sanitize_title() in dynamic_sidebar() restricts the use of specific characters for sidebar IDs

[paulvandermeijs]

In the dynamic_sidebar() function in wp-includes/widgets.php uses sanitize_title() on the given index when it looks for a sidebar with a name that matches the index. After that it leaves the index value sanitized making it impossible to use characters not allowed by sanitize_title() in a sidebar ID.

By not overwriting the given index value with the sanitized version it would still be possible to use any character for the ID. To achieve this, lines 847-853

$index = sanitize_title($index);
foreach ( (array) $wp_registered_sidebars as $key => $value ) {
	if ( sanitize_title($value['name']) == $index ) {
		$index = $key;
		break;
	}
}

should be replaced with

$sanitized_index = sanitize_title($index);
foreach ( (array) $wp_registered_sidebars as $key => $value ) {
	if ( sanitize_title($value['name']) == $sanitized_index ) {
		$index = $key;
		break;
	}
}

[SergeyBiryukov]

Related: [5473] (for #4258).

[fjarrett]

Patch allowing unsanitized $index

[SergeyBiryukov]

Related: #17201, #22116

[wonderboymusic]

Unit tests if possible

[tyxla]

Refreshing patch to work with the new location of dynamic_sidebar()

[tyxla]

Attaching a unit test for the reported issue

[tyxla]

I've just uploaded 2 patches:

• 23423.patch​ - refreshed version of the old patch to work with the latest location of dynamic_sidebar();
• 23423-test.patch​ - contains a unit test of the reported issue.

[wonderboymusic]

In 34465:

Widgets: when passing a string arg value to dynamic_sidebar(), don't reset $index when the arg's sanitized value matches the sanitized name of a sidebar.

Adds unit test.

Props tyxla, fjarrett.
Fixes #23423.

[SergeyBiryukov]

This introduced a regression, see #34995.

[SergeyBiryukov]

In 36130:

Widgets: Revert [34465], as it introduced a regression, making the $index argument of dynamic_sidebar() case-sensitive.

Fixes #34995 for trunk. See #23423.

[SergeyBiryukov]

Needs a new patch and a new test, see comment:7:ticket:34995 and comment:15:ticket:34995.

[dd32]

In 36148:

Widgets: Revert [34465], as it introduced a regression, making the $index argument of dynamic_sidebar() case-sensitive.

Merges [36130] to the 4.4 branch.
See #23423.
Fixes #34995.