From da15fb85f8b435745c357bfcf4b2541d4deaa690 Mon Sep 17 00:00:00 2001
From: Weston Ruter <weston@ruter.net>
Date: Thu, 13 Aug 2026 20:03:51 -0700
Subject: [PATCH] Emit valid values for aria-pressed on the Customizer device
 buttons
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The responsive-preview buttons in the Customizer rendered aria-pressed via
esc_attr( $active ), where $active is a bool. PHP casts true to '1' and
false to '', so the desktop button emitted aria-pressed="1" and the tablet
and mobile buttons emitted aria-pressed="".

Neither is a valid value. aria-pressed is a tristate attribute accepting
only "true", "false", "mixed", or "undefined", and an invalid or empty
value is treated as "undefined" — meaning the button is not exposed as a
toggle at all. All three buttons were therefore announced without their
pressed state on initial render, until the first interaction caused
controls.js to rewrite the attribute via jQuery, which stringifies the
bool correctly to "true"/"false".

Emit the literals directly so the server render agrees with what the
JavaScript later writes. This matches the existing pattern used for
aria-expanded in wp-admin/includes/template.php.

Also makes the sentinel explicit for the Site Icon button's data-state
attribute, which relied on the same bool-to-string cast to produce the
'1' and '' values that site-icon.js compares against and writes back.
Behaviour is unchanged there; the contract is now stated rather than
implied.

Regenerating the baselines drops the last two esc_*() entries from
tests/phpstan/baselines/argument.type.neon, which no longer has any.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 src/wp-admin/customize.php                 |  2 +-
 src/wp-admin/options-general.php           |  2 +-
 tests/phpstan/baselines/argument.type.neon | 10 ----------
 3 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/src/wp-admin/customize.php b/src/wp-admin/customize.php
index 6496c824c9b10..75c0865b1f8eb 100644
--- a/src/wp-admin/customize.php
+++ b/src/wp-admin/customize.php
@@ -288,7 +288,7 @@
 							$class .= ' active';
 						}
 						?>
-						<button type="button" class="<?php echo esc_attr( $class ); ?>" aria-pressed="<?php echo esc_attr( $active ); ?>" data-device="<?php echo esc_attr( $device ); ?>">
+						<button type="button" class="<?php echo esc_attr( $class ); ?>" aria-pressed="<?php echo $active ? 'true' : 'false'; ?>" data-device="<?php echo esc_attr( $device ); ?>">
 							<span class="devices__preview-label"><?php echo esc_html( $settings['label'] ); ?></span>
 						</button>
 					<?php endforeach; ?>
diff --git a/src/wp-admin/options-general.php b/src/wp-admin/options-general.php
index 6a9a6d2f3812d..c1efa0c063c58 100644
--- a/src/wp-admin/options-general.php
+++ b/src/wp-admin/options-general.php
@@ -190,7 +190,7 @@ class="<?php echo esc_attr( $classes_for_button ); ?>"
 			data-choose-text="<?php esc_attr_e( 'Choose a Site Icon' ); ?>"
 			data-update-text="<?php esc_attr_e( 'Change Site Icon' ); ?>"
 			data-update="<?php esc_attr_e( 'Set as Site Icon' ); ?>"
-			data-state="<?php echo esc_attr( has_site_icon() ); ?>"
+			data-state="<?php echo has_site_icon() ? '1' : ''; ?>"
 
 		>
 			<?php if ( has_site_icon() ) : ?>
diff --git a/tests/phpstan/baselines/argument.type.neon b/tests/phpstan/baselines/argument.type.neon
index da71134bcaf34..745a79986da89 100644
--- a/tests/phpstan/baselines/argument.type.neon
+++ b/tests/phpstan/baselines/argument.type.neon
@@ -43,11 +43,6 @@ parameters:
 			identifier: argument.type
 			count: 2
 			path: ../../../src/wp-admin/comment.php
-		-
-			message: '#^Parameter \#1 \$text of function esc_attr expects float\|int\|string, bool given\.$#'
-			identifier: argument.type
-			count: 1
-			path: ../../../src/wp-admin/customize.php
 		-
 			message: '#^Parameter \#1 \$position of function wp_comment_reply expects int, string given\.$#'
 			identifier: argument.type
@@ -448,11 +443,6 @@ parameters:
 			identifier: argument.type
 			count: 1
 			path: ../../../src/wp-admin/network/site-users.php
-		-
-			message: '#^Parameter \#1 \$text of function esc_attr expects float\|int\|string, bool given\.$#'
-			identifier: argument.type
-			count: 1
-			path: ../../../src/wp-admin/options-general.php
 		-
 			message: '#^Parameter \#2 \$callback of function array_filter expects \(callable\(mixed\)\: bool\)\|null, ''validate_file'' given\.$#'
 			identifier: argument.type