[pbearne]

This PR adds unit tests for wp_ajax_save_attachment_order() and wp_ajax_send_attachment_to_editor() in src/wp-admin/includes/ajax-actions.php. The tests cover updating the menu order of multiple attachments, generating HTML for editor insertion (for both images and other files), and validating nonces and permissions.

• Trac ticket: https://core.trac.wordpress.org/ticket/65252

• AI Disclosure:

  • AI assistance: Yes
  • Tool(s): Junie (JetBrains)
  • Model(s): gemini-3-flash-preview
  • Used for: Code analysis, test implementation, and verification.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs.

Unlinked Accounts

The following contributors have not linked their GitHub and WordPress.org accounts: @junie-agent.

Contributors, please read how to link your accounts to ensure your work is properly credited in WordPress releases.

Core Committers: Use this line as a base for the props when committing in SVN:

Props pbearne, lancewillett.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

---

Props Bot commands

You can trigger Props Bot actions by commenting on this PR:

• @propsbot add <username> to give props to a GitHub user. Requires write access.
• @propsbot remove <username> to leave a user out of the props. Requires write access.
• @propsbot refresh to refresh this list. Adding the props-bot label works too.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

[Copilot]

🟡 Changes recommended

The image test fixture lacks width and height metadata, causing the caption to be omitted and the Custom Caption assertion to fail.

1 open issue

• Populate image metadata in attachment fixture · New

What changed in this PR

Adds PHPUnit coverage for WordPress attachment AJAX handlers, supporting Trac ticket #65252 without changing production code.

Changes:

• Tests attachment ordering, invalid nonces, insufficient permissions, and missing parameters.
• Tests editor insertion for images and other files, plus invalid nonces and missing attachments.

File	Description
tests/​phpunit/​tests/​admin/​includes/​ajax-actions/​sendAttachmentToEditor.php	Adds editor-insertion success and error tests.
tests/​phpunit/​tests/​admin/​includes/​ajax-actions/​saveAttachmentOrder.php	Adds attachment-ordering success and validation tests.

_{Review effort: Balanced}

[lancewillett]

The editor cases overlap existing output checks, but also cover attaching an image to a post and honoring an explicit file URL. The order success case checks persisted menu orders. The malformed-input rows and local hook registration can be trimmed later.

_{AI review · gpt-6}

[lancewillett]

@pbearne The patch passes local randomized PHPUnit checks against current trunk in single-site and multisite, plus PHP lint and coding standards.

The remaining failed checks are from June. Their logs have expired, and GitHub rejected a job rerun because the run is over a month old. I cannot establish the cause from the retained metadata. Could you refresh this branch against trunk to produce a current CI run before landing?

_{AI review · gpt-6}

[lancewillett]

One further finding from tracing the test harness: both new classes copy getDieHandler() / dieHandler() and add their own die-filter setup/teardown. WP_Ajax_UnitTestCase already owns that handling. Please use the inherited handlers and remove the duplicate scaffolding, keeping the attachment-order persistence and editor output assertions.

Keep the save-attachment-order action registration: it is absent from the parent action list. The send-attachment-to-editor action is already registered by the parent.

The current patch passes randomized single-site and multisite checks. Please rerun those checks after the simplification, along with the fresh CI requested above. This is a test-maintenance finding, not an explanation of the expired CI failure.

_{AI review · gpt-6}