Make WordPress Core

Opened 5 months ago

Last modified 5 months ago

#59494 new defect (bug)

Passing orderby as array in URL results in Notice

Reported by: nomnom99's profile NomNom99 Owned by:
Milestone: Awaiting Review Priority: normal
Severity: normal Version: 4.0
Component: Administration Keywords: has-patch
Focuses: Cc:

Description

Visiting /wp-admin/edit.php?post_type=page&orderby[menu_order]=ASC&orderby[title]=ASC
or
/wp-admin/edit.php?post_type=page&orderby%5Bmenu_order%5D=ASC&orderby%5Btitle%5D=ASC (URL encoded version) throws the following notice:

 Notice: Array to string conversion in /Users/siddharth/Sites/osp/app/public/wp-includes/formatting.php on line 1104

Since multiple values can be passed to orderby in get_posts() or WP_Query(), this behaviour should also be consistent via URL.

There error occurs at this line: https://github.com/WordPress/WordPress/blob/master/wp-admin/includes/class-wp-list-table.php#L391 because esc_attr() expects a string but $_REQUEST['orderby'] is an array.

Change History (4)

#1 @peterwilsoncc
5 months ago

  • Version changed from 6.3.1 to 4.0

Hi @NomNom99 and welcome back to trac!

This looks like something that was missed in [29027] for #17065 so I've updated the version number accordingly.

Ordering the list table via an array needs to be considered when rendering the hidden fields in the search form.

@NomNom99 Is this a patch you'd feel comfortable working on?

#2 @NomNom99
5 months ago

Thanks for looking into this @peterwilsoncc

I'll spend some time next week to raise a patch.

This ticket was mentioned in PR #5404 on WordPress/wordpress-develop by @LeonidasMilossis.


5 months ago
#3

  • Keywords has-patch added

#4 @LeonidasMilossis
5 months ago

Props to @pls78 as we paired on this.

We think that we have to cover multiple formats of arrays in query parameters. There are 2 types of formats we could think of:

  • /wp-admin/edit.php?post_type=page&orderby[menu_order]=ASC&orderby[title]=ASC - the OP's format
  • /wp-admin/edit.php?post_type=page&orderby[]=menu_order&orderby[]=title&order=asc - a different format we noticed that also works

The first one makes $_REQUEST['orderby'] into:

array(2) {
  ["menu_order"]=>
  string(3) "ASC"
  ["title"]=>
  string(3) "ASC"
}

and the second one makes it into:

array(2) {
  [0]=>
  string(10) "menu_order"
  [1]=>
  string(11) "menu_order2"
}

So, we created a PR that covers both.

Hope this helps!

Note: See TracTickets for help on using tickets.