From 48be89338a0cfc82679c626c52d71cb678e9c1f2 Mon Sep 17 00:00:00 2001
From: Shail Mehta <shailmehta25@gmail.com>
Date: Mon, 19 Oct 2026 12:17:21 +0530
Subject: [PATCH 1/2] Tests: Add unit tests for `is_protected_endpoint()`

---
 .../tests/load/isProtectedEndpoint.php        | 143 ++++++++++++++++++
 1 file changed, 143 insertions(+)
 create mode 100644 tests/phpunit/tests/load/isProtectedEndpoint.php

diff --git a/tests/phpunit/tests/load/isProtectedEndpoint.php b/tests/phpunit/tests/load/isProtectedEndpoint.php
new file mode 100644
index 0000000000000..a78dd31653d7f
--- /dev/null
+++ b/tests/phpunit/tests/load/isProtectedEndpoint.php
@@ -0,0 +1,143 @@
+<?php
+
+/**
+ * Tests for is_protected_endpoint().
+ *
+ * @group load
+ *
+ * @covers ::is_protected_endpoint
+ */
+class Tests_Load_IsProtectedEndpoint extends WP_UnitTestCase {
+
+	/**
+	 * Original $pagenow value.
+	 *
+	 * @var mixed
+	 */
+	private $original_pagenow;
+
+	/**
+	 * Original $_REQUEST['action'] value.
+	 *
+	 * @var mixed
+	 */
+	private $original_request_action;
+
+	/**
+	 * Whether $_REQUEST['action'] was set before the test.
+	 *
+	 * @var bool
+	 */
+	private $had_request_action;
+
+	public function set_up() {
+		parent::set_up();
+
+		$this->original_pagenow        = $GLOBALS['pagenow'] ?? null;
+		$this->had_request_action      = array_key_exists( 'action', $_REQUEST );
+		$this->original_request_action = $this->had_request_action ? $_REQUEST['action'] : null;
+	}
+
+	public function tear_down() {
+		if ( null !== $this->original_pagenow ) {
+			$GLOBALS['pagenow'] = $this->original_pagenow;
+		} else {
+			unset( $GLOBALS['pagenow'] );
+		}
+
+		if ( $this->had_request_action ) {
+			$_REQUEST['action'] = $this->original_request_action;
+		} else {
+			unset( $_REQUEST['action'] );
+		}
+
+		parent::tear_down();
+	}
+
+	/**
+	 * @ticket 65819
+	 */
+	public function test_returns_false_for_front_end_request() {
+		$this->assertFalse( is_protected_endpoint() );
+	}
+
+	/**
+	 * @ticket 65819
+	 */
+	public function test_returns_true_for_login_screen() {
+		$GLOBALS['pagenow'] = 'wp-login.php';
+
+		$this->assertTrue( is_protected_endpoint() );
+	}
+
+	/**
+	 * @ticket 65819
+	 */
+	public function test_returns_true_for_admin_request() {
+		set_current_screen( 'dashboard' );
+
+		$this->assertTrue( is_protected_endpoint() );
+	}
+
+	/**
+	 * @ticket 65819
+	 */
+	public function test_filter_can_protect_additional_endpoints() {
+		add_filter( 'is_protected_endpoint', '__return_true' );
+
+		$this->assertTrue( is_protected_endpoint() );
+	}
+
+	/**
+	 * @ticket 65819
+	 */
+	public function test_filter_does_not_run_for_already_protected_endpoints() {
+		$GLOBALS['pagenow'] = 'wp-login.php';
+
+		$filter = new MockAction();
+		add_filter( 'is_protected_endpoint', array( $filter, 'filter' ) );
+
+		$this->assertTrue( is_protected_endpoint() );
+		$this->assertSame( 0, $filter->get_call_count() );
+	}
+
+	/**
+	 * @ticket 65819
+	 *
+	 * @runInSeparateProcess
+	 * @preserveGlobalState disabled
+	 */
+	public function test_returns_true_for_protected_ajax_action() {
+		define( 'DOING_AJAX', true );
+		$_REQUEST['action'] = 'heartbeat';
+
+		$this->assertTrue( is_protected_endpoint() );
+	}
+
+	/**
+	 * @ticket 65819
+	 *
+	 * @runInSeparateProcess
+	 * @preserveGlobalState disabled
+	 */
+	public function test_returns_false_for_unprotected_ajax_action() {
+		define( 'DOING_AJAX', true );
+		$_REQUEST['action'] = 'custom-action';
+
+		$this->assertFalse( is_protected_endpoint() );
+	}
+
+	/**
+	 * @ticket 65819
+	 *
+	 * @runInSeparateProcess
+	 * @preserveGlobalState disabled
+	 */
+	public function test_admin_ajax_without_protected_action_is_not_protected() {
+		define( 'DOING_AJAX', true );
+		set_current_screen( 'dashboard' );
+		$_REQUEST['action'] = 'custom-action';
+
+		$this->assertFalse( is_protected_endpoint() );
+	}
+}

From c5a784e443c8b7ce1f4dd726b635d5eabb5f0b6c Mon Sep 17 00:00:00 2001
From: Shail Mehta <shailmehta25@gmail.com>
Date: Mon, 19 Oct 2026 17:30:16 +0530
Subject: [PATCH 2/2] Apply Feedback changes

---
 tests/phpunit/tests/load/isProtectedEndpoint.php | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/tests/phpunit/tests/load/isProtectedEndpoint.php b/tests/phpunit/tests/load/isProtectedEndpoint.php
index a78dd31653d7f..a8ec8e8019552 100644
--- a/tests/phpunit/tests/load/isProtectedEndpoint.php
+++ b/tests/phpunit/tests/load/isProtectedEndpoint.php
@@ -103,12 +103,9 @@ public function test_filter_does_not_run_for_already_protected_endpoints() {
 
 	/**
 	 * @ticket 65819
-	 *
-	 * @runInSeparateProcess
-	 * @preserveGlobalState disabled
 	 */
 	public function test_returns_true_for_protected_ajax_action() {
-		define( 'DOING_AJAX', true );
+		add_filter( 'wp_doing_ajax', '__return_true' );
 		$_REQUEST['action'] = 'heartbeat';
 
 		$this->assertTrue( is_protected_endpoint() );
@@ -116,12 +113,9 @@ public function test_returns_true_for_protected_ajax_action() {
 
 	/**
 	 * @ticket 65819
-	 *
-	 * @runInSeparateProcess
-	 * @preserveGlobalState disabled
 	 */
 	public function test_returns_false_for_unprotected_ajax_action() {
-		define( 'DOING_AJAX', true );
+		add_filter( 'wp_doing_ajax', '__return_true' );
 		$_REQUEST['action'] = 'custom-action';
 
 		$this->assertFalse( is_protected_endpoint() );
@@ -129,12 +123,9 @@ public function test_returns_false_for_unprotected_ajax_action() {
 
 	/**
 	 * @ticket 65819
-	 *
-	 * @runInSeparateProcess
-	 * @preserveGlobalState disabled
 	 */
 	public function test_admin_ajax_without_protected_action_is_not_protected() {
-		define( 'DOING_AJAX', true );
+		add_filter( 'wp_doing_ajax', '__return_true' );
 		set_current_screen( 'dashboard' );
 		$_REQUEST['action'] = 'custom-action';