PHP Deprecated warnings with null values for success and reject URLs

[dhruvang21]

If the $success_url or $reject_url are set to null, then running esc_url() on those for ​hidden inputs could produce PHP warnings.

PHP Deprecated: ltrim(): Passing null to parameter #1 ($string) of type string is deprecated in /.../wp-includes/formatting.php on line 4482

[jrf]

@dhruvang21 Thanks for reporting this, however the proposed patch is not the way to go as you are hiding errors instead of fixing them.

The esc_url() function is clearly documented to only accept a string for the $url parameter, so passing anything else is doing it wrong.

These kind of issues need a backtrace and must be fixed at the source of the problem, i.e. the function call passing the incorrect data type. They should not be fixed in the receiving functions.

It is very likely that this error is caused by a plugin/theme, in which case: please report it there.

[dhruvang21]

Hi @jrf,

I believe the error isn't caused by any plugin or theme, as I've tested it across multiple themes and without any plugins installed. The problem appears to arise from passing null instead of an empty string in the authorize-application.php file at line 70, which is the source of the issue.

To resolve this, I’ve attached a patch that changes null to an empty string, which fixes the error. If this patch looks appropriate, I’d be happy to commit the code.

Thanks!

[sabernhardt]

Is switching from null to an empty string good, or should it not print the hidden fields with an empty attribute if the success or reject URL is not defined?

[dhruvang21]

I think using an empty string might be a good idea, as when null was passed before, the hidden fields were still being printed in the form. I’d like to know your thoughts on this as well.