Automattic / Automattic/jetpack

filter_fields() need string check on $this->query['fields']

Open
#50,669 0 comments 0 reactions 1 assignee Claimed by @bindlegirl View on GitHub
Bug Needs triage
Dominant language
PHP
Stars
1.8k
Forks
898
Avg merge
1d 18h
Merged PRs (30d)
774

Description

### Impacted plugin

Jetpack

### Quick summary

The `WPCOM_JSON_API->filter_fields()` method assumes that `$this->query['fields']` is a string - which it must be in order to work with `explode()` correctly. But URL args can be anything, a request can include `?fields[` and instantly cause a PHP fatal error.

```
Fatal error: Uncaught TypeError: explode(): Argument #2 ($string) must be of type string, array given
```

https://github.com/Automattic/jetpack/blame/5c5bc09cbf42bf8427d2cf2c38def6baeb30b16a/projects/plugins/jetpack/class.json-api.php#L814

It needs to check if `fields` is a string before it gets to the `explode()` call.

### Steps to reproduce

Make an API request with `?fields[`

### Site owner impact

Fewer than 20% of the total website/platform users

### Severity

Minor

### What other impact(s) does this issue have?

_No response_

### If a workaround is available, please outline it here.

_No response_

### Platform (Simple and/or Atomic)

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.