Merge branch 'trunk' into fix/59693-MMXV-fonts

src/wp-admin/admin-header.php

@@ -14,7 +14,7 @@
 /**
  * In case admin-header.php is included in a function.
  *
- * @global string    $title
+ * @global string    $title              The title of the current screen.
  * @global string    $hook_suffix
  * @global WP_Screen $current_screen     WordPress current screen object.
  * @global WP_Locale $wp_locale          WordPress date and time locale object.

src/wp-admin/edit-form-advanced.php

@@ -12,8 +12,8 @@
 }
 
 /**
- * @global string       $post_type
- * @global WP_Post_Type $post_type_object
+ * @global string       $post_type        Global post type.
+ * @global WP_Post_Type $post_type_object Global post type object.
  * @global WP_Post      $post             Global post object.
  */
 global $post_type, $post_type_object, $post;

src/wp-admin/edit-form-blocks.php

@@ -14,11 +14,11 @@
 }
 
 /**
- * @global string       $post_type
- * @global WP_Post_Type $post_type_object
+ * @global string       $post_type        Global post type.
+ * @global WP_Post_Type $post_type_object Global post type object.
  * @global WP_Post      $post             Global post object.
- * @global string       $title
- * @global array        $wp_meta_boxes
+ * @global string       $title            The title of the current screen.
+ * @global array        $wp_meta_boxes    Global meta box state.
  */
 global $post_type, $post_type_object, $post, $title, $wp_meta_boxes;
 

src/wp-admin/edit-tags.php

@@ -32,9 +32,9 @@
 }
 
 /**
- * $post_type is set when the WP_Terms_List_Table instance is created
+ * $post_type is set when the WP_Terms_List_Table instance is created.
  *
- * @global string $post_type
+ * @global string $post_type Global post type.
  */
 global $post_type;
 

src/wp-admin/edit.php

@@ -29,8 +29,8 @@
 }
 
 /**
- * @global string       $post_type
- * @global WP_Post_Type $post_type_object
+ * @global string       $post_type        Global post type.
+ * @global WP_Post_Type $post_type_object Global post type object.
  */
 global $post_type, $post_type_object;
 

src/wp-admin/includes/ajax-actions.php

@@ -192,7 +192,7 @@ function wp_ajax_wp_compression_test() {
 		if ( is_multisite() ) {
 			update_site_option( 'can_compress_scripts', 0 );
 		} else {
-			update_option( 'can_compress_scripts', 0, 'on' );
+			update_option( 'can_compress_scripts', 0, true );
 		}
 		wp_die( 0 );
 	}
@@ -231,15 +231,15 @@ function wp_ajax_wp_compression_test() {
 			if ( is_multisite() ) {
 				update_site_option( 'can_compress_scripts', 0 );
 			} else {
-				update_option( 'can_compress_scripts', 0, 'on' );
+				update_option( 'can_compress_scripts', 0, true );
 			}
 		} elseif ( 'yes' === $_GET['test'] ) {
 			check_ajax_referer( 'update_can_compress_scripts' );
 			// Use `update_option()` on single site to mark the option for autoloading.
 			if ( is_multisite() ) {
 				update_site_option( 'can_compress_scripts', 1 );
 			} else {
-				update_option( 'can_compress_scripts', 1, 'on' );
+				update_option( 'can_compress_scripts', 1, true );
 			}
 		}
 	}

src/wp-admin/includes/class-wp-posts-list-table.php

@@ -65,7 +65,7 @@ class WP_Posts_List_Table extends WP_List_Table {
 	 *
 	 * @see WP_List_Table::__construct() for more information on default arguments.
 	 *
-	 * @global WP_Post_Type $post_type_object
+	 * @global WP_Post_Type $post_type_object Global post type object.
 	 * @global wpdb         $wpdb             WordPress database abstraction object.
 	 *
 	 * @param array $args An associative array of arguments.

src/wp-admin/includes/class-wp-screen.php

@@ -984,7 +984,7 @@ public function render_screen_meta() {
 	}
 
 	/**
-	 * @global array $wp_meta_boxes
+	 * @global array $wp_meta_boxes Global meta box state.
 	 *
 	 * @return bool
 	 */
@@ -1103,7 +1103,7 @@ public function render_screen_options( $options = array() ) {
 	 *
 	 * @since 4.4.0
 	 *
-	 * @global array $wp_meta_boxes
+	 * @global array $wp_meta_boxes Global meta box state.
 	 */
 	public function render_meta_boxes_preferences() {
 		global $wp_meta_boxes;

src/wp-admin/includes/class-wp-terms-list-table.php

@@ -27,8 +27,8 @@ class WP_Terms_List_Table extends WP_List_Table {
 	 *
 	 * @see WP_List_Table::__construct() for more information on default arguments.
 	 *
-	 * @global string $post_type
-	 * @global string $taxonomy
+	 * @global string $post_type Global post type.
+	 * @global string $taxonomy  Global taxonomy.
 	 * @global string $action
 	 * @global object $tax
 	 *
@@ -330,7 +330,8 @@ private function _rows( $taxonomy, $terms, &$children, $start, $per_page, &$coun
 	}
 
 	/**
-	 * @global string $taxonomy
+	 * @global string $taxonomy Global taxonomy.
+	 *
 	 * @param WP_Term $tag   Term object.
 	 * @param int     $level
 	 */

src/wp-admin/includes/nav-menu.php

@@ -204,7 +204,7 @@ function wp_nav_menu_setup() {
  *
  * @since 3.0.0
  *
- * @global array $wp_meta_boxes
+ * @global array $wp_meta_boxes Global meta box state.
  */
 function wp_initial_nav_menu_meta_boxes() {
 	global $wp_meta_boxes;

src/wp-admin/includes/plugin.php

@@ -2030,7 +2030,7 @@ function get_admin_page_parent( $parent_page = '' ) {
  *
  * @since 1.5.0
  *
- * @global string $title
+ * @global string $title       The title of the current screen.
  * @global array  $menu
  * @global array  $submenu
  * @global string $pagenow     The filename of the current screen.

src/wp-admin/includes/post.php

@@ -2345,7 +2345,7 @@ function get_block_editor_server_block_settings() {
  *
  * @global WP_Post   $post           Global post object.
  * @global WP_Screen $current_screen WordPress current screen object.
- * @global array     $wp_meta_boxes
+ * @global array     $wp_meta_boxes  Global meta box state.
  */
 function the_block_editor_meta_boxes() {
 	global $post, $current_screen, $wp_meta_boxes;

src/wp-admin/includes/screen.php

@@ -89,7 +89,7 @@ function get_hidden_columns( $screen ) {
  *
  * @since 2.7.0
  *
- * @global array $wp_meta_boxes
+ * @global array $wp_meta_boxes Global meta box state.
  *
  * @param WP_Screen $screen
  */

src/wp-admin/includes/template.php

@@ -1050,7 +1050,7 @@ function wp_import_upload_form( $action ) {
  * @since 2.5.0
  * @since 4.4.0 The `$screen` parameter now accepts an array of screen IDs.
  *
- * @global array $wp_meta_boxes
+ * @global array $wp_meta_boxes Global meta box state.
  *
  * @param string                 $id            Meta box ID (used in the 'id' attribute for the meta box).
  * @param string                 $title         Title of the meta box.
@@ -1287,7 +1287,7 @@ function _get_plugin_from_callback( $callback ) {
  *
  * @since 2.5.0
  *
- * @global array $wp_meta_boxes
+ * @global array $wp_meta_boxes Global meta box state.
  *
  * @param string|WP_Screen $screen      The screen identifier. If you have used add_menu_page() or
  *                                      add_submenu_page() to create a new screen (and hence screen_id)
@@ -1472,7 +1472,7 @@ function do_meta_boxes( $screen, $context, $data_object ) {
  * @since 2.6.0
  * @since 4.4.0 The `$screen` parameter now accepts an array of screen IDs.
  *
- * @global array $wp_meta_boxes
+ * @global array $wp_meta_boxes Global meta box state.
  *
  * @param string                 $id      Meta box ID (used in the 'id' attribute for the meta box).
  * @param string|array|WP_Screen $screen  The screen or screens on which the meta box is shown (such as a

src/wp-admin/post-new.php

@@ -10,9 +10,9 @@
 require_once __DIR__ . '/admin.php';
 
 /**
- * @global string  $post_type
- * @global object  $post_type_object
- * @global WP_Post $post             Global post object.
+ * @global string       $post_type        Global post type.
+ * @global WP_Post_Type $post_type_object Global post type object.
+ * @global WP_Post      $post             Global post object.
  */
 global $post_type, $post_type_object, $post;
 

src/wp-admin/post.php

@@ -28,9 +28,9 @@
 $post_ID = $post_id;
 
 /**
- * @global string  $post_type
- * @global object  $post_type_object
- * @global WP_Post $post             Global post object.
+ * @global string       $post_type        Global post type.
+ * @global WP_Post_Type $post_type_object Global post type object.
+ * @global WP_Post      $post             Global post object.
  */
 global $post_type, $post_type_object, $post;
 

src/wp-includes/block-supports/block-style-variations.php

@@ -249,7 +249,7 @@ function wp_resolve_block_style_variations( $variations ) {
 		 * Block style variations read in via standalone theme.json partials
 		 * need to have their name set to the kebab case version of their title.
 		 */
-		$variation_name = $have_named_variations ? $key : _wp_to_kebab_case( $variation['title'] );
+		$variation_name = $have_named_variations ? $key : ( $variation['slug'] ?? _wp_to_kebab_case( $variation['title'] ) );
 
 		foreach ( $supported_blocks as $block_type ) {
 			// Add block style variation data under current block type.
@@ -441,7 +441,7 @@ function wp_register_block_style_variations_from_theme_json_data( $variations )
 		 * Block style variations read in via standalone theme.json partials
 		 * need to have their name set to the kebab case version of their title.
 		 */
-		$variation_name  = $have_named_variations ? $key : _wp_to_kebab_case( $variation['title'] );
+		$variation_name  = $have_named_variations ? $key : ( $variation['slug'] ?? _wp_to_kebab_case( $variation['title'] ) );
 		$variation_label = $variation['title'] ?? $variation_name;
 
 		foreach ( $supported_blocks as $block_type ) {

src/wp-includes/class-wp-duotone.php

@@ -215,7 +215,7 @@ private static function colord_parse_hue( $value, $unit = 'deg' ) {
 	}
 
 	/**
-	 * Parses any valid Hex3, Hex4, Hex6 or Hex8 string and converts it to an RGBA object
+	 * Parses any valid Hex3, Hex4, Hex6 or Hex8 string and converts it to an RGBA object.
 	 *
 	 * Direct port of colord's parseHex function.
 	 *
@@ -286,7 +286,7 @@ private static function colord_clamp_rgba( $rgba ) {
 	}
 
 	/**
-	 * Parses a valid RGB[A] CSS color function/string
+	 * Parses a valid RGB[A] CSS color function/string.
 	 *
 	 * Direct port of colord's parseRgbaString function.
 	 *

src/wp-includes/class-wp-theme-json.php

@@ -358,6 +358,7 @@ class WP_Theme_JSON {
 		'description',
 		'patterns',
 		'settings',
+		'slug',
 		'styles',
 		'templateParts',
 		'title',
@@ -3244,7 +3245,7 @@ protected static function filter_slugs( $node, $slugs ) {
 	 * @since 6.3.2 Preserves global styles block variations when securing styles.
 	 * @since 6.6.0 Updated to allow variation element styles and $origin parameter.
 	 *
-	 * @param array $theme_json Structure to sanitize.
+	 * @param array  $theme_json Structure to sanitize.
 	 * @param string $origin    Optional. What source of data this object represents.
 	 *                          One of 'blocks', 'default', 'theme', or 'custom'. Default 'theme'.
 	 * @return array Sanitized structure.

src/wp-includes/kses.php

@@ -963,6 +963,7 @@ function wp_kses_version() {
  * It also matches stray `>` characters.
  *
  * @since 1.0.0
+ * @since 6.6.0 Recognize additional forms of invalid HTML which convert into comments.
  *
  * @global array[]|string $pass_allowed_html      An array of allowed HTML elements and attributes,
  *                                                or a context name such as 'post'.
@@ -981,7 +982,18 @@ function wp_kses_split( $content, $allowed_html, $allowed_protocols ) {
 	$pass_allowed_html      = $allowed_html;
 	$pass_allowed_protocols = $allowed_protocols;
 
-	return preg_replace_callback( '%(<!--.*?(-->|$))|(<[^>]*(>|$)|>)%', '_wp_kses_split_callback', $content );
+	$token_pattern = <<<REGEX
+~
+	(                      # Detect comments of various flavors before attempting to find tags.
+		(<!--.*?(-->|$))   #  - Normative HTML comments.
+		|
+		</[^a-zA-Z][^>]*>  #  - Closing tags with invalid tag names.
+	)
+	|
+	(<[^>]*(>|$)|>)        # Tag-like spans of text.
+~x
+REGEX;
+	return preg_replace_callback( $token_pattern, '_wp_kses_split_callback', $content );
 }
 
 /**
@@ -1069,23 +1081,61 @@ function _wp_kses_split_callback( $matches ) {
  * @access private
  * @ignore
  * @since 1.0.0
+ * @since 6.6.0 Recognize additional forms of invalid HTML which convert into comments.
  *
  * @param string         $content           Content to filter.
  * @param array[]|string $allowed_html      An array of allowed HTML elements and attributes,
  *                                          or a context name such as 'post'. See wp_kses_allowed_html()
  *                                          for the list of accepted context names.
  * @param string[]       $allowed_protocols Array of allowed URL protocols.
+ *
  * @return string Fixed HTML element
  */
 function wp_kses_split2( $content, $allowed_html, $allowed_protocols ) {
 	$content = wp_kses_stripslashes( $content );
 
-	// It matched a ">" character.
+	/*
+	 * The regex pattern used to split HTML into chunks attempts
+	 * to split on HTML token boundaries. This function should
+	 * thus receive chunks that _either_ start with meaningful
+	 * syntax tokens, like a tag `<div>` or a comment `<!-- ... -->`.
+	 *
+	 * If the first character of the `$content` chunk _isn't_ one
+	 * of these syntax elements, which always starts with `<`, then
+	 * the match had to be for the final alternation of `>`. In such
+	 * case, it's probably standing on its own and could be encoded
+	 * with a character reference to remove ambiguity.
+	 *
+	 * In other words, if this chunk isn't from a match of a syntax
+	 * token, it's just a plaintext greater-than (`>`) sign.
+	 */
 	if ( ! str_starts_with( $content, '<' ) ) {
 		return '&gt;';
 	}
 
-	// Allow HTML comments.
+	/*
+	 * When a closing tag appears with a name that isn't a valid tag name,
+	 * it must be interpreted as an HTML comment. It extends until the
+	 * first `>` character after the initial opening `</`.
+	 *
+	 * Preserve these comments and do not treat them like tags.
+	 */
+	if ( 1 === preg_match( '~^</[^a-zA-Z][^>]*>$~', $content ) ) {
+		$content     = substr( $content, 2, -1 );
+		$transformed = null;
+
+		while ( $transformed !== $content ) {
+			$transformed = wp_kses( $content, $allowed_html, $allowed_protocols );
+			$content     = $transformed;
+		}
+
+		return "</{$transformed}>";
+	}
+
+	/*
+	 * Normative HTML comments should be handled separately as their
+	 * parsing rules differ from those for tags and text nodes.
+	 */
 	if ( str_starts_with( $content, '<!--' ) ) {
 		$content = str_replace( array( '<!--', '-->' ), '', $content );