WordPress.org

Make WordPress Core

Opened 5 weeks ago

Last modified 5 weeks ago

#47564 new defect (bug)

Protect against recursive customizer navigation menu data

Reported by: donpark Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version:
Component: Customize Keywords: has-patch reporter-feedback
Focuses: Cc:

Description (last modified by dd32)

Recursive data can slip into navigation menu structure but client-script currently has no protection against, resulting in browser freezing when trying to edit navigation menus.

Attached patch changes getDepth() to keep track of parent navigation menu item ID to avoid recursion.

Attachments (1)

fix_customizer_nav_menu_freeze.diff (835 bytes) - added by donpark 5 weeks ago.

Download all attachments as: .zip

Change History (6)

#1 follow-up: @dlh
5 weeks ago

  • Keywords reporter-feedback added

Hey @donpark — thanks for submitting this report and patch. Are you able to provide steps to replicate the bug in core?

#2 in reply to: ↑ 1 @donpark
5 weeks ago

Replying to dlh:

Hey @donpark — thanks for submitting this report and patch. Are you able to provide steps to replicate the bug in core?

Only in context of a particular site on WordPress.com. And testing plan, detailed in the A8C internal Phabricator patch I mentioned (D29638-code), requires the tester be an Automattician.

Given these obstacles, I think this ticket is best assigned to an Automattician with WP.org commit privileage.

  • Don

#3 follow-up: @dlh
5 weeks ago

  • Version trunk deleted

OK. Speaking for myself, there's nothing I can do to "assign" the ticket to anyone. So, absent more information, I'm not sure what to do other than wait for an Automattician to volunteer to try to confirm that there's a bug in core and, if so, how to replicate it. (To that end, I'll leave the reporter-feedback tag on the ticket for now.)

#4 in reply to: ↑ 3 @donpark
5 weeks ago

Replying to dlh:

OK. Speaking for myself, there's nothing I can do to "assign" the ticket to anyone. So, absent more information, I'm not sure what to do other than wait for an Automattician to volunteer to try to confirm that there's a bug in core and, if so, how to replicate it. (To that end, I'll leave the reporter-feedback tag on the ticket for now.)

Fair enough. I'll see if I can get someone here to pick up the baton. Thx for the help, David. :-)

#5 @dd32
5 weeks ago

  • Description modified (diff)
Note: See TracTickets for help on using tickets.