From 337ffc7ebec630a21c3b12be300cc0a45bbe0b8a Mon Sep 17 00:00:00 2001
From: Peter Wilson <wilson@peterwilson.cc>
Date: Wed, 11 Mar 2026 00:47:34 +0000
Subject: [PATCH] Grouped backports for the 6.8 branch.

- Interactivity API: Skip binding event handler attributes. The corresponding `data-wp-on--` attribute should be used instead.
- Customize: Introduce a fix for themes that pass a stringable object through the `template_include` filter despite it being documented as only accepting a string.



Built from https://develop.svn.wordpress.org/branches/6.8@61922


git-svn-id: http://core.svn.wordpress.org/branches/6.8@61204 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/class-wp-block-patterns-registry.php   |  4 +++-
 .../class-wp-interactivity-api.php                 | 14 ++++++++++++++
 wp-includes/template-loader.php                    |  5 +++--
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/wp-includes/class-wp-block-patterns-registry.php b/wp-includes/class-wp-block-patterns-registry.php
index 9d25e850e3..6f25583f47 100644
--- a/wp-includes/class-wp-block-patterns-registry.php
+++ b/wp-includes/class-wp-block-patterns-registry.php
@@ -174,7 +174,9 @@ final class WP_Block_Patterns_Registry {
 			$patterns = &$this->registered_patterns;
 		}
 
-		$pattern_path = realpath( $patterns[ $pattern_name ]['filePath'] ?? '' );
+		$file_path    = $patterns[ $pattern_name ]['filePath'] ?? '';
+		$is_stringy   = is_string( $file_path ) || ( is_object( $file_path ) && method_exists( $file_path, '__toString' ) );
+		$pattern_path = $is_stringy ? realpath( (string) $file_path ) : null;
 		if (
 			! isset( $patterns[ $pattern_name ]['content'] ) &&
 			is_string( $pattern_path ) &&
diff --git a/wp-includes/interactivity-api/class-wp-interactivity-api.php b/wp-includes/interactivity-api/class-wp-interactivity-api.php
index 38330b2cd0..0b4de8c792 100644
--- a/wp-includes/interactivity-api/class-wp-interactivity-api.php
+++ b/wp-includes/interactivity-api/class-wp-interactivity-api.php
@@ -868,6 +868,20 @@ final class WP_Interactivity_API {
 					return;
 				}
 
+				// Skip if the bound attribute is an event handler.
+				if ( str_starts_with( $bound_attribute, 'on' ) ) {
+					_doing_it_wrong(
+						__METHOD__,
+						sprintf(
+							/* translators: %s: The directive, e.g. data-wp-on--click. */
+							__( 'Binding event handler attributes is not supported. Please use "%s" instead.' ),
+							esc_attr( 'data-wp-on--' . substr( $bound_attribute, 2 ) )
+						),
+						'6.8.5'
+					);
+					continue;
+				}
+
 				$attribute_value = $p->get_attribute( $attribute_name );
 				$result          = $this->evaluate( $attribute_value );
 
diff --git a/wp-includes/template-loader.php b/wp-includes/template-loader.php
index e7d02c10d2..1853fef519 100644
--- a/wp-includes/template-loader.php
+++ b/wp-includes/template-loader.php
@@ -101,8 +101,9 @@ if ( wp_using_themes() ) {
 	 *
 	 * @param string $template The path of the template to include.
 	 */
-	$template = apply_filters( 'template_include', $template );
-	$template = is_string( $template ) ? realpath( $template ) : null;
+	$template   = apply_filters( 'template_include', $template );
+	$is_stringy = is_string( $template ) || ( is_object( $template ) && method_exists( $template, '__toString' ) );
+	$template   = $is_stringy ? realpath( (string) $template ) : null;
 	if (
 		is_string( $template ) &&
 		( str_ends_with( $template, '.php' ) || str_ends_with( $template, '.html' ) ) &&