WordPress.org

Make WordPress Core

Opened 6 years ago

Closed 5 years ago

#11506 closed defect (bug) (fixed)

Creation of unnamed option is possible

Reported by: hakre Owned by: ericmann
Milestone: 3.0 Priority: lowest
Severity: trivial Version: 2.9
Component: General Keywords: has-patch needs-testing
Focuses: Cc:

Description

I just looked into the DB on a wordpress setup and the otpion table contained an option with an empty option_name.

Not shure if this exactly is a bug but I would argue that an option should have a name otherwise it might not be possible to query it.

Attachments (2)

unnamed_option.diff (595 bytes) - added by ericmann 6 years ago.
A patch to validate the $option_name before updating the options table.
11506.diff (784 bytes) - added by ericmann 5 years ago.
Same patch as above, updates function documentation instead of adding commentary.

Download all attachments as: .zip

Change History (9)

comment:1 @scribu6 years ago

I agree. If the option name is empty, it should not be inserted into the table.

comment:2 @hakre6 years ago

  • Priority changed from normal to lowest
  • Severity changed from normal to trivial

Just tested this:

update_option('', '');

it does create an option with an empty name.

but it's not really a bug because it can be queried by get_option() properly. so nothing critical I assume.

@ericmann6 years ago

A patch to validate the $option_name before updating the options table.

comment:3 @ericmann6 years ago

  • Keywords has_patch needs_testing added
  • Owner set to ericmann
  • Status changed from new to accepted

The patch I just added will check to see if $option_name is empty or blank (whitespace) before adding it to the options table. If the $option_name is invalid, update_option() will return false.

comment:4 @scribu6 years ago

  • Keywords has-patch needs-testing added; has_patch needs_testing removed

comment:5 @ericmann6 years ago

  • Cc ericmann added

comment:6 @scribu5 years ago

Patch looks good, but you could loose the comentary since it's obvious what the code does.

You could update the function documentation instead.

@ericmann5 years ago

Same patch as above, updates function documentation instead of adding commentary.

comment:7 @dd325 years ago

  • Resolution set to fixed
  • Status changed from accepted to closed

(In [13858]) Do not allow empty option names. Trim leading and trailing whitespace from option names. Partial patch props ericmann. Fixes #11506

Note: See TracTickets for help on using tickets.