[wp-trac] [WordPress Trac] #59818: [PHP 8.1] deprecated null in `explode()` for 'ping_sites' in `wp-admin/options-writing.php` with "Discourage search engines" on

[WordPress Trac]

#59818: [PHP 8.1] deprecated null in `explode()` for 'ping_sites' in `wp-admin
/options-writing.php` with "Discourage search engines" on
-------------------------------------------------+-------------------------
 Reporter:  kitchin                              |       Owner:
                                                 |  SergeyBiryukov
     Type:  defect (bug)                         |      Status:  accepted
 Priority:  normal                               |   Milestone:  6.6
Component:  Administration                       |     Version:
 Severity:  normal                               |  Resolution:
 Keywords:  php81 has-patch has-testing-info     |     Focuses:  php-
  commit                                         |  compatibility
-------------------------------------------------+-------------------------
Changes (by hellofromTonya):

 * keywords:  php81 has-patch has-testing-info => php81 has-patch has-
     testing-info commit


Comment:

 To evaluate the different patches / approaches in this ticket, I needed to
 first understand the relationship between `'blog_public'` and
 `'ping_sites'`.

 == Relationship between `'blog_public'` and `'ping_sites'`

 Source: https://developer.wordpress.org/apis/options/#writing
 >`ping_sites`: When you publish a new post, WordPress automatically
 notifies the following site update services. For more about this, see
 Update Services. Separate multiple service URLs with line breaks. Requires
 `blog_public` to have a value of **1**.
 >Default: ‘http://rpc.pingomatic.com/’
 >''Data type'':String (possibly multi-line)

 This relationship shows itself in the `options-writing.php` code
 ([https://core.trac.wordpress.org/browser/tags/6.5.4/src/wp-admin/options-
 writing.php#L233 shown here]), as the `textarea#ping_sites` only renders
 when `'1' === get_option( 'blog_public' )`.

 Commit history for context:
 * `options.php` `'ping_sites'` added to the options `array[]` via [12825].
 * `options-writing.php`: `textarea#ping_sites` added in [949].
 * `options-writing.php`: conditionally rendering the `ping_sites` based on
 `blog_public` added in [4326].

 == Evaluating the patches / approaches

 The root cause is as @kitchin noted. [attachment:"kitchin59818.diff"]
 makes sense to me given the relationship between these 2 options and the
 purpose of the list of allowed `'writing'` options.

 While defensive guarding and consistency from [attachment:"59818.diff"]
 also makes sense, the expected data type for the `'ping_sites'` option is
 `string` (not nullable `string`).

 So if the `ping_sites` option is not in the post back, then it shouldn't
 be added to the options list to sanitize in `sanitize_option()`.

 As I note, both patches resolve the issue, while IMO
 [attachment:"kitchin59818.diff"] resolves the root cause that is driving
 the error.

 For 6.6, I'm in favor of moving forward with
 [attachment:"kitchin59818.diff"].

 @SergeyBiryukov any objections? What do you think?

 Marking [attachment:"kitchin59818.diff"] for `commit`, but will wait until
 before 6.6 Beta 3 to give Sergey time to review.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/59818#comment:13>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform