Automattic / Automattic/jetpack
filter_fields() need string check on $this->query['fields']
- Dominant language
- PHP
- Stars
- 1.8k
- Forks
- 898
- Avg merge
- 1d 18h
- Merged PRs (30d)
- 774
Description
### Impacted plugin
Jetpack
### Quick summary
The `WPCOM_JSON_API->filter_fields()` method assumes that `$this->query['fields']` is a string - which it must be in order to work with `explode()` correctly. But URL args can be anything, a request can include `?fields[` and instantly cause a PHP fatal error.
```
Fatal error: Uncaught TypeError: explode(): Argument #2 ($string) must be of type string, array given
```
https://github.com/Automattic/jetpack/blame/5c5bc09cbf42bf8427d2cf2c38def6baeb30b16a/projects/plugins/jetpack/class.json-api.php#L814
It needs to check if `fields` is a string before it gets to the `explode()` call.
### Steps to reproduce
Make an API request with `?fields[`
### Site owner impact
Fewer than 20% of the total website/platform users
### Severity
Minor
### What other impact(s) does this issue have?
_No response_
### If a workaround is available, please outline it here.
_No response_
### Platform (Simple and/or Atomic)
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.