From 9d52a349abdd2b5cca47f40aed4c246bc098ac77 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 2 Mar 2026 10:28:44 +0000 Subject: [PATCH 1/4] Initial plan From ec99254d364dc73b8413595c434858b16112ae67 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Mon, 2 Mar 2026 10:31:38 +0000 Subject: [PATCH 2/4] Fix: Apply wp_slash() to admin password in wp core install Co-authored-by: swissspidy <841956+swissspidy@users.noreply.github.com> --- features/core-install.feature | 16 ++++++++++++++++ src/Core_Command.php | 2 +- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/features/core-install.feature b/features/core-install.feature index 4b3b74c5..6c3d4ae6 100644 --- a/features/core-install.feature +++ b/features/core-install.feature @@ -177,6 +177,22 @@ Feature: Install WordPress core """ And the return code should be 0 + Scenario: Install WordPress with special characters in the admin password + Given an empty directory + And WP files + And wp-config.php + And a database + + When I run `wp core install --url=localhost:8001 --title=Test --admin_user=wpcli --admin_email=wpcli@example.org --admin_password='R^^CzY;G"iZ@]H9b,' --skip-email` + Then STDOUT should contain: + """ + Success: WordPress installed successfully. + """ + And the return code should be 0 + + When I run `wp user check-password wpcli 'R^^CzY;G"iZ@]H9b,'` + Then the return code should be 0 + @less-than-php-7 Scenario: Install WordPress with locale set to de_DE on WP < 4.0 Given an empty directory diff --git a/src/Core_Command.php b/src/Core_Command.php index 98e5c529..83929c3d 100644 --- a/src/Core_Command.php +++ b/src/Core_Command.php @@ -700,7 +700,7 @@ function wp_new_blog_notification() { } $public = true; - $password = $args['admin_password']; + $password = wp_slash( $args['admin_password'] ); if ( ! is_email( $args['admin_email'] ) ) { WP_CLI::error( "The '{$args['admin_email']}' email address is invalid." ); From a4d520de0bc10f61d1f4b949b27d811c8652840a Mon Sep 17 00:00:00 2001 From: Pascal Birchler Date: Wed, 4 Mar 2026 11:20:10 +0100 Subject: [PATCH 3/4] Apply suggestion from @swissspidy --- features/core-install.feature | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/features/core-install.feature b/features/core-install.feature index 6c3d4ae6..74cfafd0 100644 --- a/features/core-install.feature +++ b/features/core-install.feature @@ -190,7 +190,7 @@ Feature: Install WordPress core """ And the return code should be 0 - When I run `wp user check-password wpcli 'R^^CzY;G"iZ@]H9b,'` + When I run `wp user check-password wpcli 'R^^CzY;G"iZ@]H9b,' --escape-chars` Then the return code should be 0 @less-than-php-7 From 55cab688f6d0455fa7cdf1cc4acc6be5df34d87b Mon Sep 17 00:00:00 2001 From: Pascal Birchler Date: Wed, 4 Mar 2026 11:27:17 +0100 Subject: [PATCH 4/4] PHPStan fix --- src/Core_Command.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/Core_Command.php b/src/Core_Command.php index 04994f6a..e40a3bff 100644 --- a/src/Core_Command.php +++ b/src/Core_Command.php @@ -710,6 +710,10 @@ function wp_new_blog_notification() { WP_CLI::error( "The '{$args['admin_email']}' email address is invalid." ); } + /** + * @var string $password + */ + $result = wp_install( $args['title'], $args['admin_user'],