From 1432f4006afde09f9e0e3005d56972092089fbaf Mon Sep 17 00:00:00 2001
From: tin <thanhtinpk092007@gmail.com>
Date: Fri, 4 Sep 2026 09:45:50 +0700
Subject: [PATCH 1/3] Admin: wrap remaining one-liner inline scripts in
 wp_print_inline_script_tag()

Three raw <script> tags remain in admin pages that print one-liners:

- admin-footer.php: the wpOnload() trigger printed at the end of every
  admin screen. Mirrors the iframe_footer() migration.
- install.php: the weblog title focus() helper (non-mobile) and the
  hide-if-no-js class removal.
- async-upload.php: the upload-error speak-and-dismiss handler. The
  manually assembled <script> echo becomes sprintf() through
  wp_print_inline_script_tag(); the button id is now passed through
  wp_json_encode() instead of raw interpolation.

Under a Content Security Policy that only allows nonce'd scripts, each
of these raw tags was blocked, breaking wpOnload callbacks on every
admin screen, the installer's title focus, and the upload error
dismissal.

Follows the patterns established in r60909 / r60913 and PR #13319, for
the CSP rollout discussed in Trac #59446.
---
 src/wp-admin/admin-footer.php | 10 +++++++++-
 src/wp-admin/async-upload.php | 10 +++++++++-
 src/wp-admin/install.php      | 24 ++++++++++++++++--------
 3 files changed, 34 insertions(+), 10 deletions(-)

diff --git a/src/wp-admin/admin-footer.php b/src/wp-admin/admin-footer.php
index fef0c06bbf725..32f24e536e599 100644
--- a/src/wp-admin/admin-footer.php
+++ b/src/wp-admin/admin-footer.php
@@ -114,6 +114,14 @@
 ?>
 
 <div class="clear"></div></div><!-- wpwrap -->
-<script>if(typeof wpOnload==='function')wpOnload();</script>
+<?php
+wp_print_inline_script_tag(
+	<<<'JS'
+	if ( typeof wpOnload === 'function' ) {
+		wpOnload();
+	}
+	JS
+);
+?>
 </body>
 </html>
diff --git a/src/wp-admin/async-upload.php b/src/wp-admin/async-upload.php
index 5fbdd370c5c1a..f39bbe5f57420 100644
--- a/src/wp-admin/async-upload.php
+++ b/src/wp-admin/async-upload.php
@@ -145,7 +145,15 @@
 		$_FILES['async-upload']['name']
 	);
 
-	echo '<script>_.delay(function() {wp.a11y.speak(' . wp_json_encode( $speak_message, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ) . ");}, 1500);jQuery( 'button#{$button_unique_id}' ).on( 'click', function() {jQuery(this).parents('div.media-item').slideUp(200, function(){jQuery(this).remove();wp.a11y.speak( wp.i18n.__( 'Error dismissed.' ) );jQuery( '#plupload-browse-button' ).trigger( 'focus' );})});</script>\n";
+	wp_print_inline_script_tag(
+		sprintf(
+			<<<'JS'
+_.delay(function() {wp.a11y.speak(%s);}, 1500);jQuery( %s ).on( 'click', function() {jQuery(this).parents('div.media-item').slideUp(200, function(){jQuery(this).remove();wp.a11y.speak( wp.i18n.__( 'Error dismissed.' ) );jQuery( '#plupload-browse-button' ).trigger( 'focus' );})});
+JS,
+			wp_json_encode( $speak_message, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
+			wp_json_encode( 'button#' . $button_unique_id )
+		)
+	);
 	exit;
 }
 
diff --git a/src/wp-admin/install.php b/src/wp-admin/install.php
index b6b7a08f2a5aa..c07fc16194add 100644
--- a/src/wp-admin/install.php
+++ b/src/wp-admin/install.php
@@ -470,17 +470,25 @@ function display_setup_form( $error = null ) {
 }
 
 if ( ! wp_is_mobile() ) {
-	?>
-<script>var t = document.getElementById('weblog_title'); if (t){ t.focus(); }</script>
-	<?php
+	wp_print_inline_script_tag(
+		<<<'JS'
+		var t = document.getElementById( 'weblog_title' );
+		if ( t ) {
+			t.focus();
+		}
+		JS
+	);
 }
 
 wp_print_scripts( $scripts_to_print );
+
+wp_print_inline_script_tag(
+	<<<'JS'
+	jQuery( function( $ ) {
+		$( '.hide-if-no-js' ).removeClass( 'hide-if-no-js' );
+	} );
+	JS
+);
 ?>
-<script>
-jQuery( function( $ ) {
-	$( '.hide-if-no-js' ).removeClass( 'hide-if-no-js' );
-} );
-</script>
 </body>
 </html>

From c41207361c35a3dbd0bd7617cd963abbe2ad5116 Mon Sep 17 00:00:00 2001
From: tin <thanhtinpk092007@gmail.com>
Date: Sat, 5 Sep 2026 08:45:46 +0700
Subject: [PATCH 2/3] Admin: refactor async-upload error script per review
 feedback

Apply westonruter's suggestion from PR review: extract the inline JS
into a $js_function heredoc with proper indentation and WordPress JS
formatting, then pass it through sprintf( '( %s )( %s )' ) with the
speak message and button selector bundled into a single
wp_json_encode() object. Eliminates the sprintf placeholders inside
the JS body that were flagged as a syntax error, and matches the
coding standards for indentation and jQuery chaining.
---
 src/wp-admin/async-upload.php | 30 +++++++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/src/wp-admin/async-upload.php b/src/wp-admin/async-upload.php
index f39bbe5f57420..ba983b6c163f3 100644
--- a/src/wp-admin/async-upload.php
+++ b/src/wp-admin/async-upload.php
@@ -145,13 +145,33 @@
 		$_FILES['async-upload']['name']
 	);
 
+	$js_function = <<<'JS'
+		( { speakMessage, buttonSelector } ) => {
+			_.delay( function () {
+				wp.a11y.speak( speakMessage );
+			}, 1500 );
+			jQuery( buttonSelector ).on( 'click', function () {
+				jQuery( this )
+					.parents( 'div.media-item' )
+					.slideUp( 200, function () {
+						jQuery( this ).remove();
+						wp.a11y.speak( wp.i18n.__( 'Error dismissed.' ) );
+						jQuery( '#plupload-browse-button' ).trigger( 'focus' );
+					} );
+			} );
+		}
+	JS;
 	wp_print_inline_script_tag(
 		sprintf(
-			<<<'JS'
-_.delay(function() {wp.a11y.speak(%s);}, 1500);jQuery( %s ).on( 'click', function() {jQuery(this).parents('div.media-item').slideUp(200, function(){jQuery(this).remove();wp.a11y.speak( wp.i18n.__( 'Error dismissed.' ) );jQuery( '#plupload-browse-button' ).trigger( 'focus' );})});
-JS,
-			wp_json_encode( $speak_message, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ),
-			wp_json_encode( 'button#' . $button_unique_id )
+			'( %s )( %s )',
+			$js_function,
+			wp_json_encode(
+				array(
+					'speakMessage'   => $speak_message,
+					'buttonSelector' => 'button#' . $button_unique_id,
+				),
+				JSON_HEX_TAG | JSON_UNESCAPED_SLASHES
+			)
 		)
 	);
 	exit;

From 723d110ea07323f5062e2dea7c0d8596b9847863 Mon Sep 17 00:00:00 2001
From: tin <thanhtinpk092007@gmail.com>
Date: Mon, 7 Sep 2026 13:44:33 +0700
Subject: [PATCH 3/3] Admin: default the dismiss handler destructure; const in
 installer script

If wp_json_encode() were to fail, the emitted call would run with no
argument and throw a TypeError when destructuring. Defaulting to an empty
object avoids the error. Also declare the installer focus helper variable
with const instead of a leaking var now that the block is formatted as
part of the migration.
---
 src/wp-admin/async-upload.php | 2 +-
 src/wp-admin/install.php      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/wp-admin/async-upload.php b/src/wp-admin/async-upload.php
index ba983b6c163f3..c406cc5f5894f 100644
--- a/src/wp-admin/async-upload.php
+++ b/src/wp-admin/async-upload.php
@@ -146,7 +146,7 @@
 	);
 
 	$js_function = <<<'JS'
-		( { speakMessage, buttonSelector } ) => {
+		( { speakMessage, buttonSelector } = {} ) => {
 			_.delay( function () {
 				wp.a11y.speak( speakMessage );
 			}, 1500 );
diff --git a/src/wp-admin/install.php b/src/wp-admin/install.php
index c07fc16194add..4fd4c9a7f594b 100644
--- a/src/wp-admin/install.php
+++ b/src/wp-admin/install.php
@@ -472,7 +472,7 @@ function display_setup_form( $error = null ) {
 if ( ! wp_is_mobile() ) {
 	wp_print_inline_script_tag(
 		<<<'JS'
-		var t = document.getElementById( 'weblog_title' );
+		const t = document.getElementById( 'weblog_title' );
 		if ( t ) {
 			t.focus();
 		}