Guard select field update_value against nested-array values#465
Merged
Conversation
ACF_Field_Select::update_value() stringifies submitted values via array_map( 'strval', $value ) so they can be matched by SQL LIKE queries. When an element of $value is itself an array (which can be submitted via crafted POST input such as acf[field_key][0][]=x), this raises an "Array to string conversion" warning. Stringify only scalar elements and coerce non-scalar elements to an empty string. Normal scalar arrays of values are unaffected. The checkbox field delegates to this method, so it is covered by the same guard. This file is upstream-derived; the same guard applies upstream. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Calls update_value with a nested-array value (an element that is itself an array, as produced by crafted POST input) and asserts no "Array to string conversion" warning is emitted and only scalar strings are stored. PHPUnit is configured with convertWarningsToExceptions, so the warning surfaces as a test failure against the unpatched code. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
ACF_Field_Select::update_value()stringifies the submitted value viaarray_map( 'strval', $value )so that each value can be matched by SQLLIKEqueries. This assumes every element of$valueis a scalar.A multi-value select can receive a value where an element is itself an array — for example via a nested POST such as
acf[field_key][0][]=x. Passing such an element throughstrval()raises anArray to string conversionwarning. This should be handled rather than emitting the diagnostic.This PR makes the smallest sensible guard: stringify only scalar elements and coerce any non-scalar element to an empty string. Normal scalar arrays of values are unaffected.
The checkbox field delegates to this method (
acf_get_field_type( 'select' )->update_value( ... )), so it is covered by the same guard. The radio field has its ownupdate_value()that operates on a scalar value and does not use this code path, so it is unaffected.This file is upstream-derived; the same guard applies upstream.
Verification
Test_ACF_Field_Select::test_update_value_nested_arrayfails against the unpatched code (PHPUnit is configured withconvertWarningsToExceptions, so theArray to string conversionwarning surfaces as a failure) and passes with the fix.composer test:php -- --filter 'Field_Select'— green (17 tests).composer test:php— green (2265 tests).composer test:phpstan— clean.phpcson the changed files introduces no new issues (the select field's pre-existing legacy warnings are unchanged; the test file is clean).Closes
Use of AI Tools
This PR was authored with Claude Code under human direction. All changes were reviewed by a human, who takes responsibility for the contribution.