Check for non-empty array key 1 before using it with current_user_can()#3140
Open
remyperona wants to merge 2 commits intoWordPress:trunkfrom
Open
Check for non-empty array key 1 before using it with current_user_can()#3140remyperona wants to merge 2 commits intoWordPress:trunkfrom
current_user_can()#3140remyperona wants to merge 2 commits intoWordPress:trunkfrom
Conversation
jrfnl
reviewed
Sep 5, 2022
Member
jrfnl
left a comment
There was a problem hiding this comment.
Hiya, thanks for this PR!
Couple of questions:
- Are there any tests covering this functionality ? Could a test be added to verify the pre-PHP 8.0 behaviour of the function and to safeguard that the current fix doesn't constitute a BC-break ?
- The currently proposed fix will only run the
current_user_can()check when$sub_item[1]is non-empty and if the answer isfalse, it will ignore the submenu item.
This will protect against the "undefined array index" notice, but I'm not sure it constitutes the correct behaviour.
Ascurrent_user_can()is a security function, I wonder if the condition should be changed to:That would ignore aif ( empty( $sub_item[1] ) || ! current_user_can( $sub_item[1] ) )
$sub_itemif no capabilities have been set, as well as when the capabilities don't match those of the current user.
I'm honestly not sure what the correct behaviour should be, but adding a test which would codify the behaviour on PHP < 8.0, would confirm the issue on PHP 8.0+ and would safeguard the fix, should be able to clarify this.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Check for non-empty array key 1 before using it with current_user_can() to avoid PHP warning
Trac ticket: https://core.trac.wordpress.org/ticket/56254
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.