Changeset 53857

Timestamp:

08/07/2022 11:03:57 PM (2 years ago)

Author:

peterwilsoncc

Message:

Rewrite rules: Prevent malformed date requests throwing notices.

Ensure that date queries contain each component before attempting to use them. This prevents http requests triggering notices if a portion of the date is missing. For example a request containing a day and year but no month, a request containing a month bu not year.

Props ovidiul, dd32, peterwilsoncc, costdev, johnbillion, SergeyBiryukov, desrosj, tremidkhar, hellofromTonya.
Fixes #52252.

Location:

trunk

Files:

• src/wp-includes/rewrite.php (modified) (1 diff)
• tests/phpunit/tests/query.php (modified) (3 diffs)

trunk/src/wp-includes/rewrite.php

@@ -411 +411 @@
 
     // This is the potentially clashing slug.
-    $value = $query_vars[ $compare ];
+    $value = '';
+    if ( $compare && array_key_exists( $compare, $query_vars ) ) {
+        $value = $query_vars[ $compare ];
+    }
 
     $post = get_page_by_path( $value, OBJECT, 'post' );

trunk/tests/phpunit/tests/query.php

@@ -2 +2 @@
 
 class Tests_Query extends WP_UnitTestCase {
+
+    /**
+     * Fixed date post ID.
+     *
+     * @var int
+     */
+    public static $post_with_date;
 
     public function set_up() {
@@ -8 +15 @@
         $this->set_permalink_structure( '/%year%/%monthnum%/%day%/%postname%/' );
         create_initial_taxonomies();
+    }
+
+    public static function wpSetUpBeforeClass( WP_UnitTest_Factory $factory ) {
+        self::$post_with_date = $factory->post->create(
+            array(
+                'post_date' => '2020-01-05 12:00:00',
+                'post_name' => 'post-with-date',
+            )
+        );
     }
 
@@ -699 +715 @@
 
     /**
+     * @ticket 52252
+     * @dataProvider data_malformed_date_queries
+     *
+     * @param string $permalink_structure Permalink structure.
+     * @param array $query_vars Querystring parameteres.
+     */
+    public function test_malformed_date_queries( $permalink_structure, $query_vars ) {
+        $this->set_permalink_structure( $permalink_structure );
+        $this->go_to( add_query_arg( $query_vars, home_url() ) );
+
+        /*
+         * Ticket 52252 was to prevent notices from being thrown
+         * if the date query is malformed.
+         *
+         * The test will automatically fail if the function triggers a notice,
+         * so this dummy assertion is just for accurate stats.
+         */
+        $this->assertTrue( true );
+    }
+
+    /**
+     * Data provider for test_malformed_date_queries.
+     *
+     * @return array Test data.
+     */
+    public function data_malformed_date_queries() {
+        return array(
+            '/%postname%/ with missing year'         => array(
+                '/%postname%/',
+                array(
+                    'monthnum' => 1,
+                    'day'      => 15,
+                ),
+            ),
+            '/%postname%/ with month only'           => array(
+                '/%postname%/',
+                array(
+                    'monthnum' => 1,
+                ),
+            ),
+            '/%year%/%postname%/ with missing month' => array(
+                '/%year%/%postname%/',
+                array(
+                    'year' => 2020,
+                    'day'  => 15,
+                ),
+            ),
+        );
+    }
+
+    /**
      * @ticket 55100
      */