Changeset 48981

Timestamp:

09/16/2020 02:27:42 AM (4 years ago)

Author:

SergeyBiryukov

Message:

Code Modernization: Return an empty string from wpdb::prepare() if there are not enough arguments to match the placeholders.

This avoids a fatal error on PHP 8 caused by passing mismatched arguments to vsprintf(), and maintains the current behaviour.

Follow-up to [48979], [48980].

See #50913, #50639.

File:

• trunk/src/wp-includes/wp-db.php (modified) (2 diffs)

trunk/src/wp-includes/wp-db.php

@@ -1370 +1370 @@
         $placeholders = preg_match_all( "/(^|[^%]|(%%)+)%($allowed_format)?[sdF]/", $query, $matches );
 
-        if ( count( $args ) !== $placeholders ) {
+        $args_count = count( $args );
+
+        if ( $args_count !== $placeholders ) {
             if ( 1 === $placeholders && $passed_as_array ) {
                 // If the passed query only expected one argument, but the wrong number of arguments were sent as an array, bail.
@@ -1393 +1395 @@
                         __( 'The query does not contain the correct number of placeholders (%1$d) for the number of arguments passed (%2$d).' ),
                         $placeholders,
-                        count( $args )
+                        $args_count
                     ),
                     '4.8.3'
                 );
+
+                /*
+                 * If we don't have enough arguments to match the placeholders,
+                 * return an empty string to avoid a fatal error on PHP 8.
+                 */
+                if ( $args_count < $placeholders ) {
+                    $max_numbered_placeholder = ! empty( $matches[3] ) ? max( array_map( 'intval', $matches[3] ) ) : 0;
+
+                    if ( ! $max_numbered_placeholder || $args_count < $max_numbered_placeholder ) {
+                        return '';
+                    }
+                }
             }
         }