Make WordPress Core

Opened 2 months ago

Closed 7 weeks ago

#61400 closed defect (bug) (fixed)

`wp_get_plugin_action_button()` can return `void`.

Reported by: costdev's profile costdev Owned by: hellofromtonya's profile hellofromTonya
Milestone: 6.5.5 Priority: normal
Severity: normal Version: 6.5
Component: Plugins Keywords: has-patch has-unit-tests commit dev-reviewed
Focuses: Cc:

Description

[57545] introduced wp_get_plugin_action_button(). This function is documented to return a string.

However, the return $button; line is misplaced inside the following conditions:

if ( current_user_can( 'install_plugins' ) || current_user_can( 'update_plugins' ) ) {

As a result, when the user does not have the appropriate capabilities, the return line is not hit, and the function returns void.

Change History (9)

This ticket was mentioned in PR #6757 on WordPress/wordpress-develop by @costdev.


2 months ago
#1

#2 @rajinsharwar
2 months ago

  • Keywords commit added

For ease of testing this, I have just inversed the capability check so that I can test the patch with the admin user.

  1. Before Patch, the call to wp_get_plugin_action_button() is returning void: https://prnt.sc/pOTrSJ8-nVOG
  2. After Patch, the call to wp_get_plugin_action_button() is returning an empty string: https://prnt.sc/oi7IqWLBNhVq

This is now working to return a string irrespective of the result of the capability check. Marking this for 'commit' as it has both manual and unit tests passed.

#3 @hellofromTonya
8 weeks ago

Patch: https://core.trac.wordpress.org/ticket/61400

Reviewed and is ready for commit.

#4 @hellofromTonya
8 weeks ago

  • Owner set to hellofromTonya
  • Status changed from new to reviewing

Setting myself to owner for its review (already done) and commit.

#5 @hellofromTonya
8 weeks ago

  • Resolution set to fixed
  • Status changed from reviewing to closed

In 58396:

Plugins: Ensure wp_get_plugin_action_button() returns a string.

[57545] introduced wp_get_plugin_action_button(). This function is documented to return a string. However, if the user does not have the appropriate capabilities, it returned void, which is unexpected.

Resolves the issue by moving the return $button to the bottom of the function to ensure it always returns a string type. On success, the button's HTML string is returned; else, an empty string is returned.

Unit tests are included.

Follow-up to [57545].

Props costdev, rajinsharwar, hellofromTonya.
Fixes #61400.

#7 @hellofromTonya
8 weeks ago

@jorbin @costdev if there's a 6.5.5, r58396 might be a good candidate to backport.

#8 @jorbin
8 weeks ago

  • Keywords dev-reviewed added
  • Milestone changed from 6.6 to 6.5.5
  • Resolution fixed deleted
  • Status changed from closed to reopened

[58396] looks good for backport to the 6.5 branch. I don't think this should trigger a 6.5.5, but it would be good to include it if one takes place.

#9 @hellofromTonya
7 weeks ago

  • Resolution set to fixed
  • Status changed from reopened to closed

In 58445:

Plugins: Ensure wp_get_plugin_action_button() returns a string.

[57545] introduced wp_get_plugin_action_button(). This function is documented to return a string. However, if the user does not have the appropriate capabilities, it returned void, which is unexpected.

Resolves the issue by moving the return $button to the bottom of the function to ensure it always returns a string type. On success, the button's HTML string is returned; else, an empty string is returned.

Unit tests are included.

Follow-up to [57545].

Reviewed by jorbin.
Merges [58396] to the 6.5 branch.

Props costdev, rajinsharwar, hellofromTonya.
Fixes #61400.

Note: See TracTickets for help on using tickets.