Repository navigation
Conversation
Several admin screens passed request values straight into string functions, so an array parameter caused a TypeError or an "Array to string conversion" warning. Check that each value is a string (or a scalar for the comment search query) before using it.
_admin_search_query() and the post_mime_type and detached hidden fields still cast request arrays to strings, which surfaced as warnings once the earlier fatals were fixed.
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. Props Bot commandsYou can trigger Props Bot actions by commenting on this PR:
|
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
Co-Authored-By: Claude Opus 5.5 (medium effort) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Tnky3LnCGk4tTNDf3wjdhe Claude-Code-Session-Id: d29ab326-6a9a-4f1d-99bf-988709d1b379
An array 'orderby' whose list entry is itself an array, as with `users.php?orderby[0][]=x`, reached the `isset()` lookup on the meta query clauses in `parse_orderby()` and threw a TypeError. Guarding in the query class covers every caller of `get_users()`, not only the Users list table. Co-Authored-By: Claude Opus 5.5 (medium effort) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Tnky3LnCGk4tTNDf3wjdhe Claude-Code-Session-Id: d29ab326-6a9a-4f1d-99bf-988709d1b379
On the Posts and Media screens, an array `ids` was passed to `explode()`, and on the Posts screen a scalar `post` was passed to `array_map()`. Both threw a TypeError. Only a string `ids` is now exploded, and `post` is cast to an array, with any non-numeric entry mapped to 0. Co-Authored-By: Claude Opus 5.5 (medium effort) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Tnky3LnCGk4tTNDf3wjdhe Claude-Code-Session-Id: d29ab326-6a9a-4f1d-99bf-988709d1b379
`WP_Plugins_List_Table::search_box()` overrides the parent method, so it missed the string checks added there. An array `orderby` or `order` raised an "Array to string conversion" warning and printed `value="Array"` into the hidden input. Co-Authored-By: Claude Opus 5.5 (medium effort) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Tnky3LnCGk4tTNDf3wjdhe Claude-Code-Session-Id: d29ab326-6a9a-4f1d-99bf-988709d1b379
When `orderby` is an array, `WP_List_Table::search_box()` echoes each entry back as a hidden input. A nested array entry, such as from `orderby[title][]=x`, raised an "Array to string conversion" warning and printed `value="Array"`. Non-string entries are now skipped. Co-Authored-By: Claude Opus 5.5 (medium effort) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Tnky3LnCGk4tTNDf3wjdhe Claude-Code-Session-Id: d29ab326-6a9a-4f1d-99bf-988709d1b379
The search `type` was read without a string check next to the `s` reads that already had one. An array `type` raised "Array to string conversion" warnings in `selected()`. It now falls back to `term`, in both the search form and the list table. Co-Authored-By: Claude Opus 5.5 (medium effort) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Tnky3LnCGk4tTNDf3wjdhe Claude-Code-Session-Id: d29ab326-6a9a-4f1d-99bf-988709d1b379
…able. `WP_Comments_List_Table::prepare_items()` added the AJAX `offset` to `start` without checking either. An array, or a non-numeric string, threw an "Unsupported operand types" TypeError. Both are now used only when numeric and are cast to integers; otherwise `start` falls back to the page offset. Co-Authored-By: Claude Opus 5.5 (medium effort) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Tnky3LnCGk4tTNDf3wjdhe Claude-Code-Session-Id: d29ab326-6a9a-4f1d-99bf-988709d1b379
westonruter
requested changes
Nov 12, 2026
westonruter
left a comment
westonruter
left a comment
Member
There was a problem hiding this comment.
Marking this as requested changes because it will need to be re-worked to incorporate the changes described in https://core.trac.wordpress.org/ticket/22325#comment:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes fatal errors on admin screens when list table request parameters are sent as arrays.
See https://core.trac.wordpress.org/ticket/66432
What
Several admin screens pass
$_REQUESTvalues directly into string functions. PHP turns?s[]=xinto an array, sostrlen(),trim(),urlencode(),urldecode(), and similar calls throw aTypeErrorand the screen dies with "There has been a critical error on this website". A few other parameters only produce "Array to string conversion" warnings.Why
These request values are assumed to be strings. This is the admin counterpart of the front-end query var fatals in #60745, #64507, and #66171, which do not cover these screens.
How
Adds
is_string()guards before the values reach string functions in 17 admin files.WP_Comment_Query::searchusesis_scalar()so an integer0still works. Array values are ignored and the screen falls back to its default state; scalar values behave exactly as before. Also adds a PHPUnit test that an arraysearchvalue is ignored byWP_Comment_Query.Testing Instructions
WP_DEBUGon./wp-admin/edit.php?s[]=x/wp-admin/upload.php?mode=list&s[]=x/wp-admin/upload.php?mode=list&attachment-filter[]=image(media list view)/wp-admin/edit-comments.php?s[]=x/wp-admin/users.php?s[]=x/wp-admin/edit-tags.php?taxonomy=category&s[]=x/wp-admin/edit-tags.php?taxonomy=category&orderby[]=name/wp-admin/plugins.php?s[]=x/wp-admin/plugin-install.php?tab=search&s[]=x/wp-admin/site-health.php?tab[]=debugedit.php?post_status[]=draft,edit.php?order[]=asc,edit.php?author[]=1,upload.php?mode[]=list,edit-comments.php?comment_type[]=comment, andusers.php?role[]=administrator.?s=foo,?s=,?s=0, and nosparameter.A 19-URL sweep covering all of the above returns HTTP 200 on every URL, with 0 fatals and 0 "Array to string conversion" warnings; scalar responses are byte-identical to trunk. PHPUnit (
tests/phpunit/tests/comment/query.php, 163 tests), PHPStan, andnpm run buildpass, and phpcs reports no errors on the changed files (the remaining warnings are pre-existing and not on changed lines).Props digitalpritam for the report.