class-walker-nav-menu-checklist.php strange way to set title

  • The class class-walker-nav-menu-checklist (spotlight on line 93 in WP 5.2.2) is trying to set the label of a page’s checkbox sending a label method to the currently walked WP_Post object.

    
if ( ! empty( $item->label ) ) {
    $title = $item->label;
    [...]

    $item is an object of class WP_Post. WP_Post does not have a property or a method called label. So first question would be: why it is there?
    Going further i see that WP_Post has implemented a magic getter __get() which will try to reply -among a lot of other things- with a post meta named label attached to the post.

    The nice part is that we can deliberately “hijack” the WP admin interface naming a meta label.

    Example: https://cl.ly/c2055aea621d/Image%202019-07-09%20at%2011.48.07%20PM.png

    Steps to reproduce:

    * install wordpress
    * activate a theme with menu support
    * wp post create --post_title=TestPage --post_type=page --post_status=published
    * wp post meta add N 'label' 'baz' where N is the ID obtained from the previous command
    * wp server
    * go to https://localhost:8080/wp-admin/nav-menus.php and watch to the widget reported in the example.

    I’m not sure if this is considered a bug. For sure I think it’s a pain and I let you imagine what a hell of debug it could be.

    Any thought or advice?

    Best,

    Alessandro

    The page I need help with: [log in to see the link]

Viewing 1 replies (of 1 total)
  • Moderator bcworkz

    (@bcworkz)

    I don’t have anything to do with core code, so the following is just my personal opinion and nothing more. While it may be lazy and sloppy to not formally declare a property and rely upon __get() to implement said property, I wouldn’t go so far as calling it a bug. At most it’s a poor choice for a meta key, prone to name collisions. “wp_label” or “cb_label” would have been much better. I have less of a problem with the lack of formal declaration, seeing that the use is intended for a specific admin functionality and nothing beyond that.

    Actually, the reliance upon post meta to extend object “properties” goes well beyond “label”. The object $item is not exactly a WP_Post object, though it starts out that way. In this context it is a “nav_menu_item” which has all sorts of meta properties tacked onto it by wp_setup_nav_menu_item(). In that function there are more opportunities for name collisions, like “title” and “description” to name a few. The “label” property is far from a unique aberration.

    Thanks for pointing out a potential problem though. It would indeed be a particularly vexing issue should it happen unexpectedly. Examining meta box code would lead us back to Walker_Nav_Menu_Checklist fairly directly, so hitting upon the label property wouldn’t be that obscure. Knowing it comes from post meta via a magic getter is pretty obscure knowledge though. Of course, it’s much easier to see the path back when we already know how we got here ??

Viewing 1 replies (of 1 total)
  • The topic ‘class-walker-nav-menu-checklist.php strange way to set title’ is closed to new replies.