Make WordPress Core

Opened 2 years ago

Last modified 2 years ago

#55220 new defect (bug)

Legacy widgets lack access to some usual server-side globals

Reported by: noisysocks's profile noisysocks Owned by:
Milestone: Future Release Priority: normal
Severity: normal Version:
Component: Widgets Keywords: needs-patch
Focuses: Cc:


Copied from


## Description

Legacy widgets whose behavior depends on the $pagenow global might not render as expected via the new /wp/v2/widget-types/fm-demo/encode REST API endpoint because $pagenow during these requests is index.php, not widget.php.

Additionally, legacy widgets are no longer able to rely on the $_POST['action'] variable during requests to save widget data, which is usually set to save-widget, and these widgets might not be able to save data as expected.

Similarly, legacy widgets are no longer able to rely on DOING_AJAX or wp_doing_ajax(), although that is typical of the REST API.

## Step-by-step reproduction instructions

The easiest way to observe this behavior is to observe $pagenow and $_POST using Xdebug with a breakpoint inside of WP_REST_Widget_Types_Controller::encode_form_data().

To see the effect of the behavior on a real-world library:

  1. Clone and include the Fieldmanager library:
  2. Clone and include the Fieldmanager Widgets extension:
  3. Load the demo widget included in the README:
  4. Step through the \fm_widgets_calculated_context() function, which relies on all of the signals mentioned in the description.

## Expected behaviour

With respect to legacy widgets, $pagenow will be widgets.php during form rendering, and $_POST['action'] will be save-widget during saving.

## Actual behaviour

$pagenow is index.php, and $_POST['action'] is unset.

## Code snippet (optional)

See README link above.

## WordPress information

  • WordPress version: 5.8-RC2
  • Gutenberg version: Not installed
  • Are all plugins except Gutenberg deactivated? No, see repro steps.
  • Are you using a default theme (e.g. Twenty Twenty-One)? Yes

## Device information

  • Device: Desktop
  • Operating system: macOS 10.14
  • Browser: Chrome 91

Change History (2)

#1 @noisysocks
2 years ago

I'm okay with spoofing these variables for the REST API endpoints that call into WP_Widget::widget and WP_Widget::update.

global $pagenow;
$pagenow = 'widgets.php';
$_POST['action'] = 'save-widget';

#2 @SergeyBiryukov
2 years ago

  • Keywords needs-patch added
Note: See TracTickets for help on using tickets.