Preface:
In WordPress, filters are typically chained:
Multiple filters can be assigned to the same hook.
The value to be filtered is passed along the filter chain.
The execution order of the filter callbacks is determined by the priority number.
Sample:
Multiple callbacks can be assigned to the hook “the_title”.
The current title is passed to the callback, which can modify and return the new title.
This new title is then passed to the next filter, which can again modify and return the new title. The priority number determines the order of execution.
Background:
The WP dev handbook says:
”Return [mixed] The filtered value after all hooked functions are applied to it.”
This, imo, implies that the value to be filtered is passed through all callbacks in the chain, so every callback can modify the current value.
The Bricks Way:
Bricks implements the “echo_function_names” in a very restrictive manner:
Only the echo function name is passed to the callback. No currently whitelisted functions. And the return value of the callback is used as the one and only final function name whitelist.
The only parameter $callback is the current echo function name to be checked.
Annoyance:
This way, it’s not possible to chain multiple “echo_function_names” filters.
Only the last one executed is the final and definite source for whitelisted function names.
Requirement:
There are scenarios which require to add echo function names to the whitelist dynamically, like custom code snippets or plugins. Only real chaining of filter callbacks with passing the previous filter results would allow this.
Request:
The current whitelisted function names array should be passed as a second parameter to the callback. This way I would be able to check the current whitelist and dynamically add my own function name if necessary.
Passing the current whitelist array as a second parameter wouldn’t affect existing implementations.
Security Aspects:
Imo, this request would not affect security.
It’s already theoretically possible to create a new echo_function_names filter via code injection, code snippet or any other method, which could be applied with a high priority number, and herewith override any existing filter to inject a new possibly malicious whitelist.
