WordPress / WordPress/secure-custom-fields

Disabled local store ('local-empty' dummy) silently accepts registrations

Open
#459 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

[Type] Code Quality
Dominant language
PHP
Stars
131
Forks
64
Avg merge
10m
Merged PRs (30d)
1

Description

Description

When local fields are disabled (via acf_disable_local() or the acf/settings/local filter), acf_get_local_store() (includes/local-fields.php:87-93) returns the shared local-empty "dummy" store — but it is a normal writable ACF_Data store. Registrations made while local is disabled silently accumulate there instead of being rejected, and the same dummy instance is shared between the fields and groups paths.

Low severity (the data is never read while disabled), but it is a foot-gun: re-enabling local does not surface those registrations, and the accumulated state can confuse debugging.

Reproduction

Characterized in #450: tests/php/includes/test-local-fields.php::test_local_setting_filter_disables_local (resets the dummy store in teardown to avoid cross-test pollution).

Suggested fix

Return a write-discarding store (no-op set/append), or reset the dummy store when toggling.

Found during the 2026-06 test campaign (see PR #450).

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in includes/local-fields.php:87-93 and read how acf_get_local_store() selects the shared local-empty store. Run tests/php/includes/test-local-fields.php::test_local_setting_filter_disables_local and inspect its teardown reset. Done means registrations while local is disabled are discarded or the dummy store is safely reset, with no cross-test state leakage.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.