Opened 8 years ago
Last modified 8 years ago
#40459 new enhancement
WP_Site::__set() and WP_Network::__set() allow to set any property without a way to retrieve it
Reported by: |
|
Owned by: | |
---|---|---|---|
Milestone: | Future Release | Priority: | low |
Severity: | normal | Version: | 4.6 |
Component: | Networks and Sites | Keywords: | has-patch |
Focuses: | multisite | Cc: |
Description
Noticed while working on #40458.
The magic setters of WP_Site
and WP_Network
allow to set any property via $this->$key = $value;
but neither __set()
nor __isset()
can handle custom properties. Not sure if they should or if we should just block any non-default properties.
Attachments (1)
Change History (4)
Note: See
TracTickets for help on using
tickets.
Hi @bor0,
We talked about this issue in the ticket-scrub.
By default, as a
__set()
method hasn't been created, when you set a non-existing property, it becomes public, so it can be accessed afterwards.So now, as it hasn't been "block" in
WP_Post
, becauseWP_Post::__set()
doesn't exists, the question is why we would implement it forWP_Site
andWP_Network
?Moreover and more generally, what did you expect about blocking non-existing property creation ?
Patch avenue :
If we wanna digg into this, we would have to remove the
$this->$key = $value
in the__set()
method.