Guard text field maxlength check against non-scalar values#464
Merged
Conversation
The text and textarea field types run acf_strlen() on the submitted value when a maxlength is configured. A submission can deliver a non-scalar value (e.g. an array) for these fields, which made acf_strlen() emit an "Array to string conversion" notice. Guard the maxlength check with is_scalar() so a non-scalar value is treated as invalid text and skips the string length operation, leaving behavior for normal strings unchanged. The same code path exists in the upstream-derived source. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Cover that validating a non-scalar value against a text or textarea field with a maxlength set does not emit an "Array to string conversion" notice and preserves the passed validity state. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The text and textarea field types validate a submitted value against their configured
maxlengthby callingacf_strlen( $value ). That helper runs string operations (wp_unslash,str_replace,mb_strlen) directly on the value.A form submission can deliver a non-scalar value (for example an array) for one of these fields. When that happens with a
maxlengthset, the maxlength check ran a string operation on an array and emitted anArray to string conversionnotice. A non-scalar value is not valid text and should simply be treated as invalid rather than producing a diagnostic.Change
Guard the maxlength check with
is_scalar( $value )in both field types so a non-scalar value skips the string-length operation:includes/fields/class-acf-field-text.php—validate_value()includes/fields/class-acf-field-textarea.php—validate_value()Behavior for normal string values is unchanged. A non-scalar value preserves the passed validity state, matching the field's existing handling of values that are not valid text. The same code path exists in the upstream-derived source, so the same guard applies there.
Tests
Added regression tests asserting that validating a non-scalar value with a
maxlengthset does not emit an array-to-string conversion and preserves the passed validity state:Test_ACF_Field_Text::test_validate_value_array_with_maxlength_does_not_convertTest_ACF_Field_Textarea::test_validate_value_array_with_maxlength_does_not_convertThe tests fail against the unpatched code (the conversion notice fires) and pass with the guard.
Verification
composer test:php -- --filter 'Field_Text'— green (23 tests)composer test:php— green (2266 tests, 4306 assertions)composer test:phpstan— no errorsvendor/bin/phpcs— clean on the changed test files; the changed source lines add no new findings (pre-existing upstream-derived style findings are unchanged)Use of AI Tools
This change was authored with Claude Code under human direction. The author reviewed and takes responsibility for the change.