starter content theme_mods/options throw php warning if not string

[timph]

theme_mods/options can be mixed:
​https://developer.wordpress.org/reference/functions/set_theme_mod/
​https://developer.wordpress.org/reference/functions/update_option/

When the starter content is checking for the post symbols in theme_mods/options it does a preg_match on the value, which throws PHP warnings:

here: ​https://github.com/WordPress/WordPress/blob/4.9-branch/wp-includes/class-wp-customize-manager.php#L1531

In the very least it would be nice if core could check if is_array. Better would be a more comprehensive check based on types, to attempt to extract the post symbols for the many types of theme_mods/options that people set.

[SergeyBiryukov]

Hi @timph, thanks for the ticket!

Could you provide an example of affected values and the warnings they trigger?

[timph]

Sure @SergeyBiryukov - if you add this to twenty-ninteen's functions.php file:

add_theme_support( 'starter-content', [
        'theme_mods' => [
                'testing' => [ 1, 2, 3 ],
        ],
] );

It results in: [21-Mar-2019 22:59:12 UTC] PHP Warning: preg_match() expects parameter 2 to be string, array given in /srv/www/wordpress-default/public_html/wp-includes/class-wp-customize-manager.php on line 1548

[timph]

Patch can be tested by adding this code to twenty-nineteen's functions.php:

add_action( 'after_setup_theme', 'add_testing_theme_support' );
add_action( 'customize_register', 'add_testing_customizer_settings' );

function add_testing_theme_support() {
	add_theme_support( 'starter-content', [
		'attachments' => [
			'test' => [
				'post_title' => 'testing for post ID',
				'file' => 'screenshot.png',
			],
		],
		'theme_mods' => [
			'testing' => [ 1, '{{test}}', 3 ],
			'testing_string' => '{{test}}',
		],
		'options' => [
			'testing' => [ 1, 2, '{{test}}' ],
		],
	] );
}

function add_testing_customizer_settings( $wp_customize ) {
	$wp_customize->add_setting( 'testing' , [
		'default'     => 0,
		'transport'   => 'postMessage',
	] );
	$wp_customize->add_setting( 'testing_string' , [
		'default'     => '',
		'transport'   => 'postMessage',
	] );
}

If you're not using a fresh_site install, you will need to manually force that state, you can add this to the same functions.php file:

update_option( 'fresh_site', 1  );

Now go into the customizer, and you will get PHP warning for not being able to preg_match on the values passed as they are arrays, like these:

[22-Mar-2019 03:25:50 UTC] PHP Warning:  preg_match() expects parameter 2 to be string, array given in /srv/www/wordpress-default/public_html/wp-includes/class-wp-customize-manager.php on line 1526
[22-Mar-2019 03:25:50 UTC] PHP Warning:  preg_match() expects parameter 2 to be string, array given in /srv/www/wordpress-default/public_html/wp-includes/class-wp-customize-manager.php on line 1544

Now apply patch, and follow the same steps. You should no longer receive PHP warnings.

From the browser console, you can verify the correct value is set in the array for the theme_mod using the customizer js api:

wp.customize( 'testing' )();

The code for options vs theme_mods is pretty much identical, so it could probably be consolidated if necessary.

---

The patch does the following steps for theme_mods and options:

1. serialize value with maybe_serialize()
2. check for post symbol matches on strings.
3. replace these strings with post ID ints.
4. unserialize value with maybe_unserialize() so values can be properly used.

[timph]

check if value is serialized for treatment

[timph]

In terms of testing this, I have tested various theme mods which had values serialized in this step, and the post symbols have all been able to be successfully updated. In doing testing, the values which were strings also still are functional as they were before this patch and testing. This has been a pretty big barrier for themes to work around if they decide to support starter content.

[SergeyBiryukov]

Per discussion with the Theme Review Team, moving back for now to review the patch in the next few days.

[JarretC]

Tested based upon information given in ticket and can confirm that the PHP warning no longer exists after the patch is applied and the customizer is loaded.

[SergeyBiryukov]

In 46548:

Customize: Ensure that WP_Customize_Manager::import_theme_starter_content() properly handles starter content with (nested) arrays as values.

Previously, searching for symbol references to replace with post or attachment IDs in array values resulted in a PHP warning.

Props timph, JarretC, SergeyBiryukov.
Fixes #45484.