Make WordPress Core

Opened 7 years ago

Last modified 7 years ago

#40459 new enhancement

WP_Site::__set() and WP_Network::__set() allow to set any property without a way to retrieve it

Reported by: ocean90's profile ocean90 Owned by:
Milestone: Future Release Priority: low
Severity: normal Version: 4.6
Component: Networks and Sites Keywords: has-patch
Focuses: multisite Cc:


Noticed while working on #40458.

The magic setters of WP_Site and WP_Network allow to set any property via $this->$key = $value; but neither __set() nor __isset() can handle custom properties. Not sure if they should or if we should just block any non-default properties.

Attachments (1)

40459.patch (877 bytes) - added by bor0 7 years ago.

Download all attachments as: .zip

Change History (4)

7 years ago

#1 @bor0
7 years ago

  • Keywords has-patch added; needs-patch removed

This ticket was mentioned in Slack in #core-multisite by flixos90. View the logs.

7 years ago

#3 @MaximeCulea
7 years ago

  • Type changed from defect (bug) to enhancement

Hi @bor0,
We talked about this issue in the ticket-scrub.

By default, as a __set() method hasn't been created, when you set a non-existing property, it becomes public, so it can be accessed afterwards.

So now, as it hasn't been "block" in WP_Post, because WP_Post::__set() doesn't exists, the question is why we would implement it for WP_Site and WP_Network ?

Moreover and more generally, what did you expect about blocking non-existing property creation ?

Patch avenue :
If we wanna digg into this, we would have to remove the $this->$key = $value in the __set() method.

Note: See TracTickets for help on using tickets.