WordPress / WordPress/secure-custom-fields

acf_rendered_block() preview render leaks acf_setup_meta() state (no matching acf_reset_meta)

Open Beginner friendly
#455 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

[Type] Bug
Dominant language
PHP
Stars
131
Forks
64
Avg merge
10m
Merged PRs (30d)
1

Description

Description

The preview paths of acf_rendered_block() / acf_rendered_block_v3() call acf_setup_meta() for post-render validation but never call the matching acf_reset_meta(), leaving block-scoped local meta active after the function returns.

This compounds badly with how local meta works: while acf_setup_meta() is active for a post id, ACF_Local_Meta's pre_load_metadata filter returns __return_null for any meta name not present in the local set (includes/local-meta.php:194-203) — shadowing real database values for that post. So after a block preview render, unrelated get_field() calls for the same post id can silently return null.

Affected code

  • includes/blocks.php (acf_rendered_block / acf_rendered_block_v3 preview paths)
  • Interplay: includes/local-meta.php:194-203

Reproduction

Repro documented in #450: tests/php/includes/blocks/test-blocks-render.php (tear_down resets the leaked state manually and carries the NOTE comment); the shadowing behavior itself is characterized in tests/php/includes/test-local-meta.php (test_local_meta_shadows_missing_names).

Suggested fix

Pair every acf_setup_meta() in the preview/validation paths with acf_reset_meta() (try/finally semantics or immediately after the validation read).

Found during the 2026-06 test campaign (see PR #450).

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Inspect the preview paths in includes/blocks.php, then read the local-meta interaction in includes/local-meta.php:194-203. Use tests/php/includes/blocks/test-blocks-render.php and tests/php/includes/test-local-meta.php as the starting checks. Done means preview rendering no longer leaves local metadata active, the regression tests pass, and the manual tear_down reset is no longer needed.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
82/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.