Changeset 44546 for trunk/src/wp-includes/class-wp-comment-query.php

Timestamp:

01/10/2019 09:05:50 PM (8 years ago)

Author:

flixos90

Message:

General: Fix problematic string to array parsing.

WordPress has historically often used code like preg_split( '/[\s,]+/', $var ) to parse a string of comma-separated values into an array. However, this approach was causing an empty string to not be parsed into an empty array as expected, but rather into an array with the empty string as its sole element.

This was among other areas causing problems in the REST API where passing an empty request parameter could cause that request to fail because, instead of it being ignored, that parameter would be compared against the valid values for it, which typically do not include an empty string.

Props david.binda, sstoqnov.
Fixes #43977.

File:

• trunk/src/wp-includes/class-wp-comment-query.php (modified) (2 diffs)

trunk/src/wp-includes/class-wp-comment-query.php

@@ -483 +483 @@
                 // 'status' accepts an array or a comma-separated string.
                 $status_clauses = array();
-                $statuses       = $this->query_vars['status'];
-                if ( ! is_array( $statuses ) ) {
-                        $statuses = preg_split( '/[\s,]+/', $statuses );
+                $statuses       = wp_parse_list( $this->query_vars['status'] );
+
+                // Empty 'status' should be interpreted as 'all'.
+                if ( empty( $statuses ) ) {
+                        $statuses = array( 'all' );
                 }
 
@@ -518 +520 @@
                 // User IDs or emails whose unapproved comments are included, regardless of $status.
                 if ( ! empty( $this->query_vars['include_unapproved'] ) ) {
-                        $include_unapproved = $this->query_vars['include_unapproved'];
-
-                        // Accepts arrays or comma-separated strings.
-                        if ( ! is_array( $include_unapproved ) ) {
-                                $include_unapproved = preg_split( '/[\s,]+/', $include_unapproved );
-                        }
-
-                        $unapproved_ids = $unapproved_emails = array();
+                        $include_unapproved = wp_parse_list( $this->query_vars['include_unapproved'] );
+
+                        $unapproved_ids    = array();
+                        $unapproved_emails = array();
                         foreach ( $include_unapproved as $unapproved_identifier ) {
                                 // Numeric values are assumed to be user ids.