Commit 01047dfc22 for wordpress.org

commit 01047dfc225e7a3667c5056506eab3dfdf5fd69f
Author: westonruter <westonruter@git.wordpress.org>
Date:   Tue Sep 22 22:04:49 2026 +0000

    Administration: Use script helper for list table JS vars.

    Print the inline scripts in `WP_List_Table::_js_vars()` and `WP_Themes_List_Table::_js_vars()` via `wp_print_inline_script_tag()` instead of manually constructing `SCRIPT` tags with `printf()`. This allows attributes to be added via the `wp_inline_script_attributes` filter, such as a nonce needed to opt in to a Strict Content Security Policy. This affects the Comments screen, the Activity dashboard widget, and the Comments meta box on the post edit screen. The `list_args` global is now also declared with `var` so that the assignment remains valid in strict mode.

    Developed in https://github.com/WordPress/wordpress-develop/pull/13646.
    Follow-up to r56687, r63481, r63545.

    Props sjackson0109, westonruter.
    See #59446.

    Built from https://develop.svn.wordpress.org/trunk@63878


    git-svn-id: http://core.svn.wordpress.org/trunk@63050 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-admin/includes/class-wp-list-table.php b/wp-admin/includes/class-wp-list-table.php
index 13e61014d6..2792b4b3ec 100644
--- a/wp-admin/includes/class-wp-list-table.php
+++ b/wp-admin/includes/class-wp-list-table.php
@@ -1922,6 +1922,8 @@ class WP_List_Table {
 	 * Sends required variables to JavaScript land.
 	 *
 	 * @since 3.1.0
+	 * @since 7.2.0 Prints the script through wp_print_inline_script_tag() so it can carry
+	 *              attributes, such as a per-request nonce, added via wp_inline_script_attributes.
 	 */
 	public function _js_vars() {
 		$args = array(
@@ -1932,6 +1934,8 @@ class WP_List_Table {
 			),
 		);

-		printf( "<script>list_args = %s;</script>\n", wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
+		wp_print_inline_script_tag(
+			sprintf( 'var list_args = %s;', wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) )
+		);
 	}
 }
diff --git a/wp-admin/includes/class-wp-themes-list-table.php b/wp-admin/includes/class-wp-themes-list-table.php
index 0e9a0fe8b9..518b786f62 100644
--- a/wp-admin/includes/class-wp-themes-list-table.php
+++ b/wp-admin/includes/class-wp-themes-list-table.php
@@ -340,6 +340,8 @@ class WP_Themes_List_Table extends WP_List_Table {
 	 * Send required variables to JavaScript land
 	 *
 	 * @since 3.4.0
+	 * @since 7.2.0 Prints the script through wp_print_inline_script_tag() so it can carry
+	 *              attributes, such as a per-request nonce, added via wp_inline_script_attributes.
 	 *
 	 * @param array $extra_args
 	 */
@@ -357,7 +359,9 @@ class WP_Themes_List_Table extends WP_List_Table {
 			$args = array_merge( $args, $extra_args );
 		}

-		printf( "<script>var theme_list_args = %s;</script>\n", wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) );
+		wp_print_inline_script_tag(
+			sprintf( 'var theme_list_args = %s;', wp_json_encode( $args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) )
+		);
 		parent::_js_vars();
 	}
 }
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 8f875c49c3..848aa544b8 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-alpha-63877';
+$wp_version = '7.2-alpha-63878';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.