Repository navigation
Conversation
A WXR export carries each post's password in wp:post_password. The parser read it into postPassword, but neither the admin WXR import nor `emdash import wordpress` looked at it, so a published, password-protected post came in as published and anyone could read it on the new site. EmDash has no per-entry password, so both importers now bring such a post in as a draft, whatever its WordPress status, and never schedule it. The import result lists these posts: the admin's Import Complete screen shows them with a link to each entry, and the CLI prints them and adds them to its --json result. The EmDash Exporter plugin route is unchanged, because the exporter does not send post passwords.
…us table The content import page's status table still said a published post always comes in published, which the WXR import no longer does for a post with a password. The execute response sentence now names passwordProtected only for posts the request imports, since posts it skips are not listed. The changeset's first sentence reads in one pass.
The card lists only entries that had a password in WordPress, but ordinary WordPress drafts are imported as drafts too, so a heading of "Imported as Drafts (1)" undercounted what the import brought in as drafts. The heading now names what the card lists.
The Coming from WordPress page sums up the import's status mapping as publish to published and everything else to drafts. A WXR import now brings in a published, password-protected post as a draft, so the summary names that case, in the same words as Migrate from WordPress.
🦋 Changeset detectedLatest commit: b3e9724 The changes in this PR will be included in the next version bump. This PR includes changesets to release 12 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
github-actions
Bot
added
review/needs-review
![emdashbot[bot]](https://avatars.githubusercontent.com/in/3255304?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
The approach is right. EmDash has no per-entry passwords, so importing password-protected WordPress posts as unscheduled drafts avoids publishing content that was meant to be protected. It matches how private posts are already handled. Both reviewers approved and found nothing that needs fixing. They checked the admin /api/import/wordpress/execute route, the CLI emdash import wordpress --execute, chunk-result merging in the admin client, the new Import Complete card, the regression tests, the docs and the changeset. Two minor notes are not defects in this change. Posts skipped via skipExisting or on CLI resume are not listed as password-protected. The exported wxrSource adapter still maps status without looking at the password, though no route uses its fetchContent. Review was static, and tests, builds and lint were not run.
Reviewed by anthropic/claude-opus-5-5 and openai/gpt-6.1-sol.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
docs | b3e9724 | Nov 07 2026, 05:02 PM |
🚀 Deploying Preview to Cloudflare 🚀Preview URL: https://daniel-wp-import-password-drafts.try.emdashcms.com, https://daniel-wp-import-password-drafts-emdash-playground.emdash-cms.workers.dev (commit b3e9724)This URL reflects your latest Preview deploymentPreview Deployments by commit
|
@emdash-cms/admin
@emdash-cms/auth
@emdash-cms/auth-atproto
@emdash-cms/blocks
@emdash-cms/cloudflare
@emdash-cms/contentful-to-portable-text
emdash
create-emdash
@emdash-cms/gutenberg-to-portable-text
@emdash-cms/plugin-cli
@emdash-cms/plugin-test
@emdash-cms/plugin-types
@emdash-cms/registry-client
@emdash-cms/registry-lexicons
@emdash-cms/registry-loader
@emdash-cms/registry-moderation
@emdash-cms/registry-verification
upgrade-emdash
@emdash-cms/sandbox-workerd
@emdash-cms/x402
@emdash-cms/plugin-ai-moderation
@emdash-cms/plugin-ai-search
@emdash-cms/plugin-atproto
@emdash-cms/plugin-audit-log
@emdash-cms/plugin-color
@emdash-cms/plugin-embeds
@emdash-cms/plugin-field-kit
@emdash-cms/plugin-forms
@emdash-cms/plugin-webhook-notifier
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Imports password-protected WordPress posts as drafts instead of publishing them. The parser reads each post's password from a WXR export, but neither the admin import nor
emdash import wordpressused it. So a published, protected post came in published. After an admin import, anyone could read it on its page, in the post list and in the RSS feed.EmDash has no per-entry password, so both importers now bring such a post in as a draft and never schedule it, as the admin import already does with
privateposts. The Import Complete screen and the CLI output list these posts. The EmDash Exporter doesn't send post passwords, so imports through it are unchanged.Related: Discussion #345 proposes per-post passwords.
Type of change
Your connection to this change
Checklist
pnpm typecheckpassespnpm lintpassespnpm testpasses (or targeted tests for my change)pnpm formathas been runmessages.pochanges except in translation PRs — a workflow extracts catalogs on merge tomain.AI assistance disclosure
Screenshots / test output
The Import Complete screen after importing a WXR file with one public post and one password-protected post:
Arabic (right to left)
The new strings show in English until the catalogs are extracted after merge.
The new cases in
wxr-execute-chunked.test.tsandcli/import-wordpress.test.tsfail onmain, where a published post with a password comes in published.