Skip to content

Administration: Avoid fatals when list table request parameters are arrays #15328

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sarequl wants to merge 9 commits into
base: trunk
Choose a base branch
from
+149 −42
Open

Administration: Avoid fatals when list table request parameters are arrays #15328

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
2367b30
Administration: Guard list table request parameters against arrays.
sarequl Nov 1, 2026
973bfa3
Administration: Guard remaining search request values.
sarequl Nov 1, 2026
8bf7156
Merge branch 'trunk' into fix/66432-admin-list-table-array-params
westonruter Nov 12, 2026
cd64c6b
Users: Skip non-string orderby entries in WP_User_Query.
westonruter Nov 12, 2026
44ff3d9
Administration: Guard bulk action post IDs against unexpected types.
westonruter Nov 12, 2026
1d68298
Plugins: Only carry string orderby and order into the search box.
westonruter Nov 12, 2026
133700c
Administration: Skip nested orderby values in the list table search box.
westonruter Nov 12, 2026
e8b73b4
Plugins: Ignore a non-string search type on the Add Plugins screen.
westonruter Nov 12, 2026
339aec5
Comments: Only accept numeric start and offset in the comments list t…
westonruter Nov 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/wp-admin/edit-comments.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -275,7 +275,7 @@
}
}

if ( isset( $_REQUEST['s'] ) && strlen( $_REQUEST['s'] ) ) {
if ( isset( $_REQUEST['s'] ) && is_string( $_REQUEST['s'] ) && strlen( $_REQUEST['s'] ) ) {
echo '<span class="subtitle">';
printf(
/* translators: %s: Search query. */
Expand Down
2 changes: 1 addition & 1 deletion src/wp-admin/edit-tags.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -336,7 +336,7 @@
<h1 class="wp-heading-inline"><?php echo esc_html( $title ); ?></h1>

<?php
if ( isset( $_REQUEST['s'] ) && strlen( $_REQUEST['s'] ) ) {
if ( isset( $_REQUEST['s'] ) && is_string( $_REQUEST['s'] ) && strlen( $_REQUEST['s'] ) ) {
echo '<span class="subtitle">';
printf(
/* translators: %s: Search query. */
Expand Down
19 changes: 13 additions & 6 deletions src/wp-admin/edit.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,9 @@

if ( 'delete_all' === $doaction ) {
// Prepare for deletion of all posts with a specified post status (i.e. Empty Trash).
$post_status = preg_replace( '/[^a-z0-9_-]+/i', '', $_REQUEST['post_status'] );
$post_status = isset( $_REQUEST['post_status'] ) && is_string( $_REQUEST['post_status'] )
? preg_replace( '/[^a-z0-9_-]+/i', '', $_REQUEST['post_status'] )
: '';
// Validate the post status exists.
if ( get_post_status_object( $post_status ) ) {
/**
Expand All @@ -102,10 +104,15 @@
$doaction = 'delete';
} elseif ( isset( $_REQUEST['media'] ) ) {
$post_ids = $_REQUEST['media'];
} elseif ( isset( $_REQUEST['ids'] ) ) {
} elseif ( isset( $_REQUEST['ids'] ) && is_string( $_REQUEST['ids'] ) ) {
$post_ids = explode( ',', $_REQUEST['ids'] );
} elseif ( ! empty( $_REQUEST['post'] ) ) {
$post_ids = array_map( 'intval', $_REQUEST['post'] );
$post_ids = array_map(
static function ( $post_id ): int {
return is_numeric( $post_id ) ? (int) $post_id : 0;
},
(array) $_REQUEST['post']
);
}

if ( empty( $post_ids ) ) {
Expand Down Expand Up @@ -422,7 +429,7 @@
echo ' <a href="' . esc_url( admin_url( $post_new_file ) ) . '" class="page-title-action">' . esc_html( $post_type_object->labels->add_new_item ) . '</a>';
}

if ( isset( $_REQUEST['s'] ) && strlen( $_REQUEST['s'] ) ) {
if ( isset( $_REQUEST['s'] ) && is_string( $_REQUEST['s'] ) && strlen( $_REQUEST['s'] ) ) {
echo '<span class="subtitle">';
printf(
/* translators: %s: Search query. */
Expand Down Expand Up @@ -489,10 +496,10 @@

<?php $wp_list_table->search_box( $post_type_object->labels->search_items, 'post' ); ?>

<input type="hidden" name="post_status" class="post_status_page" value="<?php echo ! empty( $_REQUEST['post_status'] ) ? esc_attr( $_REQUEST['post_status'] ) : 'all'; ?>" />
<input type="hidden" name="post_status" class="post_status_page" value="<?php echo ! empty( $_REQUEST['post_status'] ) && is_string( $_REQUEST['post_status'] ) ? esc_attr( $_REQUEST['post_status'] ) : 'all'; ?>" />
<input type="hidden" name="post_type" class="post_type_page" value="<?php echo esc_attr( $post_type ); ?>" />

<?php if ( ! empty( $_REQUEST['author'] ) ) { ?>
<?php if ( ! empty( $_REQUEST['author'] ) && is_string( $_REQUEST['author'] ) ) { ?>
<input type="hidden" name="author" value="<?php echo esc_attr( $_REQUEST['author'] ); ?>" />
<?php } ?>

Expand Down
10 changes: 5 additions & 5 deletions src/wp-admin/includes/class-wp-comments-list-table.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@ public function prepare_items() {

$comment_type = '';

if ( ! empty( $_REQUEST['comment_type'] ) && ! in_array( $_REQUEST['comment_type'], array( 'note', 'reaction' ), true ) ) {
if ( ! empty( $_REQUEST['comment_type'] ) && is_string( $_REQUEST['comment_type'] ) && ! in_array( $_REQUEST['comment_type'], array( 'note', 'reaction' ), true ) ) {
$comment_type = $_REQUEST['comment_type'];
}

Expand All @@ -132,14 +132,14 @@ public function prepare_items() {

$page = $this->get_pagenum();

if ( isset( $_REQUEST['start'] ) ) {
$start = $_REQUEST['start'];
if ( isset( $_REQUEST['start'] ) && is_numeric( $_REQUEST['start'] ) ) {
$start = (int) $_REQUEST['start'];
} else {
$start = ( $page - 1 ) * $comments_per_page;
}

if ( $doing_ajax && isset( $_REQUEST['offset'] ) ) {
$start += $_REQUEST['offset'];
if ( $doing_ajax && isset( $_REQUEST['offset'] ) && is_numeric( $_REQUEST['offset'] ) ) {
$start += (int) $_REQUEST['offset'];
}

$status_map = array(
Expand Down
9 changes: 6 additions & 3 deletions src/wp-admin/includes/class-wp-list-table.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -415,19 +415,22 @@ public function search_box( $text, $input_id ) {
if ( ! empty( $_REQUEST['orderby'] ) ) {
if ( is_array( $_REQUEST['orderby'] ) ) {
foreach ( $_REQUEST['orderby'] as $key => $value ) {
if ( ! is_string( $value ) ) {
continue;
}
echo '<input type="hidden" name="orderby[' . esc_attr( $key ) . ']" value="' . esc_attr( $value ) . '" />';
}
} else {
echo '<input type="hidden" name="orderby" value="' . esc_attr( $_REQUEST['orderby'] ) . '" />';
}
}
if ( ! empty( $_REQUEST['order'] ) ) {
if ( ! empty( $_REQUEST['order'] ) && is_string( $_REQUEST['order'] ) ) {
echo '<input type="hidden" name="order" value="' . esc_attr( $_REQUEST['order'] ) . '" />';
}
if ( ! empty( $_REQUEST['post_mime_type'] ) ) {
if ( ! empty( $_REQUEST['post_mime_type'] ) && is_string( $_REQUEST['post_mime_type'] ) ) {
echo '<input type="hidden" name="post_mime_type" value="' . esc_attr( $_REQUEST['post_mime_type'] ) . '" />';
}
if ( ! empty( $_REQUEST['detached'] ) ) {
if ( ! empty( $_REQUEST['detached'] ) && is_string( $_REQUEST['detached'] ) ) {
echo '<input type="hidden" name="detached" value="' . esc_attr( $_REQUEST['detached'] ) . '" />';
}
?>
Expand Down
10 changes: 8 additions & 2 deletions src/wp-admin/includes/class-wp-media-list-table.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,10 @@ public function ajax_user_can() {
public function prepare_items() {
global $mode, $wp_query, $post_mime_types, $avail_post_mime_types;

$mode = empty( $_REQUEST['mode'] ) ? 'list' : $_REQUEST['mode'];
$mode = 'list';
if ( ! empty( $_REQUEST['mode'] ) && is_string( $_REQUEST['mode'] ) ) {
$mode = $_REQUEST['mode'];
}

/*
* Exclude attachments scheduled for deletion in the next two hours
Expand Down Expand Up @@ -150,7 +153,10 @@ protected function get_views() {

$type_links = array();

$filter = empty( $_GET['attachment-filter'] ) ? '' : $_GET['attachment-filter'];
$filter = '';
if ( ! empty( $_GET['attachment-filter'] ) && is_string( $_GET['attachment-filter'] ) ) {
$filter = $_GET['attachment-filter'];
}

$type_links['all'] = sprintf(
'<option value=""%s>%s</option>',
Expand Down
4 changes: 2 additions & 2 deletions src/wp-admin/includes/class-wp-plugin-install-list-table.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,8 +203,8 @@ public function prepare_items() {

switch ( $tab ) {
case 'search':
$type = isset( $_REQUEST['type'] ) ? wp_unslash( $_REQUEST['type'] ) : 'term';
$term = isset( $_REQUEST['s'] ) ? wp_unslash( $_REQUEST['s'] ) : '';
$type = isset( $_REQUEST['type'] ) && is_string( $_REQUEST['type'] ) ? wp_unslash( $_REQUEST['type'] ) : 'term';
$term = isset( $_REQUEST['s'] ) && is_string( $_REQUEST['s'] ) ? wp_unslash( $_REQUEST['s'] ) : '';

switch ( $type ) {
case 'tag':
Expand Down
8 changes: 4 additions & 4 deletions src/wp-admin/includes/class-wp-plugins-list-table.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ public function __construct( $args = array() ) {
$status = sanitize_key( $_REQUEST['plugin_status'] );
}

if ( isset( $_REQUEST['s'] ) ) {
if ( isset( $_REQUEST['s'] ) && is_string( $_REQUEST['s'] ) ) {
$_SERVER['REQUEST_URI'] = add_query_arg( 's', wp_unslash( $_REQUEST['s'] ) );
}

Expand Down Expand Up @@ -449,7 +449,7 @@ public function _order_callback( $plugin_a, $plugin_b ) {
public function no_items() {
global $plugins;

if ( ! empty( $_REQUEST['s'] ) ) {
if ( ! empty( $_REQUEST['s'] ) && is_string( $_REQUEST['s'] ) ) {
$s = esc_html( urldecode( wp_unslash( $_REQUEST['s'] ) ) );

/* translators: %s: Plugin search term. */
Expand Down Expand Up @@ -481,10 +481,10 @@ public function search_box( $text, $input_id ) {

$input_id = $input_id . '-search-input';

if ( ! empty( $_REQUEST['orderby'] ) ) {
if ( ! empty( $_REQUEST['orderby'] ) && is_string( $_REQUEST['orderby'] ) ) {
echo '<input type="hidden" name="orderby" value="' . esc_attr( $_REQUEST['orderby'] ) . '" />';
}
if ( ! empty( $_REQUEST['order'] ) ) {
if ( ! empty( $_REQUEST['order'] ) && is_string( $_REQUEST['order'] ) ) {
echo '<input type="hidden" name="order" value="' . esc_attr( $_REQUEST['order'] ) . '" />';
}
?>
Expand Down
6 changes: 3 additions & 3 deletions src/wp-admin/includes/class-wp-terms-list-table.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,7 @@ public function prepare_items() {
$tags_per_page = apply_filters( 'edit_categories_per_page', $tags_per_page );
}

$search = ! empty( $_REQUEST['s'] ) ? trim( wp_unslash( $_REQUEST['s'] ) ) : '';
$search = ! empty( $_REQUEST['s'] ) && is_string( $_REQUEST['s'] ) ? trim( wp_unslash( $_REQUEST['s'] ) ) : '';

$args = array(
'taxonomy' => $taxonomy,
Expand All @@ -119,11 +119,11 @@ public function prepare_items() {
'hide_empty' => 0,
);

if ( ! empty( $_REQUEST['orderby'] ) ) {
if ( ! empty( $_REQUEST['orderby'] ) && is_string( $_REQUEST['orderby'] ) ) {
$args['orderby'] = trim( wp_unslash( $_REQUEST['orderby'] ) );
}

if ( ! empty( $_REQUEST['order'] ) ) {
if ( ! empty( $_REQUEST['order'] ) && is_string( $_REQUEST['order'] ) ) {
$args['order'] = trim( wp_unslash( $_REQUEST['order'] ) );
}

Expand Down
8 changes: 4 additions & 4 deletions src/wp-admin/includes/class-wp-users-list-table.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,9 +83,9 @@ public function ajax_user_can() {
public function prepare_items() {
global $role, $usersearch;

$usersearch = isset( $_REQUEST['s'] ) ? wp_unslash( trim( $_REQUEST['s'] ) ) : '';
$usersearch = isset( $_REQUEST['s'] ) && is_string( $_REQUEST['s'] ) ? wp_unslash( trim( $_REQUEST['s'] ) ) : '';

$role = $_REQUEST['role'] ?? '';
$role = isset( $_REQUEST['role'] ) && is_string( $_REQUEST['role'] ) ? $_REQUEST['role'] : '';

$per_page = ( $this->is_site_users ) ? 'site_users_network_per_page' : 'users_per_page';
$users_per_page = $this->get_items_per_page( $per_page );
Expand Down Expand Up @@ -118,11 +118,11 @@ public function prepare_items() {
$args['blog_id'] = $this->site_id;
}

if ( isset( $_REQUEST['orderby'] ) ) {
if ( isset( $_REQUEST['orderby'] ) && is_string( $_REQUEST['orderby'] ) ) {
$args['orderby'] = $_REQUEST['orderby'];
}

if ( isset( $_REQUEST['order'] ) ) {
if ( isset( $_REQUEST['order'] ) && is_string( $_REQUEST['order'] ) ) {
$args['order'] = $_REQUEST['order'];
}

Expand Down
4 changes: 2 additions & 2 deletions src/wp-admin/includes/plugin-install.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -313,8 +313,8 @@ function install_dashboard() {
* @phpstan-param true $deprecated
*/
function install_search_form( $deprecated = true ) {
$type = isset( $_REQUEST['type'] ) ? wp_unslash( $_REQUEST['type'] ) : 'term';
$term = isset( $_REQUEST['s'] ) ? urldecode( wp_unslash( $_REQUEST['s'] ) ) : '';
$type = isset( $_REQUEST['type'] ) && is_string( $_REQUEST['type'] ) ? wp_unslash( $_REQUEST['type'] ) : 'term';
$term = isset( $_REQUEST['s'] ) && is_string( $_REQUEST['s'] ) ? urldecode( wp_unslash( $_REQUEST['s'] ) ) : '';
?>
<form class="search-form search-plugins" method="get">
<input type="hidden" name="tab" value="search" />
Expand Down
2 changes: 1 addition & 1 deletion src/wp-admin/includes/template.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2108,7 +2108,7 @@ function _draft_or_post_title( $post = 0 ) {
* @since 2.7.0
*/
function _admin_search_query() {
echo isset( $_REQUEST['s'] ) ? esc_attr( wp_unslash( $_REQUEST['s'] ) ) : '';
echo isset( $_REQUEST['s'] ) && is_string( $_REQUEST['s'] ) ? esc_attr( wp_unslash( $_REQUEST['s'] ) ) : '';
}

/**
Expand Down
2 changes: 1 addition & 1 deletion src/wp-admin/plugins.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
$action = $wp_list_table->current_action();

$plugin = isset( $_REQUEST['plugin'] ) ? wp_unslash( $_REQUEST['plugin'] ) : '';
$s = isset( $_REQUEST['s'] ) ? urlencode( wp_unslash( $_REQUEST['s'] ) ) : '';
$s = isset( $_REQUEST['s'] ) && is_string( $_REQUEST['s'] ) ? urlencode( wp_unslash( $_REQUEST['s'] ) ) : '';

// Clean up request URI from temporary args for screen options/paging uri's to work as expected.
$query_args_to_remove = array(
Expand Down
6 changes: 3 additions & 3 deletions src/wp-admin/site-health.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@
'tab-count-' . count( $tabs ),
);

$current_tab = $_GET['tab'] ?? '';
$current_tab = isset( $_GET['tab'] ) && is_string( $_GET['tab'] ) ? $_GET['tab'] : '';

$title = sprintf(
// translators: %s: The currently displayed tab.
Expand Down Expand Up @@ -206,7 +206,7 @@
<hr class="wp-header-end">

<?php
if ( isset( $_GET['tab'] ) && ! empty( $_GET['tab'] ) ) {
if ( isset( $_GET['tab'] ) && is_string( $_GET['tab'] ) && ! empty( $_GET['tab'] ) ) {
/**
* Fires when outputting the content of a custom Site Health tab.
*
Expand All @@ -217,7 +217,7 @@
*
* @param string $tab The slug of the tab that was requested.
*/
do_action( 'site_health_tab_content', $_GET['tab'] );
do_action( 'site_health_tab_content', $current_tab );

require_once ABSPATH . 'wp-admin/admin-footer.php';
return;
Expand Down
4 changes: 2 additions & 2 deletions src/wp-admin/upload.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -271,7 +271,7 @@ function () {
$doaction = 'delete';
} elseif ( isset( $_REQUEST['media'] ) ) {
$post_ids = $_REQUEST['media'];
} elseif ( isset( $_REQUEST['ids'] ) ) {
} elseif ( isset( $_REQUEST['ids'] ) && is_string( $_REQUEST['ids'] ) ) {
$post_ids = explode( ',', $_REQUEST['ids'] );
}
$post_ids = array_map( 'intval', (array) $post_ids );
Expand Down Expand Up @@ -429,7 +429,7 @@ function () {
<?php
}

if ( isset( $_REQUEST['s'] ) && strlen( $_REQUEST['s'] ) ) {
if ( isset( $_REQUEST['s'] ) && is_string( $_REQUEST['s'] ) && strlen( $_REQUEST['s'] ) ) {
echo '<span class="subtitle">';
printf(
/* translators: %s: Search query. */
Expand Down
2 changes: 1 addition & 1 deletion src/wp-admin/users.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -879,7 +879,7 @@

<?php $wp_list_table->search_box( __( 'Search Users' ), 'user' ); ?>

<?php if ( ! empty( $_REQUEST['role'] ) ) { ?>
<?php if ( ! empty( $_REQUEST['role'] ) && is_string( $_REQUEST['role'] ) ) { ?>
<input type="hidden" name="role" value="<?php echo esc_attr( $_REQUEST['role'] ); ?>" />
<?php } ?>

Expand Down
6 changes: 5 additions & 1 deletion src/wp-includes/class-wp-comment-query.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -843,7 +843,11 @@ protected function get_comment_ids() {
}

// Falsey search strings are ignored.
if ( isset( $this->query_vars['search'] ) && strlen( $this->query_vars['search'] ) ) {
if (
isset( $this->query_vars['search'] ) &&
is_scalar( $this->query_vars['search'] ) &&
strlen( $this->query_vars['search'] )
) {
$search_sql = $this->get_search_sql(
$this->query_vars['search'],
array( 'comment_author', 'comment_author_email', 'comment_author_url', 'comment_author_IP', 'comment_content' )
Expand Down
4 changes: 4 additions & 0 deletions src/wp-includes/class-wp-user-query.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -993,6 +993,10 @@ public function get_total() {
protected function parse_orderby( $orderby ) {
global $wpdb;

if ( ! is_string( $orderby ) ) {
return '';
}

$meta_query_clauses = $this->meta_query->get_clauses();

$_orderby = '';
Expand Down
15 changes: 15 additions & 0 deletions tests/phpunit/tests/comment/query.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2637,6 +2637,21 @@ public function test_search_null_should_be_ignored() {
$this->assertStringNotContainsString( 'comment_author LIKE', $q->request );
}

/**
* @ticket 66432
*
* @covers WP_Comment_Query::query
*/
public function test_search_array_should_be_ignored() {
$q = new WP_Comment_Query();
$q->query(
array(
'search' => array( 'foo' ),
)
);
$this->assertStringNotContainsString( 'comment_author LIKE', $q->request );
}

/**
* @ticket 35513
*
Expand Down
Loading
Loading