WordPress.org

Make WordPress Core

Opened 4 years ago

Closed 4 years ago

#11506 closed defect (bug) (fixed)

Creation of unnamed option is possible

Reported by: hakre Owned by: ericmann
Milestone: 3.0 Priority: lowest
Severity: trivial Version: 2.9
Component: General Keywords: has-patch needs-testing
Focuses: Cc:

Description

I just looked into the DB on a wordpress setup and the otpion table contained an option with an empty option_name.

Not shure if this exactly is a bug but I would argue that an option should have a name otherwise it might not be possible to query it.

Attachments (2)

unnamed_option.diff (595 bytes) - added by ericmann 4 years ago.
A patch to validate the $option_name before updating the options table.
11506.diff (784 bytes) - added by ericmann 4 years ago.
Same patch as above, updates function documentation instead of adding commentary.

Download all attachments as: .zip

Change History (9)

comment:1 scribu4 years ago

I agree. If the option name is empty, it should not be inserted into the table.

comment:2 hakre4 years ago

  • Priority changed from normal to lowest
  • Severity changed from normal to trivial

Just tested this:

update_option('', '');

it does create an option with an empty name.

but it's not really a bug because it can be queried by get_option() properly. so nothing critical I assume.

ericmann4 years ago

A patch to validate the $option_name before updating the options table.

comment:3 ericmann4 years ago

  • Keywords has_patch needs_testing added
  • Owner set to ericmann
  • Status changed from new to accepted

The patch I just added will check to see if $option_name is empty or blank (whitespace) before adding it to the options table. If the $option_name is invalid, update_option() will return false.

comment:4 scribu4 years ago

  • Keywords has-patch needs-testing added; has_patch needs_testing removed

comment:5 ericmann4 years ago

  • Cc ericmann added

comment:6 scribu4 years ago

Patch looks good, but you could loose the comentary since it's obvious what the code does.

You could update the function documentation instead.

ericmann4 years ago

Same patch as above, updates function documentation instead of adding commentary.

comment:7 dd324 years ago

  • Resolution set to fixed
  • Status changed from accepted to closed

(In [13858]) Do not allow empty option names. Trim leading and trailing whitespace from option names. Partial patch props ericmann. Fixes #11506

Note: See TracTickets for help on using tickets.