function map_meta_cap with issues since upgrade to WP 5.4.1

  • Resolved fohly

    (@fohly)


    4 years, 9 months ago

    In WP 5.4.1 map_meta_cap() (in wp-includes/capabilities.php) has an optional parameter $args.

    Since the upgrade to WP 5.4.1 for some reason on my site this function sometimes is called with $args containing an empty array, which causes a problem: If the $cap parameter equals ‘delete_post’ or ‘delete_page’ the line with
    ‘$post = get_post( $args[0] );’
    will cause an error notice: ,Undefined offset: 0 in /…wp-includes/capabilities.php’

    because $args does not contain any of the optional elements.

    Can you please insert something to prevent this, like changing the line mentione above to
    $post = isset($args[0]) ? null : get_post( $args[0] )
    In this way the content of $args would truly be optional as stated in the documentation of the function.

    Best regards
    Florian

    • This topic was modified 4 years, 9 months ago by fohly.
    • This topic was modified 4 years, 9 months ago by fohly.
Viewing 2 replies - 1 through 2 (of 2 total)
  • Moderator Samuel Wood (Otto)

    (@otto42)

    www.ads-software.com Admin

    While the args are optional, they’re not always optional. In this case, it’s expecting the ID of the post to be deleted. If something is asking to delete a post without saying which one, then that should be fixed.

    I agree that a sanity check is probably needed here, but this isn’t exactly new to 5.4.1. That particular line of code has been there for over 14 years.

    https://core.trac.www.ads-software.com/changeset/3513/trunk/wp-includes/capabilities.php

    So, pretty sure the problem is in whatever is incorrectly checking the capability here.

    Thread Starter fohly

    (@fohly)

    Hi Otto,

    thank you for the quick response!

    I looked deeper into the code, and this always occurs when checking with current_user_can() with empty $args parameter due to my mapping of a custom capability to the ‘delete_post’ capability of a custom post. In that case map_meta_cap() recursively calls itself with ‘delete_post’ and passes on the empty $args and then leads to the issue described.
    I fixed this on my site by not mapping the custom cap to a custom post cap like this.

    I don’t know why this never appeared before, as I did nothing else than update WordPress to 5.4.1. Sanity check in the future would still be great, but as my immediate problem is solved, this ticket can be closed now.

    Best regards
    Florian

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘function map_meta_cap with issues since upgrade to WP 5.4.1’ is closed to new replies.