Skip to content

fix: evaluate shortcodes in field default value - #7593

Open
faisalahammad wants to merge 4 commits into
pods-framework:release/3.4.0from
faisalahammad:fix/7021-default-value-shortcode
Open

fix: evaluate shortcodes in field default value#7593
faisalahammad wants to merge 4 commits into
pods-framework:release/3.4.0from
faisalahammad:fix/7021-default-value-shortcode

Conversation

@faisalahammad

@faisalahammad faisalahammad commented Aug 9, 2026

Copy link
Copy Markdown
Contributor

Description

When a field has Allow Shortcodes enabled and a shortcode is set in its Default Value, the shortcode stayed literal in the form until the item was first saved. The per-type {type}_allow_shortcode flag was only read in each field's display() method, not in the central PodsForm::default_value() resolver that runs at form render time.

Fix: evaluate the shortcode in PodsForm::default_value() when the field type opts in, nested inside the existing default_evaluate_tags block so only the configured default is processed, never request-supplied values.

Single-point fix in the central resolver covers every caller: the frontend form (classes/PodsForm.php:258), the three PodsAPI::save_post sites (classes/PodsAPI.php:5078, 5105, 5191), and PodsField::build_dfv_field_data() (classes/PodsField.php:475).

Backward compatibility:

  • do_shortcode() is idempotent. Unregistered shortcodes return unchanged.
  • pods_form_field_default_value filter preserved at same priority.
  • Smart Tags {@...} still resolved first.
  • Field types without {type}_allow_shortcode (e.g. pick, file, number) untouched.
  • Request-supplied defaults via default_value_parameter stay literal (security).

Related GitHub issue(s)

Fixes #7021

Testing instructions

  1. In WP admin, create a Pod named "Plants" with a Plain Text field.
  2. Edit the Plain Text field options. Enable Allow Shortcodes.
  3. Set Default Value to Today is [current_year] (or any shortcode registered on the site).
  4. Save the Pod.
  5. Create a new Plants item.
  6. The form field should render as Today is 2026, not the literal [current_year].
  7. Save the item. Frontend display still shows the year.
  8. Repeat with Allow Shortcodes off. Form shows the literal [current_year] (pre-fix behavior).
  9. Repeat with a pick field whose default is [anything]. Literal text preserved (no pick_allow_shortcode option).

PHP tests (run via SLIC):

slic run wpunit --ext DotReporter

JS tests:

npm run jest

Screenshots / screencast

Not applicable (no UI change visible to end users; the fix only changes what text is rendered in the form input on new item creation).

Changelog text for these changes

Bug: Shortcodes in Pods field Default Value are now evaluated in the form when Allow Shortcodes is enabled. #7021

PR checklist

When a field has Allow Shortcodes enabled and a shortcode is set in its
Default Value, the shortcode stayed literal in the form until the item
was first saved. The per-type allow_shortcode flag was only read in each
field's display() method, not in the central PodsForm::default_value()
resolver that runs at form render time.

Evaluate the shortcode in default_value() when the field type opts in,
nested inside the existing default_evaluate_tags block so only the
configured default is processed, never request-supplied values.

Fixes pods-framework#7021
@faisalahammad
faisalahammad changed the base branch from main to release/3.4.0 August 18, 2026 11:22
@faisalahammad

Copy link
Copy Markdown
Contributor Author

AI disclosure: this PR was written with Claude Opus 5 assistance, reviewed and tested by me.

faisalahammad and others added 3 commits August 19, 2026 13:04
do_shortcode() was nested inside the magic-tag branch, which is only entered
when str_replace() actually removed a '{@' or '}' from the default. A default
such as 'Today is [current_year]' therefore never reached do_shortcode() and
was rendered literally.

Shortcode expansion is a separate opt-in ({type}_allow_shortcode) from magic
tag evaluation (default_evaluate_tags), so it now runs in a sibling condition.
It deliberately still runs before the default_value_parameter override so that
request-supplied values are never passed through do_shortcode().

Refs pods-framework#7021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

POD Field Allows Shortcodes But Doesn't Replace Them (at least in the DEFAULT Value)

1 participant