Context Navigation

← Previous Ticket
Next Ticket →

#54840 closed defect (bug) (fixed)

wp_insert_term sanitizes attribute names, while term_exists does not before checking names

Reported by:	Dekadinious	Owned by:
Priority:	normal	Milestone:	6.0
Component:	Taxonomy	Version:	5.8.2
Severity:	normal	Keywords:	has-patch has-unit-tests needs-testing has-test-info
Cc:		Focuses:

Description

We have found an edge-case bug in the way term_exists handles checking for existing names compared to how wp_insert_term inserts the names. This happens if you are in a situation where the term name has an ampersand, and term_exists reach the point where it needs to check for the name. This happened to us because we have a suffix on each term slug.

So if we are creating the term "X & Y", the slug will be "x-y-suffix". Therefore, there is no "x-y" slug in the database. The term_exists function will therefore not find the slug and will check for the name instead.

When checking for the name, it will see if "X & Y" exists in the database. It does not, because wp_insert_term sanitizes the name and inserts it as "X & Y".

The behavior is inconsistent. I would expect term_exist to find that the term exists when checking for the exact name used in wp_insert_term.

Change History (8)

#1 @costdev
4 years ago

Test Report

Env

WordPress: trunk
Chrome 97.0.4692.71
Windows 10
Theme: Twenty Twenty One
Gutenberg Editor
Plugin: None activated

Steps to test

Navigate to Posts > Categories.
Insert a category called X & Y with the slug x-y-suffix.
Add wp_die( var_export( term_exists( 'X & Y' ), true ) ); into the active theme's functions.php file.
Refresh the page.
Actual output: NULL. Expected output: <the term's ID>.

Cleanup

Must be done before re-testing.

Remove the line added to the active theme's functions.php file.
Navigate to Posts > Categories.
Delete the X & Y category.

Results

Issue reproduced ✅

Last edited 4 years ago by costdev (previous) (diff)

This ticket was mentioned in PR #2180 on WordPress/wordpress-develop by costdev.

4 years ago #2

Keywords has-patch has-unit-tests added

Trac ticket: https://core.trac.wordpress.org/ticket/54840

#3 follow-up: ↓ 5 @costdev
4 years ago

Keywords needs-testing has-testing-info added
Milestone Awaiting Review → 6.0

PR added with unit tests. Milestoning for 6.0.

#4 @dlh
4 years ago

#47351 was marked as a duplicate.

#5 in reply to: ↑ 3 @Dekadinious
4 years ago

Replying to costdev:

PR added with unit tests. Milestoning for 6.0.

I don't know if this should be posted here as a comment, or if a new ticket should be created, but this seems to happen with get_terms() also. If you choose to fetch by name but don't run esc_attr() first, it will not find a term with single quotes in it. One would think get_terms() would find a term inserted by wp_insert_term() without modifications.

Version 0, edited 4 years ago by Dekadinious (next)

#6 @costdev
4 years ago

Resolution → fixed
Status new → closed

This particular issue appears to have been resolved by [52921]. In my testing, the term ID is returned now. Closing this ticket as fixed.

With regards to this comment, if an issue exists in get_terms(), this should be handled in a separate ticket.

costdev commented on PR #2180:

4 years ago #7

This issue appears to be fixed by 52921.

#8 @wordpressdotorg
14 months ago

Keywords has-test-info added; has-testing-info removed

Note: See TracTickets for help on using tickets.

Download in other formats:

Make WordPress Core

Context Navigation

#54840 closed defect (bug) (fixed)

wp_insert_term sanitizes attribute names, while term_exists does not before checking names

Description

Change History (8)

#1 @costdev 4 years ago

Test Report

Env

Steps to test

Cleanup

Results

This ticket was mentioned in ​PR #2180 on ​WordPress/wordpress-develop by ​costdev. 4 years ago #2

#3 follow-up: ↓ 5 @costdev 4 years ago

#4 @dlh 4 years ago

#5 in reply to: ↑ 3 @Dekadinious 4 years ago

#6 @costdev 4 years ago

​costdev commented on ​PR #2180: 4 years ago #7

#8 @wordpressdotorg 14 months ago