Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 30 additions & 12 deletions src/wp-includes/class-wp-query.php
Original file line number Diff line number Diff line change
Expand Up @@ -814,18 +814,36 @@ public function parse_query( $query = '' ) {
$qv['p'] = (int) $qv['p'];
}

$qv['page_id'] = is_scalar( $qv['page_id'] ) ? absint( $qv['page_id'] ) : 0;
$qv['year'] = is_scalar( $qv['year'] ) ? absint( $qv['year'] ) : 0;
$qv['monthnum'] = is_scalar( $qv['monthnum'] ) ? absint( $qv['monthnum'] ) : 0;
$qv['day'] = is_scalar( $qv['day'] ) ? absint( $qv['day'] ) : 0;
$qv['w'] = is_scalar( $qv['w'] ) ? absint( $qv['w'] ) : 0;
$qv['m'] = is_scalar( $qv['m'] ) ? preg_replace( '|[^0-9]|', '', $qv['m'] ) : '';
$qv['paged'] = is_scalar( $qv['paged'] ) ? absint( $qv['paged'] ) : 0;
$qv['cat'] = preg_replace( '|[^0-9,-]|', '', $qv['cat'] ); // Array or comma-separated list of positive or negative integers.
$qv['author'] = is_scalar( $qv['author'] ) ? preg_replace( '|[^0-9,-]|', '', $qv['author'] ) : ''; // Comma-separated list of positive or negative integers.
$qv['pagename'] = is_scalar( $qv['pagename'] ) ? trim( $qv['pagename'] ) : '';
$qv['name'] = is_scalar( $qv['name'] ) ? trim( $qv['name'] ) : '';
$qv['title'] = is_scalar( $qv['title'] ) ? trim( $qv['title'] ) : '';
$qv['page_id'] = is_scalar( $qv['page_id'] ) ? absint( $qv['page_id'] ) : 0;
$qv['year'] = is_scalar( $qv['year'] ) ? absint( $qv['year'] ) : 0;
$qv['monthnum'] = is_scalar( $qv['monthnum'] ) ? absint( $qv['monthnum'] ) : 0;
$qv['day'] = is_scalar( $qv['day'] ) ? absint( $qv['day'] ) : 0;
$qv['w'] = is_scalar( $qv['w'] ) ? absint( $qv['w'] ) : 0;
$qv['m'] = is_scalar( $qv['m'] ) ? preg_replace( '|[^0-9]|', '', $qv['m'] ) : '';
$qv['paged'] = is_scalar( $qv['paged'] ) ? absint( $qv['paged'] ) : 0;
$qv['cat'] = preg_replace( '|[^0-9,-]|', '', $qv['cat'] ); // Array or comma-separated list of positive or negative integers.
$qv['author'] = is_scalar( $qv['author'] ) ? preg_replace( '|[^0-9,-]|', '', $qv['author'] ) : ''; // Comma-separated list of positive or negative integers.
$qv['pagename'] = is_scalar( $qv['pagename'] ) ? trim( $qv['pagename'] ) : '';
$qv['name'] = is_scalar( $qv['name'] ) ? trim( $qv['name'] ) : '';
$qv['title'] = is_scalar( $qv['title'] ) ? trim( $qv['title'] ) : '';
$qv['feed'] = is_scalar( $qv['feed'] ) ? trim( $qv['feed'] ) : '';
$qv['attachment'] = is_scalar( $qv['attachment'] ) ? $qv['attachment'] : '';
$qv['author_name'] = is_scalar( $qv['author_name'] ) ? $qv['author_name'] : '';
$qv['author__in'] = is_array( $qv['author__in'] ) ? $qv['author__in'] : array();

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this can be discarded, but I wonder if it'd be worthwhile using wp_parse_list() for these to coerce author__in=author1 (and the other QVs) into an array. wp_parse_id_list() could also be used for post__in to also absint() them early.

Suggested change
$qv['author__in'] = is_array( $qv['author__in'] ) ? $qv['author__in'] : array();
$qv['author__in'] = wp_parse_list( $qv['author__in'] );

$qv['author__not_in'] = is_array( $qv['author__not_in'] ) ? $qv['author__not_in'] : array();
$qv['category__and'] = is_array( $qv['category__and'] ) ? $qv['category__and'] : array();
$qv['category__in'] = is_array( $qv['category__in'] ) ? $qv['category__in'] : array();
$qv['category__not_in'] = is_array( $qv['category__not_in'] ) ? $qv['category__not_in'] : array();
$qv['post__in'] = is_array( $qv['post__in'] ) ? $qv['post__in'] : array();
$qv['post__not_in'] = is_array( $qv['post__not_in'] ) ? $qv['post__not_in'] : array();
$qv['post_name__in'] = is_array( $qv['post_name__in'] ) ? $qv['post_name__in'] : array();
$qv['post_parent__in'] = is_array( $qv['post_parent__in'] ) ? $qv['post_parent__in'] : array();
$qv['post_parent__not_in'] = is_array( $qv['post_parent__not_in'] ) ? $qv['post_parent__not_in'] : array();
$qv['tag__and'] = is_array( $qv['tag__and'] ) ? $qv['tag__and'] : array();
$qv['tag__in'] = is_array( $qv['tag__in'] ) ? $qv['tag__in'] : array();
$qv['tag__not_in'] = is_array( $qv['tag__not_in'] ) ? $qv['tag__not_in'] : array();
$qv['tag_slug__and'] = is_array( $qv['tag_slug__and'] ) ? $qv['tag_slug__and'] : array();
$qv['tag_slug__in'] = is_array( $qv['tag_slug__in'] ) ? $qv['tag_slug__in'] : array();

if ( is_scalar( $qv['hour'] ) && '' !== $qv['hour'] ) {
$qv['hour'] = absint( $qv['hour'] );
Expand Down
80 changes: 80 additions & 0 deletions tests/phpunit/tests/query/php8xCompat.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,80 @@
<?php

/**
* @group query
*/
class Tests_Query_Args_Php_8x_Compat extends WP_UnitTestCase {
/**
* @ticket 60745
* @dataProvider invalid_query_arg_data_provider
*/
public function test_feed_query_arg_with_array_value( $query_args ) {
$post = self::factory()->post->create_and_get();
$query = new WP_Query( $query_args );
$posts = $query->get_posts();
$this->assertSame( 1, count( $posts ) );
}

public function invalid_query_arg_data_provider() {
return array(
'scalar_query_arg_is_array' => array(
array(
'attachment' => array(),
'attachment_id' => array(),
'author' => array(),
'author_name' => array(),
'cat' => array(),
'day' => array(),
'embed' => array(),
'error' => array(),
'favicon' => array(),
'feed' => array(),
'hour' => array(),
'm' => array(),
'menu_order' => array(),
'minute' => array(),
'monthnum' => array(),
'name' => array(),
'p' => array(),
'page' => array(),
'page_id' => array(),
'paged' => array(),
'pagename' => array(),
'post_status' => array(),
'post_type' => array(),
'preview' => array(),
'robots' => array(),
's' => array(),
'second' => array(),
'subpost' => array(),
'subpost_id' => array(),
'tb' => array(),
'title' => array(),
'w' => array(),
'withcomments' => array(),
'withoutcomments' => array(),
'year' => array(),
),
),
'query_array_arg_is_string' => array(
array(
'author__in' => 'string',
'author__not_in' => 'string',
'category__and' => 'string',
'category__in' => 'string',
'category__not_in' => 'string',
'post__in' => 'string',
'post__not_in' => 'string',
'post_name__in' => 'string',
'post_parent__in' => 'string',
'post_parent__not_in' => 'string',
'tag__and' => 'string',
'tag__in' => 'string',
'tag__not_in' => 'string',
'tag_slug__and' => 'string',
'tag_slug__in' => 'string',
),
),
);
}
}