HTML5 "required" attribute in Widget form() fails in ajax-actions.php during save

[Andy Schmidt]

If a field on a widget settings form uses the HTML5 "required" attribute, then saving the settings will only APPEAR to have "saved" the form content.

In reality, the result is:

Undefined index: widgetbaseid-nn in wp-admin\includes\ajax-actions.php on line 1998
Stack trace:
1. {main}() E:\Hosted Sites\wwwroot\wp-admin\admin-ajax.php:0
2. do_action() E:\Hosted Sites\wwwroot\wp-admin\admin-ajax.php:97
3. WP_Hook->do_action() E:\Hosted Sites\wwwroot\wp-includes\plugin.php:453
4. WP_Hook->apply_filters() E:\Hosted Sites\wwwroot\wp-includes\class-wp-hook.php:310
5. wp_ajax_save_widget() E:\Hosted Sites\wwwroot\wp-includes\class-wp-hook.php:286

Simply removing the "required" attribute from this input field, will circumvent the bug:

<?php
        <input class="widefat" type="text" required="required" id="<?php echo \esc_attr( $this->get_field_id( 'addtlfld' ) ); ?>" name="<?php echo \esc_attr( $this->get_field_name( 'addtlfld' ) ); ?>" value="<?php echo \esc_attr( $old_settings[ 'addtlfld' ] ?? '' ); ?>">

Attached is a plugin with two versions of the widget - one has regular text field, the other has the same text field but uses the "required" attribute.
Uses PHP 7.1 syntax.

[Andy Schmidt]

Plugin with two versions of Widget - one works, one fails.

[westonruter]

@Andy-Schmidt Support for validity constraints was added in [41352]. You can see this in:

		if ( form.prop( 'checkValidity' ) && ! form[0].checkValidity() ) {
			return;
		}

When you say it appears to save, does the Save button become disabled and the dirty state clear? Can you leave the widgets admin screen and not get prompted to save? Is it just that validity reporting isn't happening?

[Andy Schmidt]

Replying to westonruter:

When you say it appears to save, does the Save button become disabled and the dirty state clear? <<

If I can figure out how, I'll attach a screen shot what happens when you press Save (with Debug mode on so that you can see the PHP error). The "Save" button will changed to "Saved". You can click "Done" to exit the instance, and the instance will be an item in the list of widgets for that sidebar, as if it had been successfully saved.

However, if you exit the Widget section of the admin, click some other admin function and then RETURN to the Widget admin, that particular Widget instance does NOT appear in that side bar any more. So in reality it was never properly saved/tied into that sidebar.

Is it just that validity reporting isn't happening? <<

The "required" attribute seems to be active as far as HTML. The error will NOT occur as long as I try to save with a required field not yet entered. However, the moment I correctly complete the form with ALL required fields, THEN the "Save" button triggers the PHP error.

Support for validity constraints was added <<

Maybe an error was introduced when it was added. I'm producing this problem with 4.9.1!

[Andy Schmidt]

Result when pressing "SAVE" in Widget admin form for this instance.

[westonruter]

@Andy-Schmidt please test 43003.0.diff​. The problem is that when adding a new widget, the checkValidity call was being made. So this patch disables the check when adding a widget.

[Andy Schmidt]

Unfortunately, I am UNABLE to confirm. If the (equivalent) patch is applied to 4.9.1 (see screenshot of code), there is no difference in behavior. I reconfirmed (using browser network trace), that the updated Widgets.js is being served up.

Oddly though, I do NOT find Widgets.js ever having being requested by the browser? I then checked the server's HTTP logs directly - and there too I see no HTTP request for Widgets.js having occurred?

[Andy Schmidt]

Appach applied to equiv. location of 4.9.1

[westonruter]

@Andy-Schmidt In order to test the patch, you must add define( 'SCRIPT_DEBUG', true ); to your wp-config.php. Otherwise, the minified JS will be loaded and concatenated via load-scripts.php. That's why you're not seeing a request to widgets.php.

[Andy Schmidt]

Replying to westonruter:

@Andy-Schmidt In order to test the patch, you must add define( 'SCRIPT_DEBUG', true );

Thanks for those instructions. I've now confirmed the problem is fixed.

[dd32]

Bumping to 4.9.3 due to 4.9.2s release

[westonruter]

In 42521:

Widgets: Prevent checkValidity from running on a form when widget is first adding to sidebar.

Amends [41352].
See #23120.
Fixes #43003 for trunk.

[westonruter]

In 42522:

Widgets: Prevent checkValidity from running on a form when widget is first adding to sidebar.

Amends [41352].
See #23120.
Fixes #43003 for 4.9 branch.