Context Navigation

← Previous Ticket
Next Ticket →

#44809 closed defect (bug) (fixed)

Safeguard `has_errors()` check in extra Customizer validation

Reported by:	flixos90	Owned by:	flixos90
Priority:	normal	Milestone:	5.0.3
Component:	Customize	Version:	4.7
Severity:	normal	Keywords:	has-patch fixed-major
Cc:		Focuses:

Description

The customize_validate_{$setting_id} filter is run in both the WP_Customize_Setting class, but then again in WP_Customize_Manager, to account for cases where someone might have overridden that method without maintaining the filter.

I ran into an issue earlier causing a fatal error: While the documentation for customize_validate_{$setting->id} states that the parameter is a WP_Error, several plugins and themes have been returning true in case of success. This is correctly taken care of in WP_Customize_Setting, but not when the filter is executed again in WP_Customize_Manager::validate_setting_values(). has_errors() is called on the filter result, which however (unfortunately) may not always be a WP_Error object. We should add a is_wp_error() check to be safe.

Attachments (1)

44809.diff (690 bytes ) - added by flixos90 8 years ago.

Download all attachments as: .zip

Change History (14)

@flixos90
8 years ago

Attachment 44809.diff added

#1 @flixos90
8 years ago

Keywords has-patch added; needs-patch removed

44809.diff fixes the issue.

#2 @westonruter
8 years ago

Keywords commit added
Milestone Awaiting Review → 4.9.9
Version → 4.7

Good change. Feel free to commit!

Introduced in #37638.

#3 @flixos90
8 years ago

Owner set to flixos90
Resolution → fixed
Status new → closed

In 43578:

Customize: Safeguard a check on the customize_validate_{$setting_id} filter value to ensure it is a WP_Error.

While the filter is documented to only support a WP_Error, it has been a common practice to return true in a validation function if no errors have occurred. This was already caught when the same filter was executed in WP_Customize_Setting, it was however missing in WP_Customize_Manager::validate_setting_values().

Fixes #44809.