[wp-trac] [WordPress Trac] #9128: array_merge() Error when Adding Roles via Plugins

[WordPress Trac]

#9128: array_merge() Error when Adding Roles via Plugins
--------------------------+-------------------------------------------------
  Reporter:  johnkolbert  |        Type:  defect (bug)    
    Status:  reopened     |    Priority:  normal          
 Milestone:  2.8          |   Component:  Role/Capability 
   Version:  2.7          |    Severity:  major           
Resolution:               |    Keywords:  has-patch tested
--------------------------+-------------------------------------------------
Changes (by andrew_l):

  * status:  closed => reopened
  * resolution:  fixed =>


Comment:

 This bug is not fixed, and the above explanations miss the real problem.

 In capabilities.php, in function get_role_caps, there is a foreach loop
 that is iterating on "$this->roles as $role". Then within the body of the
 loop, there is a line like:

 $role =& $wp_roles->get_role( $role );

 This line is making $role a pointer to an element in the
 $this->role_objects object (because that is what get_role has returned).
 Then on the next iteration through the loop, the foreach sets $role to a
 role string (like "contributor"). But $role is still a reference to an
 element of role_objects! So that element gets clobbered in place,
 corrupting the role_objects object and causing junk to be returned on
 subsequent accesses.

 You can prove this by adding a couple var_dump() statements to monitor the
 state of role_objects as we iterate through the loop.

 The fix for this is to use a different, unique variable name within the
 loop body, rather than reusing $role, which should only be the loop
 iterator.

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/9128#comment:5>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software