From 22d31a58cad40129c319fe34fc839acb7fcb2f87 Mon Sep 17 00:00:00 2001
From: Shail Mehta <shailmehta25@gmail.com>
Date: Mon, 19 Oct 2026 12:27:02 +0530
Subject: [PATCH 1/2] Tests: Add unit tests for `is_protected_ajax_action()`

---
 .../tests/load/isProtectedAjaxAction.php      | 139 ++++++++++++++++++
 1 file changed, 139 insertions(+)
 create mode 100644 tests/phpunit/tests/load/isProtectedAjaxAction.php

diff --git a/tests/phpunit/tests/load/isProtectedAjaxAction.php b/tests/phpunit/tests/load/isProtectedAjaxAction.php
new file mode 100644
index 0000000000000..b19ff02db05a6
--- /dev/null
+++ b/tests/phpunit/tests/load/isProtectedAjaxAction.php
@@ -0,0 +1,139 @@
+<?php
+
+/**
+ * Tests for is_protected_ajax_action().
+ *
+ * @group load
+ *
+ * @covers ::is_protected_ajax_action
+ */
+class Tests_Load_IsProtectedAjaxAction extends WP_UnitTestCase {
+
+	/**
+	 * Original $_REQUEST['action'] value.
+	 *
+	 * @var mixed
+	 */
+	private $original_request_action;
+
+	/**
+	 * Whether $_REQUEST['action'] was set before the test.
+	 *
+	 * @var bool
+	 */
+	private $had_request_action;
+
+	public function set_up() {
+		parent::set_up();
+
+		$this->had_request_action      = array_key_exists( 'action', $_REQUEST );
+		$this->original_request_action = $this->had_request_action ? $_REQUEST['action'] : null;
+	}
+
+	public function tear_down() {
+		if ( $this->had_request_action ) {
+			$_REQUEST['action'] = $this->original_request_action;
+		} else {
+			unset( $_REQUEST['action'] );
+		}
+
+		parent::tear_down();
+	}
+
+	/**
+	 * @ticket 65819
+	 */
+	public function test_returns_false_when_not_doing_ajax() {
+		$_REQUEST['action'] = 'heartbeat';
+
+		$this->assertFalse( is_protected_ajax_action() );
+	}
+
+	/**
+	 * @ticket 65819
+	 */
+	public function test_filter_does_not_run_when_not_doing_ajax() {
+		$_REQUEST['action'] = 'heartbeat';
+
+		$filter = new MockAction();
+		add_filter( 'wp_protected_ajax_actions', array( $filter, 'filter' ) );
+
+		$this->assertFalse( is_protected_ajax_action() );
+		$this->assertSame( 0, $filter->get_call_count() );
+	}
+
+	/**
+	 * @ticket 65819
+	 *
+	 * @runInSeparateProcess
+	 * @preserveGlobalState disabled
+	 */
+	public function test_returns_false_when_doing_ajax_without_action() {
+		define( 'DOING_AJAX', true );
+		unset( $_REQUEST['action'] );
+
+		$this->assertFalse( is_protected_ajax_action() );
+	}
+
+	/**
+	 * @ticket 65819
+	 *
+	 * @runInSeparateProcess
+	 * @preserveGlobalState disabled
+	 */
+	public function test_returns_true_for_default_protected_actions() {
+		define( 'DOING_AJAX', true );
+
+		$actions = array(
+			'edit-theme-plugin-file',
+			'heartbeat',
+			'install-plugin',
+			'install-theme',
+			'search-plugins',
+			'search-install-plugins',
+			'update-plugin',
+			'update-theme',
+			'activate-plugin',
+		);
+
+		foreach ( $actions as $action ) {
+			$_REQUEST['action'] = $action;
+
+			$this->assertTrue( is_protected_ajax_action(), $action . ' should be protected.' );
+		}
+	}
+
+	/**
+	 * @ticket 65819
+	 *
+	 * @runInSeparateProcess
+	 * @preserveGlobalState disabled
+	 */
+	public function test_returns_false_for_unprotected_ajax_action() {
+		define( 'DOING_AJAX', true );
+		$_REQUEST['action'] = 'custom-action';
+
+		$this->assertFalse( is_protected_ajax_action() );
+	}
+
+	/**
+	 * @ticket 65819
+	 *
+	 * @runInSeparateProcess
+	 * @preserveGlobalState disabled
+	 */
+	public function test_filter_can_protect_additional_ajax_actions() {
+		define( 'DOING_AJAX', true );
+		$_REQUEST['action'] = 'custom-action';
+
+		add_filter(
+			'wp_protected_ajax_actions',
+			static function ( $actions ) {
+				$actions[] = 'custom-action';
+				return $actions;
+			}
+		);
+
+		$this->assertTrue( is_protected_ajax_action() );
+	}
+}

From 502c65cc10beef1f290f822e95f866e5c6b0b711 Mon Sep 17 00:00:00 2001
From: Shail Mehta <shailmehta25@gmail.com>
Date: Mon, 19 Oct 2026 17:28:13 +0530
Subject: [PATCH 2/2] Apply Feedback changes

---
 .../tests/load/isProtectedAjaxAction.php      | 20 ++++---------------
 1 file changed, 4 insertions(+), 16 deletions(-)

diff --git a/tests/phpunit/tests/load/isProtectedAjaxAction.php b/tests/phpunit/tests/load/isProtectedAjaxAction.php
index b19ff02db05a6..e13abdcce80af 100644
--- a/tests/phpunit/tests/load/isProtectedAjaxAction.php
+++ b/tests/phpunit/tests/load/isProtectedAjaxAction.php
@@ -64,12 +64,9 @@ public function test_filter_does_not_run_when_not_doing_ajax() {
 
 	/**
 	 * @ticket 65819
-	 *
-	 * @runInSeparateProcess
-	 * @preserveGlobalState disabled
 	 */
 	public function test_returns_false_when_doing_ajax_without_action() {
-		define( 'DOING_AJAX', true );
+		add_filter( 'wp_doing_ajax', '__return_true' );
 		unset( $_REQUEST['action'] );
 
 		$this->assertFalse( is_protected_ajax_action() );
@@ -77,12 +74,9 @@ public function test_returns_false_when_doing_ajax_without_action() {
 
 	/**
 	 * @ticket 65819
-	 *
-	 * @runInSeparateProcess
-	 * @preserveGlobalState disabled
 	 */
 	public function test_returns_true_for_default_protected_actions() {
-		define( 'DOING_AJAX', true );
+		add_filter( 'wp_doing_ajax', '__return_true' );
 
 		$actions = array(
 			'edit-theme-plugin-file',
@@ -105,12 +99,9 @@ public function test_returns_true_for_default_protected_actions() {
 
 	/**
 	 * @ticket 65819
-	 *
-	 * @runInSeparateProcess
-	 * @preserveGlobalState disabled
 	 */
 	public function test_returns_false_for_unprotected_ajax_action() {
-		define( 'DOING_AJAX', true );
+		add_filter( 'wp_doing_ajax', '__return_true' );
 		$_REQUEST['action'] = 'custom-action';
 
 		$this->assertFalse( is_protected_ajax_action() );
@@ -118,12 +109,9 @@ public function test_returns_false_for_unprotected_ajax_action() {
 
 	/**
 	 * @ticket 65819
-	 *
-	 * @runInSeparateProcess
-	 * @preserveGlobalState disabled
 	 */
 	public function test_filter_can_protect_additional_ajax_actions() {
-		define( 'DOING_AJAX', true );
+		add_filter( 'wp_doing_ajax', '__return_true' );
 		$_REQUEST['action'] = 'custom-action';
 
 		add_filter(