Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions includes/Blocks/SharedBlock.php
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,8 @@ public function render_callback( $attributes, $content, $block ): string {

// When displaying full content, just return the rendered content.
if ( 'full' === $display ) {
$this->enqueue_embedded_block_assets( $block_data['html'] );

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skip dependencies filter bypassed

Medium Severity

enqueue_embedded_block_assets runs before multisite_shared_block_skip_block_dependencies is applied, so assets are always enqueued even when that filter returns true. The existing dependency path still honors the filter, so behavior is now inconsistent and the documented opt-out no longer fully works.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 11c6a3c. Configure here.


/**
* Filters if dependencies for the blocks contain in the shared block should be enqueued or not on
* the current site.
Expand Down Expand Up @@ -330,6 +332,49 @@ private function get_rendered_block( int $site_id, int $post_id, string $block_i
return $block_data;
}

/**
* Enqueue assets for blocks present in shared HTML.
* This is necessary to ensure that the blocks are styled correctly in the consumer page.
*
* Also enqueues view script modules (`viewScriptModule` / `view_script_module_ids`).
*
* @param string $html Rendered shared block HTML.
*
* @return void
* @author Jules Fell
*/
private function enqueue_embedded_block_assets( string $html ): void {
if ( '' === $html ) {
return;
}

foreach ( \WP_Block_Type_Registry::get_instance()->get_all_registered() as $block_type ) {
if ( empty( $block_type->name ) ) {
continue;
}

// Convert block name to class name.
// For example: core/media-text → wp-block-media-text ; beapi/icon-block → wp-block-beapi-icon-block
$block_class = 'wp-block-' . preg_replace( '/^core-/', '', str_replace( '/', '-', $block_type->name ) );

if ( ! str_contains( $html, $block_class ) ) {
continue;
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreliable HTML block detection

Medium Severity

Block presence is inferred with str_contains on generated wp-block-* class names instead of the accurate use_block_types list already returned by the renderer. Substring matches cause false positives such as wp-block-column inside wp-block-columns, and blocks without the default classname are missed, so view scripts or styles may not load.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 11c6a3c. Configure here.


foreach ( (array) ( $block_type->style_handles ?? [] ) as $handle ) {
wp_enqueue_style( $handle );
}

foreach ( (array) ( $block_type->view_script_handles ?? [] ) as $handle ) {
wp_enqueue_script( $handle );
}

foreach ( (array) ( $block_type->view_script_module_ids ?? [] ) as $module_id ) {
wp_enqueue_script_module( $module_id );
}
}
}

/**
* Make excerpt from block's html content.
*
Expand Down
Loading