Comments: Support Notes @mentions: kses allowance and notifications

[adamsilverstein]

Backports the PHP changes from the Gutenberg Notes @mention work: the mention kses allowance (WordPress/gutenberg#79604, WordPress/gutenberg#80221) and the mention/follower notifications (WordPress/gutenberg#79606).

What

Mention markup survives sanitization (kses)

Allows the note mention markup (a class attribute on links) in comment content, scoped to note comments only:

• _wp_kses_allow_note_mention_attributes() (new, private) extends the pre_comment_content allowlist with class on a elements.
• wp_filter_comment() attaches it immediately before applying the pre_comment_content filter and removes it immediately after, and only when $commentdata['comment_type'] is note.

The pre_comment_content kses context itself is unchanged: wp_kses_allowed_html( 'pre_comment_content' ) still returns the default $allowedtags, and regular (including anonymous front-end) comments are sanitized exactly as before.

Because the scoping lives inside wp_filter_comment() - the single choke point both REST write paths pass through with comment_type already resolved - core does not need the separate REST-create arming fix the plugin shim required (WordPress/gutenberg#80221).

Mention and follower notifications

On rest_insert_comment for note comments (alongside the existing post-author notification), wp_notify_note_mentions():

1. Parses mentions out of the saved content via wp_get_note_mentioned_user_ids(): only anchors carrying both the wp-note-mention class and a user-N class token are treated as mentions, so ordinary links cannot be used to address notifications.
2. Notifies each mentioned user plus any existing followers of the thread, with a short email linking back to the post (wp_send_note_notification()).
3. Subscribes the note author and everyone they mention to the thread. Followers are stored as one _wp_note_followers meta row per user on the thread's top-level note - so concurrent replies cannot clobber each other - and the meta is registered for REST (editable by users who can edit_comment the note) so follower management UI can build on it.

Audience rules:

• The post author is excluded - wp_new_comment_via_rest_notify_postauthor() already notifies them of every note.
• The note's own author is never notified about their own note.
• Recipients are limited to users who can edit_comment the note, matching WP_REST_Comments_Controller::check_read_permission() for notes, so emails cannot leak note content to users who cannot see the note in the editor.
• Everything honors the existing wp_notes_notify option.

New filters: wp_note_notification_recipients, wp_note_notification_subject, wp_note_notification_text.

Why

The Notes @mention completer stores a mention as a link to the mentioned user's author page, <a class="wp-note-mention user-N" href="…">@Name</a>, the user-N class carrying the mentioned user's ID. The default comment kses allowlist ($allowedtags) permits a with only href and title, so for users without unfiltered_html the mention classes are stripped when the note is saved.

An earlier revision of this PR added the attributes to the pre_comment_content context unconditionally. That loosened sanitization for every comment on every site: class is a CSS/JS selector hook, so any commenter - including anonymous visitors - could publish text styled by theme classes (e.g. disguised as a button) or reachable by delegated script handlers. Scoping the allowance to the moment a note comment passes through wp_filter_comment() avoids that: notes can only be written by logged-in users with edit_post on the target post and never render on the front end.

Mentioning a collaborator in a note is only useful if they hear about it: the notification half closes that loop, and the follower model keeps everyone who has participated in a thread informed of later replies without requiring them to be re-mentioned.

Testing

Unit tests in tests/phpunit/tests/kses.php:

• test_wp_kses_allowed_html_pre_comment_content_disallows_mention_attributes verifies the pre_comment_content context still returns the stock $allowedtags.
• test_note_mention_allows_only_class_on_note_links verifies every attribute other than class and the default link attributes (e.g. onclick, style, data-*) is still stripped from note links.
• test_note_mention_markup_stripped_from_regular_comment_content verifies the class is stripped from the same markup in a regular comment.
• test_note_mention_allowance_does_not_leak_after_note_filtering verifies a regular comment filtered after a note gets the default rules and the allowlist is restored.

Unit tests in tests/phpunit/tests/comment/wpNotifyNoteMentions.php cover mention parsing (plain links ignored, IDs deduped), thread-root resolution, the mentioned-user email + auto-subscribe, author self-exclusion, post-author exclusion, capability gating (a mentioned subscriber is not emailed), follower-of-reply notification, the wp_notes_notify off switch, the recipients filter, follower removal, and the REST meta registration.

npm run test:php -- --group notes

Trac ticket: https://core.trac.wordpress.org/ticket/65622

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props adamsilverstein.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.