WordPress.org

Make WordPress Core

Opened 13 months ago

Last modified 13 months ago

#20850 new defect (bug)

Duplicate term insertion allowed after insertion with case differences

Reported by: jazbek Owned by:
Priority: normal Milestone: Awaiting Review
Component: Taxonomy Version: 3.3.2
Severity: normal Keywords: has-patch dev-feedback
Cc: knut@…, johnbillion, kpayne@…

Description

I've discovered a case where duplicate terms can be inserted with wp_insert_term(). Steps to reproduce:

  1. Insert a term, i.e.
     wp_insert_term('USA', 'country');
    
  2. Insert the same term, but with a different case, i.e.
     wp_insert_term('usa', 'country'); // it's ok that this succeeds, because technically it *is* different (case-wise)
    
  3. Insert the same term as in step 2. It should fail, but doesn't:
     wp_insert_term('usa', 'country'); // succeeds
    

This is because wp_insert_term() does the following:

  1. Finds the first term in the db that matches the initial (non-unique) slug for the new term name
  2. If the name of the found term doesn't match the new term name, then insert continues. In the example above, it's comparing all subsequent 'usa' term names to the first 'USA' term name and determining that it's ok to continue, when it's not because there are other 'usa' terms that it didn't look at.

Attachments (1)

20850.patch (1.1 KB) - added by kurtpayne 13 months ago.
Check the term name, not slug, use LIKE BINARY

Download all attachments as: .zip

Change History (6)

comment:1 knutsp13 months ago

  • Cc knut@… added

comment:2 johnbillion13 months ago

  • Cc johnbillion added

kurtpayne13 months ago

Check the term name, not slug, use LIKE BINARY

comment:3 follow-up: kurtpayne13 months ago

  • Cc kpayne@… added
  • Keywords has-patch dev-feedback added

Is there a reason duplicate term checking in wp_insert_term() uses the slug instead of the name?

comment:4 in reply to: ↑ 3 ; follow-up: DrewAPicture13 months ago

Replying to kurtpayne:

Is there a reason duplicate term checking in wp_insert_term() uses the slug instead of the name?

Probably because you can't have duplicate slugs, but I'd expect there to also be a check for the name. I'm guessing there are probably back-compat concerns for people who have existing terms of multiple casings and that's why it's still allowed.

Last edited 13 months ago by DrewAPicture (previous) (diff)

comment:5 in reply to: ↑ 4 kurtpayne13 months ago

Replying to DrewAPicture:

Probably because you can't have duplicate slugs

It looks like a unique slug is already picked via:

$slug = wp_unique_term_slug($slug, (object) $args);

Note: See TracTickets for help on using tickets.