Merge pull request #21108 from woocommerce/fix/21025

Set tabindex=1 for notices

includes/wc-cart-functions.php

@@ -118,9 +118,9 @@ function wc_add_to_cart_message( $products, $show_qty = false, $return = false )
 	// Output success messages.
 	if ( 'yes' === get_option( 'woocommerce_cart_redirect_after_add' ) ) {
 		$return_to = apply_filters( 'woocommerce_continue_shopping_redirect', wc_get_raw_referer() ? wp_validate_redirect( wc_get_raw_referer(), false ) : wc_get_page_permalink( 'shop' ) );
-		$message   = sprintf( '<a href="%s" class="button wc-forward">%s</a> %s', esc_url( $return_to ), esc_html__( 'Continue shopping', 'woocommerce' ), esc_html( $added_text ) );
+		$message   = sprintf( '<a href="%s" tabindex="1" class="button wc-forward">%s</a> %s', esc_url( $return_to ), esc_html__( 'Continue shopping', 'woocommerce' ), esc_html( $added_text ) );
 	} else {
-		$message = sprintf( '<a href="%s" class="button wc-forward">%s</a> %s', esc_url( wc_get_page_permalink( 'cart' ) ), esc_html__( 'View cart', 'woocommerce' ), esc_html( $added_text ) );
+		$message = sprintf( '<a href="%s" tabindex="1" class="button wc-forward">%s</a> %s', esc_url( wc_get_page_permalink( 'cart' ) ), esc_html__( 'View cart', 'woocommerce' ), esc_html( $added_text ) );
 	}
 
 	if ( has_filter( 'wc_add_to_cart_message' ) ) {

includes/wc-notice-functions.php

@@ -144,7 +144,7 @@ function wc_print_notices( $return = false ) {
 
 	wc_clear_notices();
 
-	$notices = wp_kses_post( ob_get_clean() );
+	$notices = wc_kses_notice( ob_get_clean() );
 
 	if ( $return ) {
 		return $notices;
@@ -208,3 +208,23 @@ function wc_add_wp_error_notices( $errors ) {
 		}
 	}
 }
+
+/**
+ * Filters out the same tags as wp_kses_post, but allows tabindex for <a> element.
+ *
+ * @since 3.5.0
+ * @param string $message Content to filter through kses.
+ * @return string
+ */
+function wc_kses_notice( $message ) {
+	return wp_kses( $message,
+		array_replace_recursive( // phpcs:ignore PHPCompatibility.PHP.NewFunctions.array_replace_recursiveFound
+			wp_kses_allowed_html( 'post' ),
+			array(
+				'a' => array(
+					'tabindex' => true,
+				),
+			)
+		)
+	);
+}

includes/wc-template-functions.php

@@ -237,11 +237,8 @@ function woocommerce_product_loop() {
 /**
  * Output generator tag to aid debugging.
  *
- * @access public
- *
  * @param string $gen Generator.
  * @param string $type Type.
- *
  * @return string
  */
 function wc_generator_tag( $gen, $type ) {

phpcs.xml

@@ -49,7 +49,7 @@
 	</rule>
 	<rule ref="WordPress.XSS.EscapeOutput">
 		<properties>
-			<property name="customEscapingFunctions" type="array" value="wc_help_tip,wc_sanitize_tooltip,wc_selected" />
+			<property name="customEscapingFunctions" type="array" value="wc_help_tip,wc_sanitize_tooltip,wc_selected,wc_kses_notice" />
 		</properties>
 	</rule>
 	<rule ref="WordPress.WP.I18n">

templates/notices/error.php

@@ -10,10 +10,9 @@
  * happen. When this occurs the version of the template file will be bumped and
  * the readme will list any important changes.
  *
- * @see 	    https://docs.woocommerce.com/document/template-structure/
+ * @see         https://docs.woocommerce.com/document/template-structure/
- * @author 		WooThemes
+ * @package     WooCommerce/Templates
- * @package 	WooCommerce/Templates
+ * @version     3.5.0
- * @version     3.3.0
  */
 
 if ( ! defined( 'ABSPATH' ) ) {
@@ -27,6 +26,10 @@ if ( ! $messages ) {
 ?>
 <ul class="woocommerce-error" role="alert">
 	<?php foreach ( $messages as $message ) : ?>
-		<li><?php echo wp_kses_post( $message ); ?></li>
+		<li>
+			<?php
+				echo wc_kses_notice( $message );
+			?>
+		</li>
 	<?php endforeach; ?>
 </ul>

templates/notices/notice.php

@@ -10,14 +10,13 @@
  * happen. When this occurs the version of the template file will be bumped and
  * the readme will list any important changes.
  *
- * @see 	    https://docs.woocommerce.com/document/template-structure/
+ * @see         https://docs.woocommerce.com/document/template-structure/
- * @author 		WooThemes
+ * @package     WooCommerce/Templates
- * @package 	WooCommerce/Templates
+ * @version     3.5.0
- * @version     1.6.4
  */
 
 if ( ! defined( 'ABSPATH' ) ) {
-	exit; // Exit if accessed directly
+	exit; // Exit if accessed directly.
 }
 
 if ( ! $messages ) {
@@ -27,5 +26,9 @@ if ( ! $messages ) {
 ?>
 
 <?php foreach ( $messages as $message ) : ?>
-	<div class="woocommerce-info"><?php echo wp_kses_post( $message ); ?></div>
+	<div class="woocommerce-info">
+		<?php
+			echo wc_kses_notice( $message );
+		?>
+	</div>
 <?php endforeach; ?>

templates/notices/success.php

@@ -10,10 +10,9 @@
  * happen. When this occurs the version of the template file will be bumped and
  * the readme will list any important changes.
  *
- * @see 	    https://docs.woocommerce.com/document/template-structure/
+ * @see         https://docs.woocommerce.com/document/template-structure/
- * @author 		WooThemes
+ * @package     WooCommerce/Templates
- * @package 	WooCommerce/Templates
+ * @version     3.5.0
- * @version     3.3.0
  */
 
 if ( ! defined( 'ABSPATH' ) ) {
@@ -27,5 +26,9 @@ if ( ! $messages ) {
 ?>
 
 <?php foreach ( $messages as $message ) : ?>
-	<div class="woocommerce-message" role="alert"><?php echo wp_kses_post( $message ); ?></div>
+	<div class="woocommerce-message" role="alert">
+		<?php
+			echo wc_kses_notice( $message );
+		?>
+	</div>
 <?php endforeach; ?>

tests/unit-tests/cart/functions.php

@@ -161,21 +161,21 @@ class WC_Tests_Cart_Functions extends WC_Unit_Test_Case {
 		$product = WC_Helper_Product::create_simple_product();
 
 		$message = wc_add_to_cart_message( array( $product->get_id() => 1 ), false, true );
-		$this->assertEquals( '<a href="http://example.org" class="button wc-forward">View cart</a> &ldquo;Dummy Product&rdquo; has been added to your cart.', $message );
+		$this->assertEquals( '<a href="http://example.org" tabindex="1" class="button wc-forward">View cart</a> &ldquo;Dummy Product&rdquo; has been added to your cart.', $message );
 
 		$message = wc_add_to_cart_message( array( $product->get_id() => 3 ), false, true );
-		$this->assertEquals( '<a href="http://example.org" class="button wc-forward">View cart</a> &ldquo;Dummy Product&rdquo; has been added to your cart.', $message );
+		$this->assertEquals( '<a href="http://example.org" tabindex="1" class="button wc-forward">View cart</a> &ldquo;Dummy Product&rdquo; has been added to your cart.', $message );
 
 		$message = wc_add_to_cart_message( array( $product->get_id() => 1 ), true, true );
-		$this->assertEquals( '<a href="http://example.org" class="button wc-forward">View cart</a> &ldquo;Dummy Product&rdquo; has been added to your cart.', $message );
+		$this->assertEquals( '<a href="http://example.org" tabindex="1" class="button wc-forward">View cart</a> &ldquo;Dummy Product&rdquo; has been added to your cart.', $message );
 
 		$message = wc_add_to_cart_message( array( $product->get_id() => 3 ), true, true );
-		$this->assertEquals( '<a href="http://example.org" class="button wc-forward">View cart</a> 3 &times; &ldquo;Dummy Product&rdquo; have been added to your cart.', $message );
+		$this->assertEquals( '<a href="http://example.org" tabindex="1" class="button wc-forward">View cart</a> 3 &times; &ldquo;Dummy Product&rdquo; have been added to your cart.', $message );
 
 		$message = wc_add_to_cart_message( $product->get_id(), false, true );
-		$this->assertEquals( '<a href="http://example.org" class="button wc-forward">View cart</a> &ldquo;Dummy Product&rdquo; has been added to your cart.', $message );
+		$this->assertEquals( '<a href="http://example.org" tabindex="1" class="button wc-forward">View cart</a> &ldquo;Dummy Product&rdquo; has been added to your cart.', $message );
 
 		$message = wc_add_to_cart_message( $product->get_id(), true, true );
-		$this->assertEquals( '<a href="http://example.org" class="button wc-forward">View cart</a> &ldquo;Dummy Product&rdquo; has been added to your cart.', $message );
+		$this->assertEquals( '<a href="http://example.org" tabindex="1" class="button wc-forward">View cart</a> &ldquo;Dummy Product&rdquo; has been added to your cart.', $message );
 	}
 }