Make WordPress Core

Opened 2 weeks ago

Last modified 8 days ago

#63273 new defect (bug)

Fatal due to superglobal $_POST modification with invalid int type

Reported by: kkmuffme's profile kkmuffme Owned by:
Milestone: 6.9 Priority: normal
Severity: major Version:
Component: Posts, Post Types Keywords: has-patch
Focuses: Cc:

Description

By default PHP's $_POST and $_GET superglobals can only contain string and array types.

Unfortunately, WordPress overwrites the superglobals though and thereby sets keys with invalid int values. e.g. when updating a page/post /wp-admin/post.php?post=123&action=edit it will set user_ID, post_author,... see https://github.com/WordPress/wordpress-develop/blame/trunk/src/wp-admin/includes/post.php#L63

When using strict_types=1 in a file and processing the $_POST data with a function that expects a string type, you'll get a fatal error.

If it's a non-WP form, which might use the same keys (e.g. ID or user_ID) means that extra handling needs to be added to plugin/theme code to ensure it works in both cases without fatal (and ignoring 1000s of errors from static analysis, which tells me that $_POST values cannot be int)

Change History (2)

#1 @joemcgill
2 weeks ago

  • Keywords needs-patch added
  • Milestone changed from Awaiting Review to 6.9

Thanks for the report, @kkmuffme. I'm moving this to the 6.9 milestone for consideration since this is an existing issue and not something that is the result of a change during 6.8.

If anyone wants to do some investigation to see if there are other places where WP is overwriting globals in this way which need to be fixed at the same time, that would be super helpful.

This ticket was mentioned in PR #8718 on WordPress/wordpress-develop by @sukhendu2002.


8 days ago
#2

  • Keywords has-patch added; needs-patch removed
Note: See TracTickets for help on using tickets.