Protected registered meta keys in block editor sidebar

[girishpanchal30]

Summary

Protected meta keys are not shown in the Custom Fields panel, which would otherwise overwrite the values saved from the Neve sidebar with the ones loaded with the page.

Check before Pull Request is ready:

• I have written a test and included it in this PR
• I have run all tests and they pass
• The code passes when running the PHP CodeSniffer
• Code meets WordPress Coding Standards for PHP, HTML, CSS and JS
• Security and Sanitization requirements have been followed
• I have assigned a reviewer or two to review this PR

Closes #4574

[pirate-bot]

Plugin build for 07b6e50 is ready 🛎️!

• Download build

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds coverage and a fix for the block editor sidebar meta save flow to prevent stale Custom Fields submissions from overwriting recently-saved sidebar meta.

Changes:

• Introduces WP unit tests that simulate saving sidebar meta via REST and subsequent Custom Fields meta box submission.
• Marks Neve’s registered sidebar meta keys as protected via is_protected_meta to keep Custom Fields from writing them back.
• Tracks registered sidebar meta keys in the metabox manager for protection checks.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

File	Description
tests/test-neve-metabox-meta.php	Adds regression tests for REST sidebar meta save + Custom Fields submission behavior.
inc/admin/metabox/manager.php	Tracks registered meta keys and protects them from Custom Fields overwrite via is_protected_meta.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

tests/test-neve-metabox-meta.php:82

• The docblock return type is inaccurate: WP_REST_Server::dispatch() can return WP_REST_Response or WP_Error. Either update the docblock (@return WP_REST_Response|WP_Error) or add a test assertion/guard immediately after dispatching so failures produce readable assertion output rather than a fatal when callers invoke $response->get_status().

	/**
	 * Save the sidebar meta the way the editor sidebar does, over the REST API.
	 *
	 * @param string $value the value to save.
	 *
	 * @return WP_REST_Response
	 */
	private function rest_save_sidebar_meta( $value ) {
		$request = new WP_REST_Request( 'POST', '/wp/v2/pages/' . $this->page_id );
		$request->set_body_params( array( 'meta' => array( 'neve_meta_sidebar' => $value ) ) );

		return rest_get_server()->dispatch( $request );
	}

[girishpanchal30]

edit_post() does not contain check_admin_referer() or any nonce handling. It only performs capability checks such as current_user_can( 'edit_post', ... ) and current_user_can( 'edit_post_meta', ... ). The administrator role is set up before each test case, so all test cases pass successfully.