From 45ffa2fae4a7a79f17d78e4e206bdc5d9a6f16ef Mon Sep 17 00:00:00 2001 From: Khokan Sardar Date: Tue, 23 Jun 2026 08:47:03 +0530 Subject: [PATCH] Script Loader: Prevent strict mode leaking into concatenated scripts. Since [22294], `wp-includes/js/dist/hooks.js` is built with esbuild, whose output begins with a top-level `"use strict";` directive. When admin script concatenation is enabled, `load-scripts.php` appends the requested files one after another, with `wp-hooks` first in the chunk. That leading directive becomes the directive prologue for the whole concatenated file, forcing every legacy, non-strict script bundled afterwards (such as ThickBox) to run in strict mode. There, ThickBox's implicit global assignments throw `ReferenceError: imgLoader is not defined`, leaving the modal stuck on the overlay (for example when clicking "View details" on the Plugins screen). Begin the concatenated output with an empty statement so that a leading `"use strict";` is no longer the first statement and is evaluated as a harmless expression instead of enabling strict mode for the entire file. This restores the pre-7.0 behaviour, where concatenated admin scripts ran in sloppy mode, and fixes every non-strict bundled script at once rather than only the first implicit global that happens to throw. Fixes #65515. --- src/wp-admin/load-scripts.php | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/src/wp-admin/load-scripts.php b/src/wp-admin/load-scripts.php index e4b6a1ee5b918..74e1e1f030369 100644 --- a/src/wp-admin/load-scripts.php +++ b/src/wp-admin/load-scripts.php @@ -45,7 +45,22 @@ require ABSPATH . WPINC . '/version.php'; $expires_offset = 31536000; // 1 year. -$out = ''; + +/* + * Begin the concatenated output with an empty statement. + * + * The concatenated files are appended one after another, so a "use strict" + * directive at the very top of the first bundled script (for example the + * one shipped in wp-includes/js/dist/hooks.js) would be treated as the + * directive prologue for the entire file. That would force every legacy, + * non-strict script bundled afterwards (such as ThickBox) to run in strict + * mode, where implicit global assignments throw a ReferenceError. + * + * Prepending an empty statement ensures any later "use strict" string is no + * longer the first statement, so it is evaluated as a harmless expression + * rather than enabling strict mode for the whole concatenated file. + */ +$out = ";\n"; $wp_scripts = new WP_Scripts(); wp_default_scripts( $wp_scripts );