WordPress.org

Make WordPress Core

Opened 5 years ago

Closed 5 years ago

#11112 closed defect (bug) (fixed)

get_term() does not verify for valid output from wpdb::get_row()

Reported by: johncoswell Owned by: filosofo
Milestone: 2.9 Priority: low
Severity: minor Version: 2.9
Component: Taxonomy Keywords: has-patch
Focuses: Cc:

Description

It's possible for wpdb::get_row() to return invalid data from a request to get_term(), yet there's no type checking done on the return value from wpdb::get_row(), which can cause PHP to raise warnings when returning something other than an object. Something similar to this should fix the issue (/wp-includes/taxonomy.php, ~line 332):

if (is_object($_term)) {
  if ($output == OBJECT) {
    ...
  } elseif (...) {
    ...
  }
} else {
  return $_term; // or maybe WP_Error
}

Attachments (1)

get_term.diff (441 bytes) - added by scribu 5 years ago.
Type check before doing anything else

Download all attachments as: .zip

Change History (6)

comment:1 scribu5 years ago

  • Keywords reporter-feedback added

This is the documented return value:

 * @return mixed|null|WP_Error Term Row from database. Will return null if $term is empty. If taxonomy does not exist then WP_Error will be returned.

So it's the expected behaviour. Could you paste a specific error and in what context you got it?

comment:2 johncoswell5 years ago

The error message: get_object_vars() expects parameter 1 to be object, null given in wp-includes\taxonomy.php on line 335

The function get_category() is being called with $object set to ARRAY_A. If the requested category ID that is passed to get_category(), which is subsequently passed to wpdb::get_row(), does not exist in the database, or some other failure occurs within wpdb::get_row(), wpdb::get_row() can return a non-object value such as null. When the code falls through to the section returning the output, and ARRAY_A or ARRAY_N is provided as $object, this non-object value will be passed to get_object_vars(), raising the warning. This warning is not raised in any other state for $object, as those cause $_term to be returned untouched.

scribu5 years ago

Type check before doing anything else

comment:3 scribu5 years ago

  • Keywords has-patch added; reporter-feedback removed
  • Milestone changed from Unassigned to 2.9

Oh, I see. You're right. It should check for a null value before filtering, etc.

See attached patch.

comment:4 johncoswell5 years ago

That should do it. Thanks.

comment:5 ryan5 years ago

  • Resolution set to fixed
  • Status changed from new to closed

(In [12200]) Return null if no term queried. fixes #11112

Note: See TracTickets for help on using tickets.