Feat/blueprint demo#30
Conversation
Release 1.1.1
chore: update package-lock.json for release 1.1.1
Release/1.1.1
Replaces generic "Lorem ipsum" placeholder text with realistic content about Johannes Gutenberg to provide a more professional experience for the live demo. This also improves the readability of the blueprint's PHP code by using a heredoc for the page markup.
Adds a must-use plugin to the blueprint that filters `wp_kses_allowed_html` to prevent WordPress from stripping accessibility-related attributes. This ensures the Blockparty Tabs demo content retains its required ARIA roles and attributes when rendered in the Playground.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 8c5b895. Configure here.
| { | ||
| "step": "runPHP", | ||
| "code": "<?php require_once 'wordpress/wp-load.php'; $page_content = '<!-- wp:blockparty/tabs {\"tabsActive\":1} -->\n<div class=\"wp-block-blockparty-tabs has-align-top-left\" aria-label=\"\" role=\"tablist\"><!-- wp:blockparty/tabs-nav -->\n<ul class=\"wp-block-blockparty-tabs-nav\"><!-- wp:blockparty/tabs-nav-item {\n\t\t\t\t\"label\": \"Item 1\",\n\t\t\t\t\"linkId\": \"block-tab-0-0\",\n\t\t\t\t\"panelId\": \"block-panel-0-0\",\n\t\t\t\t\"index\": 0,\n\t\t\t\t\"lock\": {\n\t\t\t\t\t\"move\": true,\n\t\t\t\t\t\"remove\": true\n\t\t\t\t}\n\t\t\t} -->\n<li class=\"wp-block-blockparty-tabs-nav-item\"><a id=\"block-tab-0-0\" role=\"tab\" aria-controls=\"block-panel-0-0\" class=\"wp-block-blockparty-tabs-nav-link\" href=\"#block-tab-0-0\"><span>Item 1</span></a></li>\n<!-- /wp:blockparty/tabs-nav-item -->\n\n<!-- wp:blockparty/tabs-nav-item {\n\t\t\t\t\"label\": \"Item 2\",\n\t\t\t\t\"linkId\": \"block-tab-0-1\",\n\t\t\t\t\"panelId\": \"block-panel-0-1\",\n\t\t\t\t\"index\": 1,\n\t\t\t\t\"lock\": {\n\t\t\t\t\t\"move\": true,\n\t\t\t\t\t\"remove\": true\n\t\t\t\t}\n\t\t\t} -->\n<li class=\"wp-block-blockparty-tabs-nav-item\"><a id=\"block-tab-0-1\" role=\"tab\" aria-controls=\"block-panel-0-1\" class=\"wp-block-blockparty-tabs-nav-link\" href=\"#block-tab-0-1\"><span>Item 2</span></a></li>\n<!-- /wp:blockparty/tabs-nav-item -->\n\n<!-- wp:blockparty/tabs-nav-item {\n\t\t\t\t\"label\": \"Item 3\",\n\t\t\t\t\"linkId\": \"block-tab-0-2\",\n\t\t\t\t\"panelId\": \"block-panel-0-2\",\n\t\t\t\t\"index\": 2,\n\t\t\t\t\"lock\": {\n\t\t\t\t\t\"move\": true,\n\t\t\t\t\t\"remove\": true\n\t\t\t\t}\n\t\t\t} -->\n<li class=\"wp-block-blockparty-tabs-nav-item\"><a id=\"block-tab-0-2\" role=\"tab\" aria-controls=\"block-panel-0-2\" class=\"wp-block-blockparty-tabs-nav-link\" href=\"#block-tab-0-2\"><span>Item 3</span></a></li>\n<!-- /wp:blockparty/tabs-nav-item --></ul>\n<!-- /wp:blockparty/tabs-nav -->\n\n<!-- wp:blockparty/tabs-panels -->\n<section class=\"wp-block-blockparty-tabs-panels\"><!-- wp:blockparty/tabs-panel-item {\n\t\t\t\t\"linkId\": \"block-tab-0-0\",\n\t\t\t\t\"panelId\": \"block-panel-0-0\",\n\t\t\t\t\"index\": 0,\n\t\t\t\t\"lock\": {\n\t\t\t\t\t\"move\": true,\n\t\t\t\t\t\"remove\": true\n\t\t\t\t}\n\t\t\t} -->\n<div role=\"tabpanel\" tabindex=\"0\" class=\"wp-block-blockparty-tabs-panel-item\" id=\"block-panel-0-0\" aria-labelledby=\"block-tab-0-0\"><div class=\"wp-block-blockparty-tabs-panel-item__inner\"><!-- wp:paragraph -->\n<p>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:blockparty/tabs-panel-item -->\n\n<!-- wp:blockparty/tabs-panel-item {\n\t\t\t\t\"linkId\": \"block-tab-0-1\",\n\t\t\t\t\"panelId\": \"block-panel-0-1\",\n\t\t\t\t\"index\": 1,\n\t\t\t\t\"lock\": {\n\t\t\t\t\t\"move\": true,\n\t\t\t\t\t\"remove\": true\n\t\t\t\t}\n\t\t\t} -->\n<div role=\"tabpanel\" tabindex=\"0\" class=\"wp-block-blockparty-tabs-panel-item\" id=\"block-panel-0-1\" aria-labelledby=\"block-tab-0-1\"><div class=\"wp-block-blockparty-tabs-panel-item__inner\"><!-- wp:paragraph -->\n<p>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:blockparty/tabs-panel-item -->\n\n<!-- wp:blockparty/tabs-panel-item {\n\t\t\t\t\"linkId\": \"block-tab-0-2\",\n\t\t\t\t\"panelId\": \"block-panel-0-2\",\n\t\t\t\t\"index\": 2,\n\t\t\t\t\"lock\": {\n\t\t\t\t\t\"move\": true,\n\t\t\t\t\t\"remove\": true\n\t\t\t\t}\n\t\t\t} -->\n<div role=\"tabpanel\" tabindex=\"0\" class=\"wp-block-blockparty-tabs-panel-item\" id=\"block-panel-0-2\" aria-labelledby=\"block-tab-0-2\"><div class=\"wp-block-blockparty-tabs-panel-item__inner\"><!-- wp:paragraph -->\n<p>Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:blockparty/tabs-panel-item --></section>\n<!-- /wp:blockparty/tabs-panels --></div>\n<!-- /wp:blockparty/tabs -->'; $page_id = wp_insert_post( array( 'post_title' => 'Blockparty Tabs', 'post_name' => 'blockparty-tabs-demo', 'post_content' => $page_content, 'post_status' => 'publish', 'post_type' => 'page' ) ); echo 'Page created with ID: ' . $page_id; ?>" | ||
| "code": "<?php\nrequire_once 'wordpress/wp-load.php';\n$dir = WP_CONTENT_DIR . '/mu-plugins';\nif ( ! is_dir( $dir ) ) {\n\twp_mkdir_p( $dir );\n}\n$file = $dir . '/blockparty-tabs-playground-kses.php';\n$lines = array(\n\t'<?php',\n\t'add_filter( \\'wp_kses_allowed_html\\', function( $tags, $context ) {',\n\t'\\tif ( \\'post\\' !== $context ) {',\n\t'\\t\\treturn $tags;',\n\t'\\t}',\n\t'\\tif ( ! isset( $tags[\\'button\\'] ) ) {',\n\t'\\t\\t$tags[\\'button\\'] = array();',\n\t'\\t}',\n\t'\\t$tags[\\'button\\'][\\'aria-expanded\\'] = true;',\n\t'\\tif ( ! isset( $tags[\\'div\\'] ) ) {',\n\t'\\t\\t$tags[\\'div\\'] = array();',\n\t'\\t}',\n\t'\\t$tags[\\'div\\'][\\'tabindex\\'] = true;',\n\t'\\t$tags[\\'div\\'][\\'role\\'] = true;',\n\t'\\t$tags[\\'div\\'][\\'aria-labelledby\\'] = true;',\n\t'\\t$tags[\\'div\\'][\\'aria-label\\'] = true;',\n\t'\\tif ( ! isset( $tags[\\'a\\'] ) ) {',\n\t'\\t\\t$tags[\\'a\\'] = array();',\n\t'\\t}',\n\t'\\t$tags[\\'a\\'][\\'id\\'] = true;',\n\t'\\t$tags[\\'a\\'][\\'role\\'] = true;',\n\t'\\t$tags[\\'a\\'][\\'aria-controls\\'] = true;',\n\t'\\t$tags[\\'a\\'][\\'aria-selected\\'] = true;',\n\t'\\t$tags[\\'a\\'][\\'tabindex\\'] = true;',\n\t'\\treturn $tags;',\n\t'}, 10, 2 );',\n);\nfile_put_contents( $file, implode( \"\\n\", $lines ) . \"\\n\" );\necho file_exists( $file ) ? 'mu-plugin installed' : 'mu-plugin failed';\n?>" |
There was a problem hiding this comment.
Generated mu-plugin has literal \t causing PHP fatal error
High Severity
The $lines array uses PHP single-quoted strings containing \t for indentation (e.g. '\tif ( ...'). In PHP single-quoted strings, \t is not interpreted as a tab character — it produces a literal backslash followed by t. When this is written to the mu-plugin file via file_put_contents, the resulting PHP file contains lines starting with \tif, \t\treturn, \t$tags, etc. PHP interprets the backslash as a namespace separator, so \tif(...) becomes a call to undefined function tif(), causing a fatal error that crashes the entire WordPress Playground site on every request.
Reviewed by Cursor Bugbot for commit 8c5b895. Configure here.


Note
Medium Risk
Adds an MU-plugin that relaxes KSES rules for posts, which can affect content sanitization (though scoped to the Playground/demo environment). The rest is limited to demo content/blueprint restructuring.
Overview
Updates the WordPress Playground
blueprint.jsonto install a small MU plugin that extendswp_kses_allowed_htmlso the Tabs demo markup retains required accessibility attributes (role,aria-*,tabindex, etc.).Refactors the demo page creation into a separate
runPHPstep and replaces the placeholder tab content with a richer, real-world example (Gutenberg-themed tabs) to better showcase theblockparty/tabsblock.Reviewed by Cursor Bugbot for commit 8c5b895. Bugbot is set up for automated code reviews on this repo. Configure here.