Site Health applies auto_update_theme filter incorrectly

[bpayton]

The auto_update_{type} filters are ​documented to take an item object, but the WP_Debug_Data class, used by the Site Health page, passes an array instead.

This leads to PHP notices for existing auto_update_theme filters which treat the item argument as an object. For example, ​here is a Jetpack filter that treats the item argument as an object and triggers a PHP notice on the Site Health information page:

[04-Aug-2020 23:07:30 UTC] PHP Notice: Trying to get property 'theme' of non-object in /srv/htdocs/wp-content/plugins/jetpack/class.jetpack-autoupdate.php on line 93

How is it broken?

Both the Site Health page and the theme update logic consume the update_themes transient as a representation of which themes need updates and which do not. When the information is retrieved, each theme is represented by an array. The WP_Automatic_Updater class casts each theme array to an object prior to attempting an update ​here,
and because of this, when the class applies the auto_update_theme filter, it passes an item object.

In contrast, the Site Health information page, specifically the WP_Debug_Data class, doesn't cast the theme item array to an object before it applies auto_update_theme ​here, ​here, and ​here.

[bpayton]

Here's my take on a fix. It avoids the notices and allows my auto_update_theme filters to apply properly for the active, parent, and inactive themes on the Site Health information page.

[bpayton]

Here are instructions to reproduce the issue using WP-CLI. These should have been included in the original report.

Setup

Add the following filter in an mu-plugin to log the type of item passed to the filter:

<?php
add_filter( 'auto_update_theme', 'reproduce_auto_update_theme_inconsistency', 10, 2 );

function reproduce_auto_update_theme_inconsistency( $allow_update, $item ) {
        error_log( 'auto_update_theme item type is ' . gettype( $item ) );
        return $allow_update;
}

To observe correct usage of the filter in the auto update system:

1. Install an old version of a theme like wp theme install --force --version=1.4.6 zakra
2. Schedule and run theme auto updates:

wp cron event schedule wp_update_themes now
wp cron event schedule wp_version_check now
wp cron event run --due-now

3. Observe the following in the log output:

auto_update_theme item type is object

To observe the incorrect behavior by Site Health:

1. Navigate to the Site Health information view
2. Observe the log output contains messages like:

auto_update_theme item type is array

[pbiron]

Thanx @bpayton . I think your analysis is correct. Site Health does currently use an object when it needs to construct a "mock" item, but not in the other cases.

[pbiron]

50852.2.diff​ does what 50852.diff​ does and removes the now superfluous cast when assigning the "mock" themes to $item. That makes all of those assignments consistent, for readability.

[SergeyBiryukov]

In 48745:

Site Health: Consistently pass an object to the auto_update_{$type} filter in Site Health debug data.

Previously, some instances of the filter received an array from a plugin or theme update response, potentially triggering PHP notices.

Props bpayton, pbiron.
Fixes #50852.

[SergeyBiryukov]

Reopening for the 5.5 branch.

[desrosj]

In 48747:

Site Health: Consistently pass an object to the auto_update_{$type} filter in Site Health debug data.

Previously, some instances of the filter received an array from a plugin or theme update response, potentially triggering PHP notices.

Merges [48745] to the 5.5 branch.
Reviewed by desrosj, SergeyBiryukov.
Props bpayton, pbiron.
Fixes #50852.