Bug: W3TC breaks plugins that need the current user's role
-
Summary:
A bug in W3TC 0.9.4 breaks plugins that need to determine the role of a logged-in user.Details:
Several W3TC modules attempt to retrieve the role of the currently logged-in user. However, instead of just looking at the role, the code actually modifies theWP_User::$roles
array and removes the first role. As a result, if another plugin checks the user’s role after that, it will look like the user doesn’t have any roles. This can cause various plugin conflicts that are extremely hard to track down.Here’s an example of the buggy code (
/w3-total-cache/lib/W3/Plpugin/Cdn.php
, lines 926 to 936):global $current_user; if (!is_user_logged_in()) return true; $roles = $this->_config->get_array('cdn.reject.roles'); if (empty($roles)) return true; $role = array_shift( $current_user->roles ); // ^^^ removes the first entry from the $current_user->roles array if (in_array($role, $roles)) { return false; }
Quoting array_shift() documentation (emphasis mine):
array_shift() shifts the first value of the array off and returns it, shortening the array by one element and moving everything down. All numerical array keys will be modified to start counting from zero while literal keys won’t be touched.
Similar bugs are present in at least two more files:
/w3-total-cache/lib/W3/Plpugin/NewRelic.php
line 114/w3-total-cache/lib/W3/Plpugin/TotalCache.php
line 739
Proposed solution:
Get the user role without modifying the user object. This could be as simple as:
$role = reset($current_user->roles)
- The topic ‘Bug: W3TC breaks plugins that need the current user's role’ is closed to new replies.