Admin: wrap remaining one-liner inline scripts in wp_print_inline_script_tag()

[tinhien11]

Description

Follows up on the inline script migration in #13319 for the Content Security Policy rollout discussed in Trac #59446: wraps the remaining one-liner raw <script> tags in wp_print_inline_script_tag(), so every script these pages print can carry a per-request nonce.

Under a CSP that only allows nonce'd scripts, each raw tag replaced here was blocked outright: the wpOnload() trigger on every admin screen, the installer's title focus, and the upload-error dismissal.

Changes

wp-admin/admin-footer.php

• The wpOnload() trigger printed at the end of every admin screen now goes through wp_print_inline_script_tag(), mirroring the iframe_footer() migration in Media/Admin: migrate raw inline scripts to wp_print_inline_script_tag() #13319.

wp-admin/install.php

• The installer's weblog_title focus helper (non-mobile) and the hide-if-no-js class-removal block are wrapped the same way. The needless PHP close/reopen pair between them is removed.

wp-admin/async-upload.php

• The upload-error speak-and-dismiss handler is printed via wp_print_inline_script_tag() instead of a manually assembled echo '<script>…'. The dismiss button selector is passed through wp_json_encode() as one whole string, replacing raw string interpolation of the id.

Behavioral notes

• The emitted JavaScript is semantically identical; only the formatting of the wpOnload and installer blocks is normalized.
• wp_print_inline_script_tag() appends a trailing newline after the closing tag, matching the raw echo it replaces in async-upload.php.
• Hardening aside, the dismiss selector construction now can never break on unusual ids, since the full button#… string is JSON-encoded rather than the id being interpolated inside quotes.

Verification

• php -l on all three files.
• The four emitted script bodies were executed against a simulated DOM: wpOnload guard (no-op when undefined, invoked when defined), installer focus, .hide-if-no-js removal on ready, and the full dismiss chain (click → parents( 'div.media-item' ) → slideUp → remove → wp.a11y.speak).
• Emitted tags were validated through the real wp_get_inline_script_tag() implementation, including its unsafe-content guard for </script> sequences.

compression_test() in wp-admin/includes/template.php intentionally remains untouched, per #13319.

Trac ticket: https://core.trac.wordpress.org/ticket/59446

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props thanhtinpk.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[github-actions]

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

• All changes will be lost when closing a tab with a Playground instance.
• All changes will be lost when refreshing the page.
• A fresh instance is created each time the link below is clicked.
• Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
  it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.