General settings save throws string-offset TypeError for scalar options

オープン 初心者向け
  • 何か問題がありますか？
#595 コメント 4 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@girishpanchal30 がすでに取り組んでいます。

2026年11月5日 から。

  • #592 @pirate-bot による — オープン

評価

難易度
2/5
見積もり時間
1〜3時間
初心者へのやさしさ
78/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
php, wordpress
領域
backend, testing

調査の方向性

includes/classes/wp-maintenance-mode-admin.phpのWP_Maintenance_Mode_Admin::save_plugin_settings()付近と、views/settings.phpのGeneralフォームを読んでください。まず、スカラー値のoptionsとoptions[general]がステータスへのアクセスにどう渡るかを確認し、既存の設定テストに加えて、不正な送信を対象とするテストを追加してください。完了条件は、無効なリクエスト形式が未捕捉のTypeErrorを発生させずに拒否され、通常のGeneral設定の保存は引き続き機能することです。

索引モデルが issue の本文から書いたものです。

説明

bug-report bug-report-triage

Summary

Saving General settings can terminate with TypeError: Cannot access offset of type string on string when the submitted options structure contains a string where an array is expected. Invalid settings submissions are expected to be rejected without an uncaught exception. The captured failure aborts the settings-save request.

Customer context

  • Product / area: LightStart, General settings save
  • Version: 2.6.25
  • Environment: PHP and WordPress versions not provided
  • Reported error: TypeError: Cannot access offset of type string on string
  • Impact: Settings-save request terminates
  • Evidence: Error captured in two November 4 uninstall submissions; exact request bodies unavailable

Reproduction notes

Repository-derived reproduction, not executed: submit the authenticated settings-save action with tab=general, a valid tab-general nonce, and either string-valued options or string-valued options[general]. The source reaches the reported offset access after its existing guards. The actual captured payload and PHP version are unavailable.

Diagnosis

Conclusion

The captured General settings error matches a definite unchecked request-shape access in v2.6.25. This is source-backed confirmation, not an inference from the number of uninstall comments. The request body that produced the recorded error remains unknown.

Where this likely occurs
  • includes/classes/wp-maintenance-mode-admin.php lines 72–73, WP_Maintenance_Mode_Admin::__construct(): registers save_plugin_settings() on the authenticated settings-save action.
  • includes/classes/wp-maintenance-mode-admin.php lines 392–422, WP_Maintenance_Mode_Admin::save_plugin_settings(): checks capability, nonce, and tab membership, then directly accesses $_POST['options']['general']['status'] without validating the container types. A string-valued container can produce the recorded TypeError at line 422.
  • views/settings.php lines 85–94, General settings form: ordinary markup submits nested options[general][status] fields.
  • Tagged v2.6.25 source matches the recorded line. Blame attributes the access to commit 72a22e07; the v2.6.24..v2.6.25 comparison leaves this handler unchanged, so no new regression is established.
Engineering notes

The failing value comes from POST data, not the persisted settings option. Reaching the access requires passing the existing capability, nonce, and tab checks. Normal form markup supplies an array-shaped payload; how the reported requests acquired a scalar container is unknown. No anonymous exploit or broader frontend failure is established. WordPress core was not runtime-verified.

Test coverage status

No relevant malformed-General-options coverage was found during inspection. tests/page-state-test.php lines 186–214, Test_Page_State::save_design_settings(), exercises a different settings branch with an array-shaped payload. PHP and Docker are unavailable in this environment, so tests and a local PHP reproduction were not run.

What to verify or explore next
  • Reproduce an authenticated General save with a valid tab nonce and scalar options, then with scalar options[general].
  • Compare responses with an ordinary General form submission.
  • Obtain the originating request shape and PHP version if available.
Unknowns / follow-up

The telemetry includes no request body or stack trace. The reason the malformed payload was submitted is not established.

Confidence

Confidence: 93/100

The captured error location matches an unchecked array-offset access in the affected release, with no request-container validation before it.

Source: automated uninstall feedback — wp-maintenance-mode, 2026-11-04
Generated by bug-report-triage (ID: bug-report-triage_6aec0d90cde642.94809936)

主要言語
PHP
スター
163
フォーク
82
平均マージ
4時間 2分
マージ済み PR（30日）
7

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

Codeinwp/wp-maintenance-mode のほかの issue

Codeinwp/wp-maintenance-mode の issue をすべて見る

似ている issue

PHP の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。