From 3e80aee1a2c1ed054059a6e03a5a544ff12a05b0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc=20G=C3=B6rtz?= Date: Mon, 24 Aug 2026 02:19:27 +0200 Subject: [PATCH] Do not use a failed insert's Error object as a post ID MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit check_error() returns a Micropub\Error rather than throwing, so when wp_insert_post() fails, $args['ID'] holds an object. An object is truthy, so the guard on $args['ID'] let it through and the Error reached wp_set_object_terms() as $object_id, which casts it to int: PHP Warning: Object of class Micropub\Error could not be converted to int in wp-includes/taxonomy.php get_permalink() then received the same object and produced a bogus post_url. handle_create() does check is_micropub_error( $args['ID'] ), but only after insert_post() has returned, by which point both calls have already run. Test for the error explicitly and return early. kses_init_filters() moves up to directly after the insert so the filters are restored on the error path too — it only needs to be suspended for wp_insert_post() itself. --- includes/rest/class-endpoint-controller.php | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/includes/rest/class-endpoint-controller.php b/includes/rest/class-endpoint-controller.php index 2220486..128e7f5 100644 --- a/includes/rest/class-endpoint-controller.php +++ b/includes/rest/class-endpoint-controller.php @@ -674,13 +674,21 @@ protected function insert_post( &$args ) { \kses_remove_filters(); $args['ID'] = $this->check_error( \wp_insert_post( $args, true ) ); + \kses_init_filters(); + + // check_error() returns an Error object rather than throwing, and an object + // is truthy, so the insert failure has to be tested for explicitly before + // the ID is used as a post ID. The caller checks for it too, but only after + // this method has returned. + if ( \is_micropub_error( $args['ID'] ) ) { + return; + } - if ( $args['ID'] && array_key_exists( 'client_uid', $this->micropub_auth_response ) ) { + if ( array_key_exists( 'client_uid', $this->micropub_auth_response ) ) { \wp_set_object_terms( $args['ID'], array( $this->micropub_auth_response['client_uid'] ), 'indieauth_client' ); } $args['post_url'] = \get_permalink( $args['ID'] ); - \kses_init_filters(); } /**