feat(collections): collections block feedback

[rbcorrales]

All Submissions:

• Have you followed the Newspack Contributing guideline?
• Does your code follow the WordPress' coding standards and VIP Go coding standards?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

This PR addresses Collections Block feedback from previous PRs across security, functionality, and code quality:

1. Remove 'See All' CTA functionality and all the related code for see-all CTAs, as it will no longer be used. Conversation in feat(collections): add Collections block #4166.
2. Escape CTA values (label, url, type, class) in get_collection_ctas_for_rest() used in REST responses, to match what render_cta() does. Conversation in test(collections): add unit tests for collections block #4172.
3. Improve attribute sanitization by using defaults for fallbacks instead of hardcoded values. Conversation in test(collections): add unit tests for collections block #4172.

How to test the changes in this Pull Request:

1. Test removed 'See All' functionality:
   • Verify the Collections Block editor no longer shows see-all CTA options
2. Test CTA escaping:
   • Create a collection with malicious CTA data (<script> tags, javascript: URLs). Might require updating the DB.
   • Check REST API response contains escaped values, no raw malicious content
3. Test attribute sanitization:
   • Create Collections Block with invalid values (numberOfItems: 0, columns: 'invalid')
   • Verify block uses defaults from DEFAULT_ATTRIBUTES array

Other information:

• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes, as applicable?
• Have you successfully ran tests with your changes locally?

[Copilot]

Pull Request Overview

This PR addresses Collections Block feedback from previous PRs by removing the 'See All' CTA functionality, improving CTA security through proper escaping, and enhancing attribute sanitization to use defaults instead of hardcoded values.

• Remove all 'See All' functionality including editor controls, rendering logic, and CSS styles
• Add proper escaping for CTA values in REST API responses to prevent XSS vulnerabilities
• Refactor attribute sanitization to use default values from DEFAULT_ATTRIBUTES instead of hardcoded minimums

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tests/unit-tests/collections/class-test-collections-block.php	Remove see-all tests and enhance attribute sanitization testing
tests/unit-tests/collections/class-test-collection-meta.php	Add security tests for CTA escaping in REST responses
src/blocks/collections/styles/_ctas.scss	Remove see-all link CSS styles
src/blocks/collections/edit.jsx	Remove see-all editor controls and RichText component
src/blocks/collections/components/InspectorPanel.jsx	Remove see-all inspector panel controls
src/blocks/collections/class-collections-block.php	Extract attribute sanitization logic and remove see-all rendering
src/blocks/collections/block.json	Remove see-all attributes from block schema
includes/collections/class-template-helper.php	Remove see-all attribute from template defaults
includes/collections/class-collection-meta.php	Add CTA escaping in REST API responses

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[dkoo]

Looks good!

[github-actions]

Hey @rbcorrales, good job getting this PR merged! 🎉

Now, the needs-changelog label has been added to it.

Please check if this PR needs to be included in the "Upcoming Changes" and "Release Notes" doc. If it doesn't, simply remove the label.

If it does, please add an entry to our shared document, with screenshots and testing instructions if applicable, then remove the label.

Thank you! ❤️

[matticbot]

🎉 This PR is included in version 6.20.0-alpha.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

[matticbot]

🎉 This PR is included in version 6.20.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀