Make WordPress Core

Opened 4 years ago

Closed 4 years ago

#50534 closed defect (bug) (duplicate)

Menu position conflicts not properly handled in add_menu_page function

Reported by: nufocusuk's profile nufocusuk Owned by:
Milestone: Priority: normal
Severity: normal Version: 5.5
Component: Administration Keywords:
Focuses: Cc:

Description (last modified by SergeyBiryukov)

In add_menu_page function inside plugin.php the assignment of new menu in the else condition should have $position inside quotes in the same way as the other lines.

If $position is passed in with a decimal value 103.768 (as supplied my MailChimp Forms by MailMunch plugin) then it fails to detect if $menu[103] has already been assigned by another plugin, but then overwrites it by impicitly treating $position as integer rather than a string as in $menu["103.768"].

Result is that random plugins can be missing from the admin menu.

if ( null === $position ) {
        $menu[] = $new_menu;
} elseif ( isset( $menu[ "$position" ] ) ) {
        $position            = $position + substr( base_convert( md5( $menu_slug . $menu_title ), 16, 10 ), -5 ) * 0.00001;
        $menu[ "$position" ] = $new_menu;
} else {
        $menu[ **$position** ] = $new_menu; //# should be change to **$menu[ "$position" ]  = $new_menu;**

Change History (2)

#1 @SergeyBiryukov
4 years ago

  • Component changed from General to Administration
  • Description modified (diff)

#2 @SergeyBiryukov
4 years ago

  • Milestone Awaiting Review deleted
  • Resolution set to duplicate
  • Status changed from new to closed

Hi there, welcome to WordPress Trac!

Thanks for the report, we're already tracking this issue in #40927.

Note: See TracTickets for help on using tickets.