Skip to content

Guard select field update_value against nested-array values#465

Merged
cbravobernal merged 2 commits into
trunkfrom
fix/select-field-nonscalar-value
Jun 12, 2026
Merged

Guard select field update_value against nested-array values#465
cbravobernal merged 2 commits into
trunkfrom
fix/select-field-nonscalar-value

Conversation

@cbravobernal

Copy link
Copy Markdown
Contributor

Description

ACF_Field_Select::update_value() stringifies the submitted value via array_map( 'strval', $value ) so that each value can be matched by SQL LIKE queries. This assumes every element of $value is a scalar.

A multi-value select can receive a value where an element is itself an array — for example via a nested POST such as acf[field_key][0][]=x. Passing such an element through strval() raises an Array to string conversion warning. This should be handled rather than emitting the diagnostic.

This PR makes the smallest sensible guard: stringify only scalar elements and coerce any non-scalar element to an empty string. Normal scalar arrays of values are unaffected.

// Before
$value = array_map( 'strval', $value );

// After
$value = array_map(
    static function ( $v ) {
        return is_scalar( $v ) ? strval( $v ) : '';
    },
    $value
);

The checkbox field delegates to this method (acf_get_field_type( 'select' )->update_value( ... )), so it is covered by the same guard. The radio field has its own update_value() that operates on a scalar value and does not use this code path, so it is unaffected.

This file is upstream-derived; the same guard applies upstream.

Verification

  • New regression test Test_ACF_Field_Select::test_update_value_nested_array fails against the unpatched code (PHPUnit is configured with convertWarningsToExceptions, so the Array to string conversion warning surfaces as a failure) and passes with the fix.
  • composer test:php -- --filter 'Field_Select' — green (17 tests).
  • Full composer test:php — green (2265 tests).
  • composer test:phpstan — clean.
  • phpcs on the changed files introduces no new issues (the select field's pre-existing legacy warnings are unchanged; the test file is clean).

Closes

Use of AI Tools

This PR was authored with Claude Code under human direction. All changes were reviewed by a human, who takes responsibility for the contribution.

cbravobernal and others added 2 commits June 12, 2026 12:20
ACF_Field_Select::update_value() stringifies submitted values via
array_map( 'strval', $value ) so they can be matched by SQL LIKE
queries. When an element of $value is itself an array (which can be
submitted via crafted POST input such as acf[field_key][0][]=x), this
raises an "Array to string conversion" warning.

Stringify only scalar elements and coerce non-scalar elements to an
empty string. Normal scalar arrays of values are unaffected. The
checkbox field delegates to this method, so it is covered by the same
guard.

This file is upstream-derived; the same guard applies upstream.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Calls update_value with a nested-array value (an element that is itself
an array, as produced by crafted POST input) and asserts no
"Array to string conversion" warning is emitted and only scalar strings
are stored. PHPUnit is configured with convertWarningsToExceptions, so
the warning surfaces as a test failure against the unpatched code.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props cbravobernal.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@cbravobernal cbravobernal merged commit 5696225 into trunk Jun 12, 2026
19 checks passed
@cbravobernal cbravobernal deleted the fix/select-field-nonscalar-value branch June 12, 2026 10:41
@cbravobernal cbravobernal added the [Type] Bug Something isn't working label Jun 12, 2026
@cbravobernal cbravobernal modified the milestones: 6.9.0, 6.8.9 Jun 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

[Type] Bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant