[wp-trac] [WordPress Trac] #54043: PHP Fatal Error on the rest api location

[WordPress Trac]

#54043: PHP Fatal Error on the rest api location
--------------------------+------------------------------
 Reporter:  passam        |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  REST API      |     Version:
 Severity:  normal        |  Resolution:
 Keywords:  close         |     Focuses:
--------------------------+------------------------------
Changes (by hellofromTonya):

 * keywords:   => close


Comment:

 Hello @passam,

 Welcome to WordPress Core's Trac!

 The error message and first entry in the error stack trace give clues:

 {{{
 PHP Fatal error: Uncaught ArgumentCountError: is_numeric() expects exactly
 1 argument, 3 given in /home/sauron/code/global/wp/www/wp/wp-includes
 /rest-api/class-wp-rest-request.php:910

 Stack trace:
 #0 /home/sauron/code/global/wp/www/wp/wp-includes/rest-api/class-wp-rest-
 request.php(910): is_numeric('14102', Object(WP_REST_Request), 'id')
 }}}

 - Something has set the `validate_callback` as `is_numeric`
 - Core's
 [https://developer.wordpress.org/reference/classes/wp_rest_request/has_valid_params/
 `WP_REST_Request::has_valid_params()`] method is where the error happens

 You noted that it happened when upgrading to PHP 8. That's a clue too.
 [https://3v4l.org/A5mm2 This sample shows] what happens in < PHP 8 and
 with PHP 8 when the `validate_callback` is set to `is_numeric`:

 - PHP 8 throws a Fatal Error
 - <= 7.4.23 throws a Warning

 A warning was likely being logged in the site's error logs.

 **Why is this happening?**

 A custom endpoint exists in the site (from a plugin, theme, or script)
 that defines a custom endpoint with the `validate_callback` set to
 `is_integer`.

 [https://www.php.net/manual/en/function.is-numeric.php PHP's
 `is_numeric()`] accepts only 1 argument, i.e. the value to be evaluated.

 The [https://developer.wordpress.org/rest-api/extending-the-rest-api
 /adding-custom-endpoints/#arguments REST API Handbook] warns of using
 `is_integer` as the `validation_callback`:

 >You could also pass in a function name to `validate_callback`, but
 passing certain functions like is_numeric directly will not only throw a
 warning about having extra parameters passed to it, but will also return
 NULL causing the callback function to be called with invalid data.

 **What to do?**

 The key is to figure out where the custom endpoint exists and then work
 with its author to resolve. How to figure out?

 - do a search in the `wp-content` folder
 - or deactivate plugins one-at-time until the problem goes away (then
 that's the one causing it)
 - or use the [https://wordpress.org/support/forums/ WordPress Support
 Forums] for further help

 For resolution, the [https://developer.wordpress.org/rest-api/extending-
 the-rest-api/adding-custom-endpoints/#arguments REST API Handbook]
 recommends using an anonymous function and then within it invoke
 `is_integer()`.

 **Notes**

 I'm marking this ticket as `close`.

 Why? The problem appears to be external to WordPress core itself.

 Why not close it? Thinking it would be good for a REST component
 maintainer to review:

 - if there are further enhancements to be done within core itself to allow
 using functions like `is_integer()` as the callback
 - and/or if using `rest_is_integer()` might be another option, and if yes,
 then maybe updating the handbook to suggest it as an alternative

 though likely both of these are outside scope of this ticket.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/54043#comment:2>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform