From e8704ab4a085b182b9f90f5f387492145bf63360 Mon Sep 17 00:00:00 2001
From: KokkieH <KokkieH@users.noreply.github.com>
Date: Thu, 10 Sep 2026 16:50:04 +0200
Subject: [PATCH] PHPUnit Test Reporter: Improve single result rendering

- Render the report after the content shortcode pass
- Escape the parent changeset title, consistent with the sibling templates

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../plugins/phpunit-test-reporter/parts/single-result.php | 2 +-
 .../phpunit-test-reporter/phpunit-test-reporter.php       | 8 +++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/wordpress.org/public_html/wp-content/plugins/phpunit-test-reporter/parts/single-result.php b/wordpress.org/public_html/wp-content/plugins/phpunit-test-reporter/parts/single-result.php
index cfb06077b4..4c8955d73c 100644
--- a/wordpress.org/public_html/wp-content/plugins/phpunit-test-reporter/parts/single-result.php
+++ b/wordpress.org/public_html/wp-content/plugins/phpunit-test-reporter/parts/single-result.php
@@ -36,7 +36,7 @@
 $parent = get_post( $report->post_parent );
 if ( $parent ) :
 	?>
-<p><a href="<?php echo esc_url( get_permalink( $parent ) ); ?>">&larr; <?php echo esc_html( $parent->post_name ) . ': ' . apply_filters( 'the_title', get_the_title( $parent ) ); ?></a></p>
+<p><a href="<?php echo esc_url( get_permalink( $parent ) ); ?>">&larr; <?php echo esc_html( $parent->post_name ) . ': ' . esc_html( $parent->post_title ); ?></a></p>
 <?php endif; ?>
 
 <p><a href="<?php echo esc_url( get_permalink( $report->ID ) ); ?>" title="<?php echo esc_attr( $status_title ); ?>" class="<?php echo esc_attr( 'ptr-status-badge ptr-status-badge-' . strtolower( $status ) ); ?>"><?php echo esc_html( $status ); ?></a></p>
diff --git a/wordpress.org/public_html/wp-content/plugins/phpunit-test-reporter/phpunit-test-reporter.php b/wordpress.org/public_html/wp-content/plugins/phpunit-test-reporter/phpunit-test-reporter.php
index 37baf96cc9..02c06248d2 100644
--- a/wordpress.org/public_html/wp-content/plugins/phpunit-test-reporter/phpunit-test-reporter.php
+++ b/wordpress.org/public_html/wp-content/plugins/phpunit-test-reporter/phpunit-test-reporter.php
@@ -27,7 +27,13 @@
 add_action( 'get_post_metadata', array( 'PTR\Display', 'filter_get_post_metadata' ), 10, 4 );
 add_action( 'body_class', array( 'PTR\Display', 'filter_body_class' ) );
 add_action( 'post_class', array( 'PTR\Display', 'filter_post_class' ) );
-add_action( 'the_content', array( 'PTR\Display', 'filter_the_content' ) );
+// This callback discards its $content input and returns a freshly rendered report,
+// so it must run after every shortcode-parsing pass or that generated markup — which
+// contains esc_html'd, submitter-controlled data — gets fed back to the parser.
+// Core's do_shortcode is at priority 11; a late priority (99) also runs after any
+// third-party shortcode filter registered above that. add_filter (not add_action) as
+// the returned value is used.
+add_filter( 'the_content', array( 'PTR\Display', 'filter_the_content' ), 99 );
 add_action( 'rest_api_init', array( 'PTR\RestAPI', 'register_routes' ) );
 add_action( 'load-edit.php', 'ptr_load_edit_php' );