← All changes | includes/admin/class-metabox-manager.php +19 -4 2.10.0 → 2.14.3 View file →

		@@ -242,12 +242,21 @@
242	242	*
243	243	* Validates JSON structure and recursively sanitizes all string values
244	244	* to prevent XSS and injection attacks.
245	245	*
246		- * @param string $value Raw JSON string value
	246	+ * Untyped on purpose: this is a registered `sanitize_callback`, so
	247	+ * WordPress hands it whatever any writer stored. A `string` parameter made
	248	+ * an array or null a fatal TypeError instead of reaching the guard below
	249	+ * (#1014). An array is a decoded payload and is encoded rather than lost.
	250	+ *
	251	+ * @param mixed $value Raw JSON string value, or an already-decoded array
247	252	* @return string Sanitized JSON string or empty string if invalid
248	253	*/
249		- public function sanitize_json_meta_field(string $value): string {
	254	+ public function sanitize_json_meta_field($value): string {
	255	+ if (is_array($value)) {
	256	+ $value = (string) wp_json_encode($value);
	257	+ }
	258	+
250	259	// Return empty string for non-string values
251	260	if (!is_string($value) || empty($value)) {
252	261	return '';
253	262	}
		@@ -316,13 +325,19 @@
316	325	*
317	326	* Validates JSON structure, recursively sanitizes all string values,
318	327	* and preserves @ characters in keys (crucial for JSON-LD).
319	328	*
320		- * @param string $value Raw JSON string value
	329	+ * Untyped for the same reason as sanitize_json_meta_field() (#1014).
321	330	*
	331	+ * @param mixed $value Raw JSON string value, or an already-decoded array
	332	+ *
322	333	* @return string Sanitized JSON string or empty string if invalid
323	334	*/
324		- public function sanitize_json_ld_field( string $value ): string {
	335	+ public function sanitize_json_ld_field( $value ): string {
	336	+ if ( is_array( $value ) ) {
	337	+ $value = (string) wp_json_encode( $value );
	338	+ }
	339	+
325	340	// Return empty string for non-string values
326	341	if ( ! is_string( $value ) || empty( $value ) ) {
327	342	return '';
328	343	}