Unchecked Input Condition in Widgets

[hakre]

In WP_Widget::__construct() - according to the documented specs - first parameter $id_base has to be unique.

Next to the fact that is not properly documented to what domain the uniqueness has to pay to, the input is not verified at all for uniqueness leaving the specification useless as well as leaving Wordpress open to a malfunction on the underlying data structures and models.

[nacin]

So we just need some docs?

[azaozz]

Replying to nacin:

So we just need some docs?

The uniqueness requirement is the same as for plugin and theme function names and since widgets are only added by plugins and themes, it seems pretty clear. It is well explained in the codex (prefixing a function name with unique string) and has been working well for years.

Perhaps we could add something to that effect to the phpdoc to remove any doubts.

[nacin]

I honestly can't see how we can make the inline docs more clear without being just redundant.