fix: register the Edit Snippet menu item only while editing - #466
Open
TallblokeUK wants to merge 1 commit into
Open
fix: register the Edit Snippet menu item only while editing#466TallblokeUK wants to merge 1 commit into
TallblokeUK wants to merge 1 commit into
Conversation
Two problems reported together on the forums, with one cause. The item appeared for anyone reading the admin menu programmatically, even on the Dashboard. It was registered unconditionally on `admin_menu` and removed afterwards on `current_screen`, which fires later — so it genuinely sat in `$submenu` for a window. Nothing rendered it, but a menu editor or role manager reading the menu at that point captured it, and the reporter's saved menu kept reinstating a page they had hidden. Selecting the item while editing also discarded the snippet. Its link was `page=edit-snippet` with no ID, which the editor treats as a new snippet, so following the item that marks "you are here" opened a blank form and dropped unsaved changes. The page is now registered outside the menu, so it stays reachable by URL but never enters `$submenu` under the Snippets parent. While a snippet is being edited, a plain link to that snippet is added alongside. `maybe_hide_menu_item()` is gone: registration decides, rather than registering and retracting. The ID is carried on a link rather than in the registered slug, because a submenu slug doubles as the identifier WordPress checks permissions against. Putting the ID there makes `page=edit-snippet` match nothing and the screen returns "Sorry, you are not allowed to access this page" — confirmed while building this. Verified against WordPress 7.0.4, PHP 8.2.33, Code Snippets 3.10.0. A probe reading the menu at the end of `admin_menu`, as a menu editor would, previously reported the item on every admin screen; it now reports it only while editing, and the link resolves back to the same snippet. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft — the approach is worth a look before this goes further, particularly the choice to keep the ID on a link rather than in the registered slug.
Reported
https://wordpress.org/support/topic/edit-snippet/ — two problems in one thread, with one cause.
1. The item is registered globally. The reporter uses Admin Menu Editor Pro to keep other admins out of the Snippets area, and "Edit Snippet" keeps reappearing in their menu after updates.
2. Selecting it starts a new snippet. As acknowledged in the thread: the item is meant to mark the page you're on, but following it lands on Add New.
Cause
Edit_Menuregistered the item unconditionally onadmin_menuand removed it afterwards oncurrent_screen, which fires later. Nothing ever rendered it — but it genuinely sat in$submenuin between.A probe reading the menu at the end of
admin_menu, which is what a menu editor does, found it on every admin screen:So the reporter's tooling isn't misbehaving: it captures a genuinely-registered page and persists it. Their access-control complaint is real.
And while editing snippet 5, the item's link was
admin.php?page=edit-snippetwith no ID:Unsaved changes go with it.
Change
The page is registered outside the menu, so it stays reachable by URL but never enters
$submenuunder the Snippets parent. While a snippet is being edited, a plain link to that snippet is added alongside.maybe_hide_menu_item()is deleted — registration decides, instead of registering and retracting.Why the ID is on a link rather than in the slug — this is the part worth reviewing. A submenu slug doubles as the identifier WordPress checks permissions against. My first attempt rewrote the registered slug to carry the ID; the edit screen then returned "Sorry, you are not allowed to access this page", because
page=edit-snippetno longer matched anything registered. That is the "WordPress limitation" from the thread, and adding a separate link is the way around it.After
admin_menu, Dashboardparent=snippetsparent=(none)page=edit-snippetpage=edit-snippet&id=5Verified on WordPress 7.0.4 / PHP 8.2.33 / Code Snippets 3.10.0.
Edit_Menu_Testis rewritten for the new design: the page stays reachable, the item is absent when not editing, and carries the ID when it is. All three fail without the change. PHPUnit 156, Playwright 89,lint:jsand phpcs clean.Open questions
Fixes #472