Skip to content

Commit 25ebbb5

Browse files
fix: do not allow to fall into infinite query loop on error
Internally, `esc_html` calls database to find if site actually uses utf8. This has some serious implications during our new database installation (after hitting *install* button) because we land in undetermined state. 1. User hits *install* button. 2. We are not installing database yet, just checking if it's available. 3. We found out that db is not present (missing tables points that, but we collect errors). 4. During error collection we call `esc_html` to sanitize text, which again calls `get_options`, resulting in another error being collected and prepared for output, which recursively fails. --- The situation doesn't look better if we immediately enter installation state (navigating directly to `wp-admin/install.php`). This ensures that `WP_INSTALLING` constant is defined and introduces some safety checks, but those merely limits to suppressing errors, yet those are still collected in HTML format. The easiest solution allowing us to properly install database would be to drop formatting function because of it's dependencies in favour of native PHP function. Nevertheless, it might be reconsidered whether we actually need HTML output and such sanitization, especially when sometimes wpdb error outputs encoded HTML, resulting in illegible wall of plain HTML (not parsed by browser). Following original `wpdb` class implementation, we might opt-in for concise error messages, which doesn't require complex formatting (especially within database driver logic). Signed-off-by: Bart Jaskulski <bjaskulski@protonmail.com>
1 parent 5c298f7 commit 25ebbb5

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

wp-includes/sqlite/class-wp-sqlite-pdo-engine.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -604,7 +604,7 @@ public function get_error_message() {
604604
$output .= '<p>Queries made or created this session were:</p>';
605605
$output .= '<ol>';
606606
foreach ( $this->queries as $q ) {
607-
$output .= '<li>' . esc_html( $q ) . '</li>';
607+
$output .= '<li>' . htmlspecialchars( $q ) . '</li>';
608608
}
609609
$output .= '</ol>';
610610
$output .= '</div>';
@@ -613,7 +613,7 @@ public function get_error_message() {
613613
$output .= sprintf(
614614
'Error occurred at line %1$d in Function %2$s. Error message was: %3$s.',
615615
(int) $this->errors[ $num ]['line'],
616-
'<code>' . esc_html( $this->errors[ $num ]['function'] ) . '</code>',
616+
'<code>' . htmlspecialchars( $this->errors[ $num ]['function'] ) . '</code>',
617617
$m
618618
);
619619
$output .= '</div>';

0 commit comments

Comments
 (0)