humanmade / humanmade/Custom-Meta-Boxes

Check for switched site context in CMB_Meta_Box::save()

Open
#335 1 comment 0 reactions 0 assignees View on GitHub
Bug
Dominant language
PHP
Stars
516
Forks
118
PR merge metrics
No merged PRs in 30d

Description

The method CMB_Meta_Box::save() assumes it runs in a site context it was initialized in. That means if any other component runs a `switch_to_blog()` and triggers the `save_post` action, your plugin writes data to a wrong object (in a wrong site). This already leads to [concrete issues](https://wordpress.org/support/topic/bug-in-lastest-version?replies=2).

However, this is easy to solve by just adding the following guard to your `save_post` handler:

```
if ( is_multisite() && ms_is_switched() )
return;
```

If appreciated I would provide a pull request.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.