WordPress / WordPress/secure-custom-fields

Meta/Option.php diverges from MetaLocation base: missing unserialize in get_meta(), inverted slashing in update_meta()

Open
#454 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

[Type] Bug
Dominant language
PHP
Stars
131
Forks
64
Avg merge
10m
Merged PRs (30d)
1

Description

Description

Two consistency bugs in the options meta backend, found via integration tests of all Meta backends:

  1. Option::get_meta() never unserializes values. Unlike MetaLocation::get_meta(), which runs values through acf_maybe_unserialize(), the option backend returns raw strings — so acf_get_meta( 'options' ) yields serialized array strings where every other location yields arrays.
  2. Option::update_meta() calls wp_unslash() on values, while MetaLocation::update_meta() wp_slash()es before update_metadata(). Net effect: acf_copy_metadata() to an options location strips backslashes (C:\temp\new becomes C:tempnew), while post-to-post copies preserve them.

Affected code

  • includes/Meta/Option.php:45 (get_meta)
  • includes/Meta/Option.php:87 (update_meta)

Reproduction

Repro tests in #450, tests/php/includes/meta/test-meta-locations.php:

  • test_option_get_meta_pairs_values_with_references
  • test_option_update_meta_unslashes_values

Note before fixing

These code paths are ported from upstream — verify whether the same behavior exists upstream first. If it does, a divergence decision is needed (or an upstream-first fix); if it does not, this is a porting regression and can be fixed directly.

Found during the 2026-06 test campaign (see PR #450).

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing includes/Meta/Option.php at get_meta and update_meta with the upstream implementation, as requested. Run the two named tests in tests/php/includes/meta/test-meta-locations.php and inspect PR #450; done means the options backend matches MetaLocation behavior without breaking the integration tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend, database
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.