Making WordPress.org

wiki:TracQuery

Trac Ticket Queries

In addition to reports, Trac provides support for custom ticket queries, which can be used to display tickets that meet specified criteria.

To configure and execute a custom query, switch to the View Tickets module from the navigation bar, and select the Custom Query link.

Filters

When you first go to the query page, the default filter will display tickets relevant to you:

  • If logged in then all open tickets, it will display open tickets assigned to you.
  • If not logged in but you have specified a name or email address in the preferences, then it will display all open tickets where your email (or name if email not defined) is in the CC list.
  • If not logged in and no name/email is defined in the preferences, then all open issues are displayed.

Current filters can be removed by clicking the button to the left with the minus sign on the label. New filters are added from the dropdown lists at the bottom corners of the filters box; 'And' conditions on the left, 'Or' conditions on the right. Filters with either a text box or a dropdown menu of options can be added multiple times to perform an Or on the criteria.

For text fields such as Keywords and CC the - operator can be used to negate a match and double quotes (since 1.2.1) can be used to match a phrase. For example, a contains match for word1 word2 -word3 "word4 word5" matches tickets containing word1 and word2, not word3 and word4 word5.

You can use the fields just below the filters box to group the results based on a field, or display the full description for each ticket.

After you have edited your filters, click the Update button to refresh your results.

Keyboard shortcuts are available for manipulating the checkbox filters:

  • Clicking on a filter row label toggles all checkboxes.
  • Pressing the modifier key while clicking on a filter row label inverts the state of all checkboxes.
  • Pressing the modifier key while clicking on a checkbox selects the checkbox and deselects all other checkboxes in the filter. Since 1.2.1 this also works for the Columns checkboxes.

The modifier key is platform and browser dependent. On Mac the modified key is Option/Alt or Command. On Linux the modifier key is Ctrl + Alt. Opera on Windows seems to use Ctrl + Alt, while Alt is effective for other Windows browsers.

Clicking on one of the query results will take you to that ticket. You can navigate through the results by clicking the Next Ticket or Previous Ticket links just below the main menu bar, or click the Back to Query link to return to the query page.

You can safely edit any of the tickets and continue to navigate through the results using the Next/Previous/Back to Query links after saving your results. When you return to the query any tickets which were edited will be displayed with italicized text. If one of the tickets was edited such that it no longer matches the query criteria , the text will also be greyed. Lastly, if a new ticket matching the query criteria has been created, it will be shown in bold.

The query results can be refreshed and cleared of these status indicators by clicking the Update button again.

Saving Queries

Trac allows you to save the query as a named query accessible from the reports module. To save a query ensure that you have Updated the view and then click the Save query button displayed beneath the results. You can also save references to queries in Wiki content, as described below.

Note: one way to easily build queries like the ones below, you can build and test the queries in the Custom report module and when ready - click Save query. This will build the query string for you. All you need to do is remove the extra line breaks.

Note: you must have the REPORT_CREATE permission in order to save queries to the list of default reports. The Save query button will only appear if you are logged in as a user that has been granted this permission. If your account does not have permission to create reports, you can still use the methods below to save a query.

You may want to save some queries so that you can come back to them later. You can do this by making a link to the query from any Wiki page.

[query:status=new|assigned|reopened&version=1.0 Active tickets against 1.0]

Which is displayed as:

Active tickets against 1.0

This uses a very simple query language to specify the criteria, see Query Language.

Alternatively, you can copy the query string of a query and paste that into the Wiki link, including the leading ? character:

[query:?status=new&status=assigned&status=reopened&group=owner Assigned tickets by owner]

Which is displayed as:

Assigned tickets by owner

Customizing the table format

You can also customize the columns displayed in the table format (format=table) by using col=<field>. You can specify multiple fields and what order they are displayed in by placing pipes (|) between the columns:

[[TicketQuery(max=3,status=closed,order=id,desc=1,format=table,col=resolution|summary|owner|reporter)]]

This is displayed as:

Results (1 - 3 of 6927)

1 2 3 4 5 6 7 8 9 10 11
Ticket Resolution Summary Owner Reporter
#7961 duplicate Inconsistencies and UI issues on profile.wordpress.org social icons kimjiwoon
#7960 fixed Rosetta Sites and WordPress.org Sub-sites: Access Behavior of /wp-admin/about.php kimjiwoon
#7957 worksforme Inconsistent display of Jetpack Like button across Make Team blogs kimjiwoon
1 2 3 4 5 6 7 8 9 10 11

Full rows

In table format you can also have full rows by using rows=<field>:

[[TicketQuery(max=3,status=closed,order=id,desc=1,format=table,col=resolution|summary|owner|reporter,rows=description)]]

This is displayed as:

Results (1 - 3 of 6927)

1 2 3 4 5 6 7 8 9 10 11
Ticket Resolution Summary Owner Reporter
#7961 duplicate Inconsistencies and UI issues on profile.wordpress.org social icons kimjiwoon
Description

Hi Meta team,

I've noticed a couple of minor but visually important inconsistencies on the [WordPress.org profile page](https://profiles.wordpress.org/kimjiwoon/).

1. Social Icons Display Issue

  • The GitHub profile is shown twice—once as text (GitHub: Jiwoon-Kim) and again as a social icon below (Find me on:). → This feels redundant and might benefit from better deduplication logic.
  • The Threads.net account is present but the icon appears invisible or transparent, making it look like a UI bug.
  • Are these icons being rendered conditionally via some external source or local logic?

2. Social Metadata Source

  • It seems like some parts of the profile (like find me on) are not user-editable. → Are these being pulled from the Gravatar API or another system (e.g. BuddyPress)? It would be helpful to clarify the data source and if users have any way to manage or override it directly.

Would appreciate if these issues could be reviewed for better consistency and usability across the network.

Thanks a lot for your amazing work!

#7960 fixed Rosetta Sites and WordPress.org Sub-sites: Access Behavior of /wp-admin/about.php kimjiwoon
Description

Rosetta Sites and WordPress.org Sub-sites: Access Behavior of /wp-admin/about.php

Author: Jiwoon Kim (Meta Translation Editor, Korean Locale) Date Reported: April 21, 2025 Priority: Low (Not a security issue) Scope: Various Rosetta sites and related WordPress.org sub-sites

I am a Meta Translation Editor (PTE) for the Korean WordPress team. With PTE permissions, I can access the backend at https://ko.wordpress.org/wp-admin/. However, I discovered several cases where /wp-admin/about.php is accessible even without proper permissions. While this does not seem to be a security issue, I am reporting it here for documentation and potential review.

---

### Korean Rosetta Site (/team/, /support/)

Since https://ko.wordpress.org/wp-admin/index.php is accessible, it's understandable that https://ko.wordpress.org/wp-admin/about.php is also accessible.

  • Accessing https://ko.wordpress.org/team/wp-admin/about.php redirects to the user profile at https://profiles.wordpress.org/kimjiwoon/.
  • Attempting to access https://ko.wordpress.org/support/wp-admin/ shows the error:

    "You tried to access the 'Korean Support' dashboard, but you do not currently have access to this site. If you believe you should be able to access the 'Korean Support' dashboard, please contact the network administrator."

However, https://ko.wordpress.org/support/wp-admin/about.php is accessible without permissions.

---

### Japanese Rosetta Site

  • Accessing https://ja.wordpress.org/wp-admin/about.php redirects to https://profiles.wordpress.org/kimjiwoon/.
  • https://ja.wordpress.org/support/wp-admin/about.php is accessible without permissions.

---

### WordPress.org Forums

  • Accessing https://wordpress.org/support/wp-admin/ returns the following error:

    "You tried to access the 'WordPress.org Forums' dashboard, but you do not currently have access to this site. If you believe you should be able to access the 'WordPress.org Forums' dashboard, please contact the network administrator."

However, https://wordpress.org/support/wp-admin/about.php is accessible.

---

### bbPress.org

  • https://bbpress.org/wp-admin/ shows:

    "Sorry, you are not allowed to access this page."

However, https://bbpress.org/wp-admin/about.php is accessible (displayed in English even if the site language is Korean).

---

### BuddyPress.org

  • Accessing https://buddypress.org/wp-admin/about.php redirects to the site front page https://buddypress.org/.

---

### GPT Analysis

about.php is a core admin file in WordPress, typically gated behind login and capability checks like wp-admin/index.php. On multisite installations, if sub-sites are not fully configured or capability checks are not enforced for specific files, access to /about.php may be inadvertently allowed.

The about.php file primarily contains read-only release notes and update information (e.g. “What’s New”), and is intended to be informational rather than administrative — hence, it's likely that explicit access restrictions were not enforced on purpose.

Some sub-sites, even within a multisite environment, do not redirect properly or display profile pages instead of denying access.

---

🧩 What does this suggest? There appears to be a consistent pattern where the about.php file is accessible *only* on sites based on bbPress, which is not expected behavior.

In a typical WordPress Multisite setup, accessing wp-admin/about.php on a subsite should be restricted by user capabilities. However, bbPress may be bypassing or missing this permission check.

The fact that about.php is also accessible on bbPress.org itself suggests a possible omission or inconsistency in how bbPress handles admin templates or hooks.

---

🛠 Likely Cause Candidates The about.php file is a static PHP file located directly under the /wp-admin/ directory in WordPress Core. It doesn't include its own capability check internally.

Normally, access restrictions are handled globally via admin.php or admin_init hooks in WordPress. But in bbPress, these checks might be missing for specific files like about.php, or filters may be malfunctioning before the file is loaded.

Alternatively, it’s possible that about.php was intentionally left open as a "read-only public info page." Even so, the fact that only bbPress-related sites allow access while others block it raises concerns about inconsistency in permission enforcement.

---

### Security Considerations

This is not a security vulnerability. The about.php file does not allow administrative actions or access to sensitive data — it only displays release information.

However, unauthenticated access to /wp-admin/ paths, even for read-only pages, could cause UX confusion or indicate a lack of consistent policy enforcement across the network. If unintended, this behavior might be worth reviewing and improving.

---

### Additional Observation: Version Display Inconsistency

At the bottom of /wp-admin/ pages, the WordPress version string sometimes changes between reloads:

Example:

  • Initially: Version 6.9-alpha-60170
  • After refresh: Version 6.9-alpha-60172

This could be due to version metadata being served from different build caches or CDN nodes, especially within a Trunk development environment. When servers or caches are not fully synchronized, minor inconsistencies in version strings can occur.

---

### WordPress.com / Dashboard Access Examples

  • https://wordpress.com/wp-admin/my-sites.php: Access denied.
  • https://wordpress.com/wp-admin/about.php: 403 Forbidden.
  • https://wordpress.com/wp-admin/index.php: Redirects to https://wordpress.com/sites.

---

### dashboard.wordpress.com

  • https://dashboard.wordpress.com/wp-admin/: Accessible.
  • https://dashboard.wordpress.com/wp-admin/index.php?page=my-blogs: Accessible.
  • https://dashboard.wordpress.com/wp-admin/about.php: 403 Forbidden with message:

"Lost? Our server sentries tell us you probably shouldn’t be here. Maybe you’re lost? If you’re sure this is the place you’re trying to go, please contact us and we’ll be happy to help."

---

### Jetpack-Related Subdomains

  • https://jetpackme.wordpress.com/wp-admin/: Inaccessible.
  • https://koreanjetpack.wordpress.com/wp-admin/: Inaccessible.

*User kimjiwoon96 Cannot Access the Dashboard Requested* "You are logged in as 'kimjiwoon96' and do not have the necessary privileges to access the dashboard for 'Jetpack — Essential Security & Performance for WordPress'. If you are not 'kimjiwoon96', please log out, and log back in with your username. If you are 'kimjiwoon96' and you need access, please ask an administrator of the site to invite you."

#7957 worksforme Inconsistent display of Jetpack Like button across Make Team blogs kimjiwoon
Description

The Jetpack Like button appears only on individual posts of the Meta Team blog and not in the feed view. On other Make Team blogs, the Like button does not appear even on individual post pages. https://make.wordpress.org/meta/2024/12/12/make-wordpress-gets-a-refresh/

This seems to be a configuration or MU plugin scope issue, and I’d like to understand how it is enabled on the Meta blog but not elsewhere.

Ultimately, my goal is to implement features like the Jetpack Like button, social sharing icons, and Gravatar hovercards on a Rosetta site. Investigating this discrepancy is an important step toward achieving that.

Would appreciate any insights into how these features are enabled selectively across the network. Thanks!

1 2 3 4 5 6 7 8 9 10 11

Query Language

query: TracLinks and the [[TicketQuery]] macro both use a mini “query language” for specifying query filters. Filters are separated by ampersands (&). Each filter consists of the ticket field name, an operator and one or more values. More than one value are separated by a pipe (|), meaning that the filter matches any of the values. To include a literal & or | in a value, escape the character with a backslash (\).

The available operators are:

= the field content exactly matches one of the values
~= the field content contains one or more of the values
^= the field content starts with one of the values
$= the field content ends with one of the values

All of these operators can also be negated:

!= the field content matches none of the values
!~= the field content does not contain any of the values
!^= the field content does not start with any of the values
!$= the field content does not end with any of the values

Filters combining matches and negated matches can be constructed for text fields such as Keywords and CC when using the contains (~=) operator. The - operator is used to negate a match and double quotes (since 1.2.1) are used for whitespace-separated words in a phrase. For example, keywords~=word1 word2 -word3 "word4 word5" matches tickets containing word1 and word2, not word3 and also word4 word5.

status=closed,keywords~=firefox query closed tickets that contain keyword firefox
status=closed,keywords~=opera query closed tickets that contain keyword opera
status=closed,keywords~=firefox opera query closed tickets that contain keywords firefox and opera
status=closed,keywords~=firefox|opera query closed tickets that contain keywords firefox or opera
status=closed,keywords~=firefox,or,keywords~=opera query closed tickets that contain keyword firefox, or (closed or unclosed) tickets that contain keyword opera
status=closed,keywords~=firefox -opera query closed tickets that contain keyword firefox, but not opera
status=closed,keywords~=opera -firefox query closed tickets that contain keyword opera, but no firefox

The date fields created and modified can be constrained by using the = operator and specifying a value containing two dates separated by two dots (..). Either end of the date range can be left empty, meaning that the corresponding end of the range is open. The date parser understands a few natural date specifications like "3 weeks ago", "last month" and "now", as well as Bugzilla-style date specifications like "1d", "2w", "3m" or "4y" for 1 day, 2 weeks, 3 months and 4 years, respectively. Spaces in date specifications can be omitted to avoid having to quote the query string.

created=2007-01-01..2008-01-01 query tickets created in 2007
created=lastmonth..thismonth query tickets created during the previous month
modified=1weekago.. query tickets that have been modified in the last week
modified=..30daysago query tickets that have been inactive for the last 30 days

Note that modified is the last modified time, so modified with a date range shows ticket that were last modified in that date range. If a ticket was modified in the date range, but modified again after the end date, it will not be included in the results.


See also: TracTickets, TracReports, TracGuide, TicketQuery

Last modified 7 years ago Last modified on 03/29/2018 07:57:32 PM