Repository navigation
Notes: mention notification emails are missing the fixes made during the Core review #81186
Description
Description
The note @mention notification landed in WordPress Core as https://core.trac.wordpress.org/changeset/63012, and the review on that patch turned up a handful of bugs in the email composition. The plugin still ships the version those fixes were made against, in lib/compat/wordpress-7.1/notes-mentions.php.
This matters more than a normal "core caught up with the plugin" gap, because that file deliberately removes Core's wp_notify_note_mentions() from rest_insert_comment and registers its own copy instead:
gutenberg/lib/compat/wordpress-7.1/notes-mentions.php
Lines 139 to 149 in a74e27c
So on WordPress 7.1 with Gutenberg active, the plugin's copy is the one that runs, and these are the emails users actually get.
The issues
1. The editor link is built for the sender, not the recipient.
get_edit_post_link() answers for whoever is the current user. Everything else in that function is composed for the recipient (switch_to_user_locale() a few lines up), but this is evaluated as the note's author over REST. Under WP-Cron there is no current user at all, so it returns an empty string and the email goes out with no link.
2. The subject is decoded twice. $blogname is decoded on assignment and then the whole assembled subject is decoded again at the wp_mail() call. A site or post title where the author meant & to be read literally gets flattened.
3. Note content is decoded before its tags are stripped.
Decoding first turns escaped text like <code> into a real tag, which wp_strip_all_tags() then removes, so that text disappears from the message body.
4. No Content-Type header. Nothing is passed to wp_mail(), so its default applies and a filter could turn the message into HTML. Core sends Content-Type: text/plain; charset=<blog_charset> here, matching wp_notify_postauthor().
5. A null comment is fatal.
WP_REST_Comments_Controller does $comment = get_comment( $comment_id ) and passes the result straight into do_action( 'rest_insert_comment', ... ). If the comment is gone by then that is null, and the non-nullable WP_Comment type hint turns it into a TypeError. Unlikely to happen, but it is the plugin's own type hint that makes it fatal rather than harmless - Core widened the parameter to ?WP_Comment and guards.
6. A comment_post_ID of 0 picks up the global post.
get_post() treats 0 as empty and substitutes $GLOBALS['post'], so a note with no post would compose the email about whatever post happened to be in scope.
There is also a small formatting difference: Core labels the link Edit This: <url> where the plugin emits a bare URL, so the email changes shape depending on whether the plugin is active. Worth aligning while we are in here.
Related
- https://core.trac.wordpress.org/ticket/65639 - the Core ticket
- https://core.trac.wordpress.org/changeset/63012 - the Core changeset these fixes come from
- Comments: Notify users mentioned in a note wordpress-develop#12548 - the Core PR, where @westonruter's review turned up items 1, 4, 5 and 6
- Notes: Email users mentioned in a note #79606 - the original mention notification PR
Activity