alleyinteractive / wordpress-fieldmanager

Custom field types for WordPress

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

`save_term_fields()` does not check the term ID, can result in data corruption

johnbillion opened this issue · comments

The save_fields_for_post() method in the post context has a guard condition where it checks the post ID before saving data to it. This is for the situation where another post gets updated when a post is saved and prevents meta data being saved to another post. Ref:

// Make sure this hook fired on the post being saved, not a side-effect post for which the $_POST context is invalid.

This was introduced in #147.

There is no such protection for terms. If a term gets saved and some code updates another term, Fieldmanager will write its term meta to that term too. Ref:

public function save_term_fields( $term_id, $tt_id, $taxonomy ) {

Thanks @johnbillion! Great find. We'll dig into it and try to ship a new release today.

@johnbillion this ended up being a little more complicated than I anticipated! I have a PR open to address it (#832) which I need to do more testing on. Would you also be able to give it a quick try?

Thanks!

@johnbillion @alwaysblank I just shipped 1.5.0 which resolves this issue. Thanks again!