WordPress / WordPress/secure-custom-fields

JS: _acf-compatibility.js depends on sloppy-mode semantics (undeclared global, arguments aliasing)

Open Beginner friendly
#460 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

[Type] Code Quality
Dominant language
PHP
Stars
131
Forks
64
Avg merge
10m
Merged PRs (30d)
1

Description

Description

The legacy compatibility layer (assets/src/js/_acf-compatibility.js) only works because the production webpack bundle keeps it in non-strict mode:

  1. maybe_get() assigns to an undeclared keys variable — a global leak; under strict mode this throws ReferenceError.
  2. add_action()'s multi-action split and Field→$el argument conversion rely on arguments aliasing, which strict mode disables — under strict mode the legacy callback wrapping silently stops working.

Any future tooling change that forces strict mode (e.g. converting the module to an ES module, or a bundler default change) breaks the acf.* legacy API used by third-party add-ons — one loudly, one silently.

Reproduction

Characterized in #450: tests/js/compatibility.test.js loads the raw source via indirect eval specifically to match production sloppy-mode semantics (see file comments).

Suggested fix

Declare var keys, capture arguments explicitly — two tiny changes that make the module strict-mode-safe without behavior change.

Found during the 2026-06 test campaign (see PR #450).

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with assets/src/js/_acf-compatibility.js and read the maybe_get() and add_action() implementations. Run tests/js/compatibility.test.js, including its raw-source loading and strict-mode cases, to confirm the legacy behavior. Done means the compatibility layer works under strict mode without changing the existing acf.* callback behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.