[wp-trac] [WordPress Trac] #36724: who=>authors breaks meta arguments in user queries

[WordPress Trac]

#36724: who=>authors breaks meta arguments in user queries
--------------------------+---------------------------
 Reporter:  Rarst         |       Owner:  boonebgorges
     Type:  defect (bug)  |      Status:  assigned
 Priority:  normal        |   Milestone:  4.6
Component:  Users         |     Version:  trunk
 Severity:  normal        |  Resolution:
 Keywords:                |     Focuses:
--------------------------+---------------------------
Changes (by boonebgorges):

 * keywords:  needs-unit-tests good-first-bug has-patch dev-feedback 2nd-
     opinion =>
 * owner:   => boonebgorges
 * status:  new => assigned


Comment:

 Thank you, @adrianosilvaferreira. This patch is looking pretty good.

 In writing a unit test, I found a previous bug that sorta needs to be
 addressed in order to fix this ticket.

 Short version: because of an accident of implementation, it was possible
 to pass a malformed `meta_query` when using the `who` parameter and still
 have the `meta_query` recognized.

 Long version:
 https://core.trac.wordpress.org/browser/tags/4.5.1/tests/phpunit/tests/user/query.php?annotate=blame&marks=690-693#L670
 shows that a passing test is using improper syntax for `meta_query`:

 {{{
 'meta_query' => array(
     'key' => 'foo',
     'value' => 'bar',
 )
 }}}

 is missing a level of nesting. It should be:


 {{{
 'meta_query' => array(
     array(
         'key' => 'foo',
         'value' => 'bar',
     ),
 )
 }}}

 The offending test was introduced in [32207]. In that changeset, 'who'
 params were translated to `meta_value` and `meta_key` before
 `WP_Meta_Query::parse_query_vars()` was called. In `parse_query_vars()`,
 the presence of a "primary meta query" and "existing meta query" resulted
 in the two being concatenated in such a way that the invalid `meta_query`
 was inadvertantly nested in an array, accidentally turning it into proper
 syntax. However, I think that the bug was probably originally introduced
 in [30094], which caused `parse_query_vars()` to be run both before and
 after the `role` parameter.

 In the vast majority of cases, the improperly nested syntax described
 above will simply be ignored by `WP_Meta_Query`. It's only when combined
 with `who` in the context of `WP_User_Query` that it will accidentally
 work. So, while it's technically a compatibility break to remove this
 support (which inadvertently happens with [attachment:class-wp-user-
 query.4.diff]), I think it's an acceptable break that is very unlikely to
 affect anyone.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/36724#comment:8>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform