Ticket #52995: 52995.diff

src/wp-includes/post.php

@@ -2558 +2558 @@
                         } else {
                                 $value = format_to_edit( $value );
                         }
-                } else {
+                } elseif ( ! in_array( $field, $int_fields, true ) || ! is_int( $value ) ) {
                         $value = esc_attr( $value );
                 }
         } elseif ( 'db' === $context ) {
@@ -2626 +2626 @@
                         $value = apply_filters( "post_{$field}", $value, $post_id, $context );
                 }
 
-                if ( 'attribute' === $context ) {
-                        $value = esc_attr( $value );
-                } elseif ( 'js' === $context ) {
-                        $value = esc_js( $value );
+                if ( ! in_array( $field, $int_fields, true ) || ! is_int( $value ) ) {
+                        if ( 'attribute' === $context ) {
+                                $value = esc_attr( $value );
+                        } elseif ( 'js' === $context ) {
+                                $value = esc_js( $value );
+                        }
                 }
         }
 

tests/phpunit/tests/post/objects.php

@@ -184 +184 @@
                 $this->assertSame( esc_js( "Mary's home" ), $raw_post->post_title );
         }
 
+        /**
+         * @ticket 52995
+         */
+        function test_numeric_properties_should_be_cast_to_ints() {
+                $post_id  = self::factory()->post->create();
+                $contexts = array( 'raw', 'edit', 'db', 'display', 'attribute', 'js' );
+
+                foreach ( $contexts as $context ) {
+                        $post = get_post( $post_id, OBJECT, $context );
+
+                        $this->assertSame( $context, $post->filter );
+                        $this->assertInternalType( 'int', $post->ID );
+                        $this->assertInternalType( 'int', $post->post_parent );
+                        $this->assertInternalType( 'int', $post->menu_order );
+                }
+        }
+
         function test_get_post_identity() {
                 $post = get_post( self::factory()->post->create() );