[wp-trac] [WordPress Trac] #53830: Default filters try to create nonce during installation before options table exists

[WordPress Trac]

#53830: Default filters try to create nonce during installation before options
table exists
----------------------------------------+---------------------
 Reporter:  schlessera                  |       Owner:  (none)
     Type:  defect (bug)                |      Status:  new
 Priority:  normal                      |   Milestone:  5.9
Component:  Upgrade/Install             |     Version:  5.7
 Severity:  normal                      |  Resolution:
 Keywords:  needs-patch good-first-bug  |     Focuses:
----------------------------------------+---------------------
Changes (by SergeyBiryukov):

 * keywords:  needs-patch => needs-patch good-first-bug
 * milestone:  Future Release => 5.9


Old description:

> Similar to https://core.trac.wordpress.org/ticket/39047, there's a new
> instance where a default filter tries to use `wp_create_nonce()` during
> WP installation, which throws an error as the `wp_options` table does not
> yet exist.
>
> The filter is adding the default scripts on `'init'`, and the offending
> code is found in `wp-includes/script-loader.php`:
>
> {{{#!php
> <?php
> $user_id = isset( $_GET['user_id'] ) ? (int) $_GET['user_id'] : 0;
> did_action( 'init' ) && $scripts->localize(
>         'user-profile',
>         'userProfileL10n',
>         array(
>                 'user_id' => $user_id,
>                 'nonce'   => wp_create_nonce( 'reset-password-for-' .
> $user_id ),
>         )
> );
> }}}
>
> It was introduced via https://core.trac.wordpress.org/changeset/50129.
>
> As suggested by @swissspidy, the `wp_create_nonce()` call should be
> wrapped like the following:
> {{{#!php
> <?php
> ( wp_installing() && ! is_multisite() ) ? '' : wp_create_nonce(..)
> }}}

New description:

 Similar to #39047, there's a new instance where a default filter tries to
 use `wp_create_nonce()` during WP installation, which throws an error as
 the `wp_options` table does not yet exist.

 The filter is adding the default scripts on `'init'`, and the offending
 code is found in `wp-includes/script-loader.php`:

 {{{#!php
 <?php
 $user_id = isset( $_GET['user_id'] ) ? (int) $_GET['user_id'] : 0;
 did_action( 'init' ) && $scripts->localize(
         'user-profile',
         'userProfileL10n',
         array(
                 'user_id' => $user_id,
                 'nonce'   => wp_create_nonce( 'reset-password-for-' .
 $user_id ),
         )
 );
 }}}

 It was introduced via [50129].

 As suggested by @swissspidy, the `wp_create_nonce()` call should be
 wrapped like the following:
 {{{#!php
 <?php
 ( wp_installing() && ! is_multisite() ) ? '' : wp_create_nonce(..)
 }}}

--

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/53830#comment:2>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform