Upgrader_Skin extends WP_Upgrader_Skin {
 					'</p></div>';
 			}

-			echo '<script>jQuery(\'.waiting-' . esc_js( $this->upgrader->update_current ) . '\').hide();</script>';
+			$js_function = <<<'JS'
+				( selector ) => {
+					jQuery( selector ).hide();
+				}
+				JS;
+			wp_print_inline_script_tag(
+				sprintf(
+					'( %s )( %s );',
+					$js_function,
+					wp_json_encode( '.waiting-' . $this->upgrader->update_current, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES )
+				)
+			);
 		}

 		$this->reset();
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 2c97846ee9..80f26a8223 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-alpha-63946';
+$wp_version = '7.2-alpha-63947';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.