Skip to content

Use GET request to download theme from underscores.me - #398

Merged
swissspidy merged 1 commit into
mainfrom
fix/underscores-get-request
Oct 23, 2026
Merged

swissspidy merged 1 commit into
mainfrom
fix/underscores-get-request

Conversation

@swissspidy

@swissspidy swissspidy commented Oct 23, 2026 •

Copy link
Copy Markdown
Member

The wp scaffold _s Behat scenarios have started failing with Error: Couldn't create theme (received 403 response). (example run).

underscores.me now responds with 403 Access Denied to every POST request (even an empty one, regardless of User-Agent/Referer/Origin headers), but it still serves the generated theme zip when the same form fields are sent as query arguments via GET:

$ curl -s -o /dev/null -w '%{http_code}\n' -X POST https://underscores.me/ -d 'underscoresme_slug=starter&underscoresme_generate=1'
403
$ curl -s -D - -o starter.zip 'https://underscores.me/?underscoresme_slug=starter&underscoresme_generate=1&...'
HTTP/1.1 200 OK
Content-Disposition: attachment; filename="starter.zip"
Content-Type: application/zip

I also confirmed that the underscoresme_sass and underscoresme_woocommerce options still work via GET (the zip contains sass/ and the WooCommerce files).

This PR switches wp_remote_post() to wp_remote_get() and passes the existing form fields through add_query_arg( urlencode_deep( $body ), $url ). No test changes are needed: the existing scenarios cover this.


Generated by Claude Code

Summary by CodeRabbit

  • Improvements
    • Updated the way theme archives are requested for download. Existing timeout and download handling remain unchanged.

underscores.me now responds with 403 to all POST requests, but still
serves the generated theme zip when the same form fields are passed
as query arguments.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013rF1yyKWPmtBrXEVSrPJUW
Copilot AI balanced review requested due to automatic review settings October 23, 2026 10:09
@swissspidy
swissspidy requested a review from a team as a code owner October 23, 2026 10:09

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@coderabbitai

coderabbitai Bot commented Oct 23, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: c65d854a-f040-47a5-9792-1e65d8d8d989
📥 Commits

Reviewing files that changed from the base of the PR and between 5aa3fdb and d2f2dc1.

📒 Files selected for processing: 1
  • src/Scaffold_Command.php

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

underscores() now requests the theme archive with wp_remote_get() and sends the encoded fields in the URL query. The request keeps its timeout, streamed response, and temporary filename.

Changes: Theme archive request

Layer / File(s) Summary
Send archive request with GET
src/Scaffold_Command.php
underscores() puts the encoded fields in the request URL and uses wp_remote_get(). The timeout, streamed response, and temporary filename remain configured.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Suggested reviewers: ernilambar, schlessera

Merge Risk: ⚪ Minimal · up to d2f2d

The archive request now uses the required GET method while preserving existing download behavior, with no established merge-blocking risk.

Pre-merge checks: Passed 5
Check name Status Explanation
Description Check Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check Passed The title clearly and concisely describes the main change: switching the theme download from POST to GET.
Docstring Coverage Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Commit to this branch
  • Create a new PR
🧪 Generate unit tests (beta)
  • Commit to this branch
  • Create a new PR
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Oct 23, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@swissspidy swissspidy added this to the 3.0.2 milestone Oct 23, 2026
@swissspidy
swissspidy merged commit a8cdd2c into main Oct 23, 2026
57 checks passed
@swissspidy
swissspidy deleted the fix/underscores-get-request branch October 23, 2026 19:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants