WordPress / WordPress/secure-custom-fields
scf/list-fields ability fails its own output schema for code-registered fields and unknown field types
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 131
- Forks
- 64
- Avg merge
- 10m
- Merged PRs (30d)
- 1
Description
Description
The scf/list-fields ability validates its output against an output_schema that is an array of oneOf over ~39 per-field-type variants (each pinning type to a single-value enum, with additionalProperties: false and internal properties requiring ID >= 1). Because array validation is all-or-nothing, a single non-conforming field invalidates the entire listing, returning ability_invalid_output instead of results.
Two independent triggers:
- Code-registered fields always fail. Fields registered via
acf_add_local_field_group()legitimately haveID => 0, violating theIDminimum: 1constraint inschemas/internal-properties.schema.json. Any site that registers fields in code — a very common pattern — gets a brokenscf/list-fields. - Unknown field types fail. A field stored with a type that has no schema variant (third-party field type, or a type whose plugin was deactivated) matches no
oneOfbranch and poisons the whole response.
Additionally, the comment at includes/class-scf-schema-builder.php:30 claims a "Fallback variant allows unknown types until all 35 field types have schemas" — but the generated schemas/field.schema.json contains no fallback variant. The stale comment points at the missing piece.
Affected code
includes/abilities/class-scf-field-abilities.php:277-281(list output schema)schemas/internal-properties.schema.json(IDdefinition,minimum: 1)includes/class-scf-schema-builder.php:30(stale fallback comment)
Reproduction
Covered by repro tests in #450: tests/php/includes/abilities/test-scf-list-fields-schema-robustness.php
test_local_text_field_fails_output_schema_due_to_id_zerotest_single_drifted_field_invalidates_entire_list_output
Also observed live as an order-dependent E2E failure before suite isolation was added (a stray malformed field bricked the listing for the whole run).
Suggested fix directions
- Add the permissive fallback
oneOfvariant the schema-builder comment promises, and/or - Relax
IDtominimum: 0(or document local fields' ID semantics), and/or - Sanitize/skip invalid items in
list_callbackso one bad field degrades to omission instead of total failure.
Found during the 2026-06 test campaign (see PR #450).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with tests/php/includes/abilities/test-scf-list-fields-schema-robustness.php and the affected list output schema in includes/abilities/class-scf-field-abilities.php. Then inspect schemas/internal-properties.schema.json and includes/class-scf-schema-builder.php; done means code-registered fields and unknown field types no longer invalidate the entire scf/list-fields response, with the repro tests passing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100