Abilities API: Catch exceptions thrown by ability callbacks and return WP_Error.

Wraps `invoke_callback()` in a try/catch so that exceptions thrown by execute or permission callbacks are converted to a `WP_Error` with the `ability_callback_exception` code instead of propagating as uncaught throwables.

Developed in: WordPress/wordpress-develop#11544

Reviewed by adamsilverstein, justlevine, jorbin.
Merges [62238] to the 7.0 branch.

Props priyankagusani, jamesgiroux, jeffpaul, dkotter, adamsilverstein, justlevine, jorbin, pavanpatil1.
Fixes #65058.

Built from https://develop.svn.wordpress.org/branches/7.0@62240


git-svn-id: http://core.svn.wordpress.org/branches/7.0@61520 1a063a9b-81f0-0310-95a4-ce76da25c4cd

Author: gziolo

wp-includes/abilities-api/class-wp-ability.php

@@ -502,15 +502,27 @@ public function validate_input( $input = null ) {
 	 *
 	 * @param callable $callback The callable to invoke.
 	 * @param mixed    $input    Optional. The input data for the ability. Default `null`.
-	 * @return mixed The result of the callable execution.
+	 * @return mixed The result of the callable execution, or a `WP_Error` if the callback threw.
 	 */
 	protected function invoke_callback( callable $callback, $input = null ) {
 		$args = array();
 		if ( ! empty( $this->get_input_schema() ) ) {
 			$args[] = $input;
 		}
 
-		return $callback( ...$args );
+		try {
+			return $callback( ...$args );
+		} catch ( Throwable $e ) {
+			return new WP_Error(
+				'ability_callback_exception',
+				sprintf(
+					/* translators: 1: Ability name, 2: Exception message. */
+					__( 'Ability "%1$s" callback threw an exception: %2$s' ),
+					esc_html( $this->name ),
+					esc_html( $e->getMessage() )
+				)
+			);
+		}
 	}
 
 	/**

wp-includes/version.php

@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.0-RC2-62236';
+$wp_version = '7.0-RC2-62240';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.