#41488: Fix handling of backslashes encoded in in partial placement context data #2

westonruter · 2017-08-02T04:06:17Z

https://core.trac.wordpress.org/ticket/41488

(This pull request will not be merged. The patch from the patch is being committed and pushed to GitHub for the sake of the pull request, both for review and for the Travis build.)

…emails-1 50448-auto-update-failure-emails

No input validation was done. Covered by existing `Tests_Functions::test_validate_file()` test (well, the `null` and string part is). Error fixed: `preg_match_all(): Passing null to parameter #2 ($subject) of type string is deprecated` QUESTION: should we add tests for other scalar input types ?

This fixes a `preg_match_all(): Passing null to parameter #2 ($subject) of type string is deprecated` notice on PHP 8.1. The behavior for `null` and `string` input is covered by the existing `Tests_Functions::test_validate_file()` test. Effect: Errors down by 238, assertions up by 1920, failures down by 1. Props jrf, hellofromTonya, SergeyBiryukov. See #53635. git-svn-id: https://develop.svn.wordpress.org/trunk@51625 602fd350-edb4-49c9-b593-d223f7449a82

…` in `WP_Sitemaps_Provider::get_sitemap_url()`. The `WP_Sitemaps_Provider::get_sitemap_url()` method calls the PHP native `http_build_query()` function, the second parameter of which is the ''optional'' `$numeric_prefix` parameter which expects a `string`. A parameter being optional, however, does not automatically make it nullable. As of PHP 8.1, passing `null` to a non-nullable PHP native function will generate a deprecation notice. In this case, this function call yielded a `http_build_query(): Passing null to parameter #2 ($numeric_prefix) of type string is deprecated` notice. Changing the `null` to an empty string fixes this without a backward compatibility break. This change is already covered by tests as 14 of the existing tests failed on these function calls when running the tests on PHP 8.1. References: * [https://www.php.net/manual/en/function.http-build-query.php PHP Manual: http_build_query()] * [https://wiki.php.net/rfc/deprecate_null_to_scalar_internal_arg PHP RFC: Deprecate passing null to non-nullable arguments of internal functions] Follow-up to [48470]. Props jrf. See #53635. git-svn-id: https://develop.svn.wordpress.org/trunk@51652 602fd350-edb4-49c9-b593-d223f7449a82

…precation notices The PHP native `mysqli_real_escape_string()` function expects to be passed a string as the second parameter and this is not a nullable parameter. Passing `null` to it will result in a `mysqli_real_escape_string(): Passing null to parameter #2 ($string) of type string is deprecated` notice on PHP 8.1. Previously, an input type check was put in place to prevent fatal errors on PHP 8.0 when an array, object or resource was passed. Changeset [48980]. A `null` value was explicitly excluded from that check, even though a `null` value being passed would only ever result in an empty string anyway. This commit changes the previous input type check to also bow out early for `null` values and to automatically return an empty string for those. Refs: * https://www.php.net/manual/en/mysqli.real-escape-string.php * https://wiki.php.net/rfc/deprecate_null_to_scalar_internal_arg

…cation On PHP 8.1, the `_mb_substr()` function would throw a `preg_match_all(): Passing null to parameter #2 ($subject) of type string is deprecated` notice when passed `null`. To maintain the same behaviour as before, let's just bow out early when `$str` is passed as `null` as the outcome will, in that case, only ever be an empty string. Note: this does mean that the `_mb_substr()` function now has a subtle difference in behaviour compared to the PHP native `mb_substr()` function as the latter *will* throw the deprecation notice. The existing tests for the compat function already cover this issue.

…precation notices The PHP native `mysqli_real_escape_string()` function expects to be passed a string as the second parameter and this is not a nullable parameter. Passing `null` to it will result in a `mysqli_real_escape_string(): Passing null to parameter #2 ($string) of type string is deprecated` notice on PHP 8.1. Previously, an input type check was put in place to prevent fatal errors on PHP 8.0 when an array, object or resource was passed. Changeset [48980]. A `null` value was explicitly excluded from that check, even though a `null` value being passed would only ever result in an empty string anyway. This commit changes the previous input type check to also bow out early for `null` values and to automatically return an empty string for those. Refs: * https://www.php.net/manual/en/mysqli.real-escape-string.php * https://wiki.php.net/rfc/deprecate_null_to_scalar_internal_arg

… `wpdb::_real_escape()`. The PHP native `mysqli_real_escape_string()` function expects to be passed a string as the second parameter and this is not a nullable parameter. Passing `null` to it will result in a `mysqli_real_escape_string(): Passing null to parameter #2 ($string) of type string is deprecated` notice on PHP 8.1. Previously, an input type check was put in place to prevent fatal errors on PHP 8.0 when an array, object or resource was passed. Changeset [48980]. A `null` value was explicitly excluded from that check, even though a `null` value being passed would only ever result in an empty string anyway. This commit changes the previous input type check to also bow out early for `null` values and to automatically return an empty string for those. Refs: - https://www.php.net/manual/en/mysqli.real-escape-string.php - https://wiki.php.net/rfc/deprecate_null_to_scalar_internal_arg Follow-up to [48980]. Props jrf, hellofromTonya. See #53635. git-svn-id: https://develop.svn.wordpress.org/trunk@51799 602fd350-edb4-49c9-b593-d223f7449a82

…IncludesPlugin::test_get_plugin_files_folder()`. The `Tests_Admin_IncludesPlugin::_create_plugin()` expects the first parameter to be a text string to be written to a plugin file using `fwrite()`. Passing null causes a `fwrite(): Passing null to parameter #2 ($data) of type string is deprecated` notice. Ref: https://www.php.net/manual/en/function.fwrite Follow-up to [31002]. [41806]. Props jrf, hellofromTonya. See #53635. git-svn-id: https://develop.svn.wordpress.org/trunk@51800 602fd350-edb4-49c9-b593-d223f7449a82

… `_mb_substr()`. The `_mb_substr()` function expects a string for the `$str` parameter, but does not do input validation. This function contains a `preg_match_all()` which also expects a string type for the given subject (i.e. `$str`). Passing `null` to this parameter results in `preg_match_all(): Passing null to parameter #2 ($subject) of type string is deprecated` notice on PHP 8.1. To maintain the same behaviour as before, a guard clause is added to bail out early when `$str` is passed as `null`. The outcome will, in that case, only ever be an empty string. Note: this does mean that the `_mb_substr()` function now has a subtle difference in behaviour compared to the PHP native `mb_substr()` function as the latter ''will'' throw the deprecation notice. The existing tests already cover this issue. Follow-up to [17621], [36017], [32364]. Props jrf, hellofromTonya. See #53635. git-svn-id: https://develop.svn.wordpress.org/trunk@51853 602fd350-edb4-49c9-b593-d223f7449a82

… `wpdb::_real_escape()`. The PHP native `mysqli_real_escape_string()` function expects to be passed a string as the second parameter and this is not a nullable parameter. Passing `null` to it will result in a `mysqli_real_escape_string(): Passing null to parameter WordPress#2 ($string) of type string is deprecated` notice on PHP 8.1. Previously, an input type check was put in place to prevent fatal errors on PHP 8.0 when an array, object or resource was passed. Changeset [48980]. A `null` value was explicitly excluded from that check, even though a `null` value being passed would only ever result in an empty string anyway. This commit changes the previous input type check to also bow out early for `null` values and to automatically return an empty string for those. Refs: - https://www.php.net/manual/en/mysqli.real-escape-string.php - https://wiki.php.net/rfc/deprecate_null_to_scalar_internal_arg Follow-up to [48980]. Props jrf, hellofromTonya. See #53635. git-svn-id: https://develop.svn.wordpress.org/trunk@51799 602fd350-edb4-49c9-b593-d223f7449a82

…IncludesPlugin::test_get_plugin_files_folder()`. The `Tests_Admin_IncludesPlugin::_create_plugin()` expects the first parameter to be a text string to be written to a plugin file using `fwrite()`. Passing null causes a `fwrite(): Passing null to parameter WordPress#2 ($data) of type string is deprecated` notice. Ref: https://www.php.net/manual/en/function.fwrite Follow-up to [31002]. [41806]. Props jrf, hellofromTonya. See #53635. git-svn-id: https://develop.svn.wordpress.org/trunk@51800 602fd350-edb4-49c9-b593-d223f7449a82

… `_mb_substr()`. The `_mb_substr()` function expects a string for the `$str` parameter, but does not do input validation. This function contains a `preg_match_all()` which also expects a string type for the given subject (i.e. `$str`). Passing `null` to this parameter results in `preg_match_all(): Passing null to parameter WordPress#2 ($subject) of type string is deprecated` notice on PHP 8.1. To maintain the same behaviour as before, a guard clause is added to bail out early when `$str` is passed as `null`. The outcome will, in that case, only ever be an empty string. Note: this does mean that the `_mb_substr()` function now has a subtle difference in behaviour compared to the PHP native `mb_substr()` function as the latter ''will'' throw the deprecation notice. The existing tests already cover this issue. Follow-up to [17621], [36017], [32364]. Props jrf, hellofromTonya. See #53635. git-svn-id: https://develop.svn.wordpress.org/trunk@51853 602fd350-edb4-49c9-b593-d223f7449a82

… `wpdb::_real_escape()`. The PHP native `mysqli_real_escape_string()` function expects to be passed a string as the second parameter and this is not a nullable parameter. Passing `null` to it will result in a `mysqli_real_escape_string(): Passing null to parameter WordPress#2 ($string) of type string is deprecated` notice on PHP 8.1. Previously, an input type check was put in place to prevent fatal errors on PHP 8.0 when an array, object or resource was passed. Changeset [48980]. A `null` value was explicitly excluded from that check, even though a `null` value being passed would only ever result in an empty string anyway. This commit changes the previous input type check to also bow out early for `null` values and to automatically return an empty string for those. Refs: - https://www.php.net/manual/en/mysqli.real-escape-string.php - https://wiki.php.net/rfc/deprecate_null_to_scalar_internal_arg Follow-up to [48980]. Props jrf, hellofromTonya. See #53635. git-svn-id: https://develop.svn.wordpress.org/trunk@51799 602fd350-edb4-49c9-b593-d223f7449a82

…IncludesPlugin::test_get_plugin_files_folder()`. The `Tests_Admin_IncludesPlugin::_create_plugin()` expects the first parameter to be a text string to be written to a plugin file using `fwrite()`. Passing null causes a `fwrite(): Passing null to parameter WordPress#2 ($data) of type string is deprecated` notice. Ref: https://www.php.net/manual/en/function.fwrite Follow-up to [31002]. [41806]. Props jrf, hellofromTonya. See #53635. git-svn-id: https://develop.svn.wordpress.org/trunk@51800 602fd350-edb4-49c9-b593-d223f7449a82

… `_mb_substr()`. The `_mb_substr()` function expects a string for the `$str` parameter, but does not do input validation. This function contains a `preg_match_all()` which also expects a string type for the given subject (i.e. `$str`). Passing `null` to this parameter results in `preg_match_all(): Passing null to parameter WordPress#2 ($subject) of type string is deprecated` notice on PHP 8.1. To maintain the same behaviour as before, a guard clause is added to bail out early when `$str` is passed as `null`. The outcome will, in that case, only ever be an empty string. Note: this does mean that the `_mb_substr()` function now has a subtle difference in behaviour compared to the PHP native `mb_substr()` function as the latter ''will'' throw the deprecation notice. The existing tests already cover this issue. Follow-up to [17621], [36017], [32364]. Props jrf, hellofromTonya. See #53635. git-svn-id: https://develop.svn.wordpress.org/trunk@51853 602fd350-edb4-49c9-b593-d223f7449a82

…query()` This fixes the "Deprecated: http_build_query(): Passing null to parameter WordPress#2 ($numeric_prefix) of type string is deprecated" warning on PHP 8.1. PHP has started requiring that built-in method arguments that are not explicitly declared as nullable may no longer be passed null. The correct value for the `$numeric_prefix` parameter to `http_build_query()` is an empty string. Trac ticket: https://core.trac.wordpress.org/ticket/53635

…` in `get_core_checksums()` and `wp_version_check()`. The `get_core_checksums()` and `wp_version_check()` functions call the PHP native `http_build_query()` function, the second parameter of which is the ''optional'' `$numeric_prefix` parameter which expects a non-nullable `string`. A parameter being optional, however, does not automatically make it nullable. As of PHP 8.1, passing `null` to a non-nullable PHP native function will generate a deprecation notice. In this case, this function call yielded a `http_build_query(): Passing null to parameter #2 ($numeric_prefix) of type string is deprecated` notice. Changing the `null` to an empty string fixes this without a backward compatibility break. References: * [https://www.php.net/manual/en/function.http-build-query.php PHP Manual: http_build_query()] * [https://wiki.php.net/rfc/deprecate_null_to_scalar_internal_arg PHP RFC: Deprecate passing null to non-nullable arguments of internal functions] Follow-up to [18697], [25540]. Props bjorsch, kraftbj, hellofromTonya, jrf. See #54229. git-svn-id: https://develop.svn.wordpress.org/trunk@52019 602fd350-edb4-49c9-b593-d223f7449a82

…n array to avoid PHP 8+ TypeError fatal error. Adds an `is_array()` check before the `in_array()`. Why? `in_array()` requires a array for the haystack. Any other data type will cause a fatal error on PHP 8.0 or higher: {{{ Fatal error: Uncaught TypeError: in_array(): Argument #2 ($haystack) must be of type array }}} As this is a new filter, this type check properly guards to avoid the fatal error. Follow-up to [52084]. See #54331. git-svn-id: https://develop.svn.wordpress.org/trunk@52085 602fd350-edb4-49c9-b593-d223f7449a82

update

…heme()` tests. In the tests for updating a theme via Ajax, `wp_installing( true )` is called to prevent `wp_update_themes()` from running. This worked as expected in `test_update_theme()`, however, it was missed in `test_uppercase_theme_slug()`, which was accidentally relying on the `wp_installing()` status not being properly restored in the previous test. Now that the `wp_installing()` status was corrected in [54723], the latter test started throwing an error on PHP 8.2: {{{ 1) Tests_Ajax_wpAjaxUpdateTheme::test_uppercase_theme_slug http_build_query(): Passing null to parameter #2 ($numeric_prefix) of type string is deprecated /var/www/src/wp-includes/Requests/Transport/cURL.php:345 /var/www/src/wp-includes/Requests/Transport/cURL.php:135 /var/www/src/wp-includes/class-requests.php:381 /var/www/src/wp-includes/class-wp-http.php:395 /var/www/src/wp-includes/class-wp-http.php:615 /var/www/src/wp-includes/http.php:179 /var/www/src/wp-includes/update.php:719 /var/www/src/wp-admin/includes/ajax-actions.php:4292 /var/www/src/wp-includes/class-wp-hook.php:308 /var/www/src/wp-includes/class-wp-hook.php:332 /var/www/src/wp-includes/plugin.php:517 /var/www/tests/phpunit/includes/testcase-ajax.php:265 /var/www/tests/phpunit/tests/ajax/wpAjaxUpdateTheme.php:157 }}} Replicating the `wp_installing()` status changes in this test too resolves the error. Follow-up to [38168], [38710], [54722], [54723]. See #56793. git-svn-id: https://develop.svn.wordpress.org/trunk@54725 602fd350-edb4-49c9-b593-d223f7449a82

Fix incompatible declarations PHP War nings - patch.diff (1.9 KB) - added by davidbawiec 3 years ago. patching file wp-includes/class-wp-image-editor-gd.php Hunk #1 FAILED at 154. Hunk #2 FAILED at 218. 2 out of 2 hunks FAILED patching file wp-includes/class-wp-image-editor-imagick.php Hunk #1 FAILED at 251. Hunk #2 succeeded at 364 (offset 75 lines). 1 out of 2 hunks FAILED

40370.diff (4.7 KB) - added by thema ttroyal 5 years ago. patching file src/wp-includes/class-wp-image-editor-gd.php Hunk #1 succeeded at 153 with fuzz 1 (offset 17 lines). Hunk #2 FAILED at 225. Hunk #3 FAILED at 256. Hunk WordPress#4 succeeded at 557 with fuzz 2 (offset 105 lines). 2 out of 4 hunks FAILED patching file src/wp-includes/class-wp-image-editor-imagick.php Hunk #1 succeeded at 309 with fuzz 1 (offset 72 lines). Hunk #2 succeeded at 364 (offset 80 lines). Hunk #3 succeeded at 859 with fuzz 2 (offset 191 lines). patching file src/wp-includes/class-wp-image-editor.php Hunk #1 succeeded at 15 with fuzz 2 (offset 1 line). Hunk #2 succeeded at 222 (offset 26 lines). Hunk #3 succeeded at 512 (offset 108 lines).

Prevent passing null to param WordPress#2 of preg_match()

Patch applied 40370.diff (4.7 KB) - added by themattroyal 5 years ago patching file src/wp-includes/class-wp-image-editor-gd.php Hunk #1 succeeded at 153 with fuzz 1 (offset 17 lines). Hunk #2 FAILED at 225. Hunk #3 FAILED at 256. Hunk WordPress#4 succeeded at 557 with fuzz 2 (offset 105 lines). 2 out of 4 hunks FAILED

When saving options from the Settings page, include the `'ping_sites'` option in the allowed "writing" options list only when the `'blog_public'` option is `'1'`. Fixes a PHP 8.1 and above "null to non-nullable" deprecation notice in `sanitize_option()` ([https://core.trac.wordpress.org/browser/trunk/src/wp-includes/formatting.php?annotate=blame#L4952 which happens when here] as part of [22255]): {{{ Deprecated: explode(): Passing null to parameter #2 ($string) of type string is deprecated in .../wp-includes/formatting.php }}} **Explanation** [https://developer.wordpress.org/apis/options/#writing Per the documentation], the `ping_sites` option requires the `'blog_public'` option to have a value of `'1'` and must be a `string` data type. `null` is not valid for this option. The relationship between the 2 options shows itself in the `options-writing.php` code ([https://core.trac.wordpress.org/browser/tags/6.5.4/src/wp-admin/options-writing.php#L233 shown here] and in [4326]), as the `textarea#ping_sites` only renders when `'1' === get_option( 'blog_public' )`. **What happens if `'blog_public'` is not `'1'`?** The `'ping_sites'` option will not be a field on the page. Upon saving: * HTTP POST (`$_POST`) does not include `'ping_sites'`. * Before this commit: * The [https://core.trac.wordpress.org/browser/trunk/src/wp-admin/options.php#L333 option's value was set to] `null` before being passed to `update_option()`. * `update_option()` invokes `sanitize_option()`. * A `null` value for the `'ping_sites'` case was passed to `explode()`, which threw a deprecation notice on PHP 8.1 and above. * With this commit, the `'ping_sites'` option is no longer included in the allow list and thus will not be passed to `update_options()` > `sanitize_option()` > `explode()`. Follow-up to [22255], [12825], [4326], [949]. Props kitchin, SergeyBiryukov, swissspidy, devmuhib, rajinsharwar, hellofromTonya. Fixes #59818. git-svn-id: https://develop.svn.wordpress.org/trunk@58425 602fd350-edb4-49c9-b593-d223f7449a82

…t_mime_types(). Fixes a PHP 8.1 and above "null to non-nullable" deprecation notice in `get_available_post_mime_types()`: {{{ Deprecated: preg_match(): Passing null to parameter #2 ($subject) of type string is deprecated in ./wp-includes/post.php on line 3395 }}} [https://developer.wordpress.org/reference/functions/get_available_post_mime_types/#return This function is documented] to: * Return `An array of MIME types.` * as an array of `string`s, i.e. `string[]`. A `null` or empty element within the returned array is not a valid MIME type. If a `null` exists in the returned array, it is the root cause of PHP throwing the deprecation notice. This commit removes the `null` and empty elements from the returned array of MIME types. It also adds a unit test. Follow-up to [56623], [56452]. Props nosilver4u, jrf, ironprogrammer, antpb, antonvlasenko, rajinsharwar, hellofromTonya. Fixes #59195. git-svn-id: https://develop.svn.wordpress.org/trunk@58437 602fd350-edb4-49c9-b593-d223f7449a82

westonruter added 3 commits August 1, 2017 21:04

Fix handling of backslashes encoded in in partial placement context data

a1a8216

Fix test compat with 5.2

b0577fc

Fix phpunit compat for PHP 5.2

845d2a1

westonruter closed this Aug 2, 2017

pento deleted the trac-41488 branch August 2, 2017 05:11

desrosj referenced this pull request in desrosj/wordpress-develop Jul 2, 2020

Merge pull request #2 from helloarpitgshah/50448-auto-update-failure-…

47fe8b1

…emails-1 50448-auto-update-failure-emails

hellofromtonya mentioned this pull request Nov 24, 2020

51423: wp_privacy_generate_personal_data_export_file fixes type match for array_merge (PHP 8) #758

Closed

anomiex mentioned this pull request Nov 2, 2021

Code Modernization: Avoid passing null to parameter 2 of http_build_query() #1800

Closed

costdev mentioned this pull request Nov 4, 2021

Coding Standards: Add visibility to methods in tests/phpunit/tests/ A-B-C-D files. #1717

Closed

anton-vlasenko referenced this pull request in anton-vlasenko/wordpress-develop May 26, 2022

Merge pull request #2 from WordPress/master

5cc4239

update

ockham mentioned this pull request Sep 12, 2022

Elements API updates backport #3206

Closed

toddlahman mentioned this pull request Apr 28, 2023

Cast (int) $cron->time - time() to prevent String - int error #4398

Closed

nosilver4u added a commit to nosilver4u/wordpress-develop that referenced this pull request Aug 24, 2023

Update post.php

633051c

Prevent passing null to param WordPress#2 of preg_match()

nosilver4u mentioned this pull request Aug 24, 2023

Update post.php #5083

Open

QAQQL mentioned this pull request Dec 15, 2023

Fix docblock reference in _register_theme_block_patterns #5649

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

#41488: Fix handling of backslashes encoded in in partial placement context data #2

#41488: Fix handling of backslashes encoded in in partial placement context data #2

westonruter commented Aug 2, 2017

#41488: Fix handling of backslashes encoded in in partial placement context data #2

#41488: Fix handling of backslashes encoded in in partial placement context data #2

Conversation

westonruter commented Aug 2, 2017