WordPress.tv: Fix subtitle upload error on cached/unauthenticated submissions

[wprashed]

Trac ticket: https://meta.trac.wordpress.org/ticket/8406

Description

When submitting subtitles via /subtitle/?video=..., unauthenticated users or users with stale nonces (due to page caching or browser cache differences such as on Firefox) encountered Invalid form data. Please go back and try again..

This mirrors the handling in anon-upload.php by ensuring unauthenticated submissions providing a WordPress.org username are not blocked by stale nonces, and adds nocache_headers() to upload-subtitles-template.php to prevent caching of the subtitle submission form.

Props

Props @sebastienserre, @wprashed.

Summary by CodeRabbit

• Bug Fixes
  • Improved validation for subtitle upload requests, including more reliable security checks.
  • Preserved access for eligible WordPress.org users during subtitle uploads.
  • Subtitle upload pages now prevent stale cached content from being displayed.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props wprashed.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 4cb7b1f7-c458-447a-a284-444bfce456ea

📥 Commits

Reviewing files that changed from the base of the PR and between 4156dcc and 6bc44a4.

📒 Files selected for processing (2)

• wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-upload-subtitles/wordpresstv-upload-subtitles.php
• wordpress.tv/public_html/wp-content/themes/wptv2/upload-subtitles-template.php

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The subtitle upload handler now normalizes nonce input and supports WordPress.org username-based bypasses. The upload page also sends no-cache headers before rendering.

Changes

Subtitle upload handling

Layer / File(s)	Summary
Nonce validation wordpress.tv/public_html/wp-content/themes/wptv2/plugins/wordpresstv-upload-subtitles/wordpresstv-upload-subtitles.php	The POST handler sanitizes and unslashes the submitted nonce. It skips nonce verification when a WordPress.org username is present. Missing nonces remain invalid.
Upload form cache control wordpress.tv/public_html/wp-content/themes/wptv2/upload-subtitles-template.php	The template sends no-cache headers before rendering the upload form.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 6bc44

This PR adjusts subtitle submission handling for unauthenticated or stale-nonce requests and prevents the submission form from being cached; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: fixing subtitle upload errors caused by cached pages or unauthenticated submissions.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}