Modules: Ignore non-string module tags (#53848)

Author: LiamSarsfield

projects/plugins/jetpack/changelog/fix-module-tag-array

@@ -0,0 +1,4 @@
+Significance: patch
+Type: bugfix
+
+Modules: Fix a fatal error on the Modules screen when the tag filter in the address is not plain text.

projects/plugins/jetpack/class.jetpack-modules-list-table.php

@@ -346,7 +346,7 @@ public function views() {
 		$views = $this->get_views();
 
 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- This is a view, not a model or controller.
-		$module_tag = empty( $_GET['module_tag'] ) ? 'all' : sanitize_title( wp_unslash( $_GET['module_tag'] ) );
+		$module_tag = empty( $_GET['module_tag'] ) || ! is_string( $_GET['module_tag'] ) ? 'all' : sanitize_title( wp_unslash( $_GET['module_tag'] ) );
 
 		echo "<ul class='subsubsub'>\n";
 		foreach ( $views as $class => $view ) {
@@ -380,7 +380,7 @@ public function filter_displayed_table_items( $modules ) {
 	public static function is_module_displayed( $module ) {
 		// Handle module tag based filtering.
 		// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- This is a view, not a model or controller.
-		if ( ! empty( $_REQUEST['module_tag'] ) ) {
+		if ( ! empty( $_REQUEST['module_tag'] ) && is_string( $_REQUEST['module_tag'] ) ) {
 			// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- This is a view, not a model or controller.
 			$module_tag = sanitize_text_field( wp_unslash( $_REQUEST['module_tag'] ) );
 			if ( ! in_array( $module_tag, array_map( 'jetpack_get_module_i18n_tag', $module['module_tags'] ), true ) ) {

projects/plugins/jetpack/tests/php/Get_Modules_Test.php

@@ -1,6 +1,6 @@
 <?php
 /**
- * Test module related methods in Jetpack and Jetpack_Admin class.
+ * Test module discovery, administration, and list-table filtering.
  *
  * @package jetpack
  */
@@ -9,12 +9,16 @@
 use PHPUnit\Framework\Attributes\CoversClass;
 use PHPUnit\Framework\Attributes\DataProvider;
 
+require_once JETPACK__PLUGIN_DIR . 'class.jetpack-modules-list-table.php';
+
 /**
- * Test module related methods in Jetpack and Jetpack_Admin class.
+ * Test module discovery, administration, and list-table filtering.
  *
  * @covers \Jetpack_Admin
+ * @covers \Jetpack_Modules_List_Table
  */
 #[CoversClass( Jetpack_Admin::class )]
+#[CoversClass( Jetpack_Modules_List_Table::class )]
 class Get_Modules_Test extends WP_UnitTestCase {
 	use \Automattic\Jetpack\PHPUnit\WP_UnitTestCase_Fix;
 
@@ -255,4 +259,36 @@ public function test_get_module_valid_module() {
 	public function test_get_module_module_no_info() {
 		$this->assertFalse( Jetpack::get_module( 'module-extras' ) );
 	}
+
+	/**
+	 * Ignore an array tag in the view selector.
+	 */
+	public function test_array_module_tag_selects_all_view() {
+		$original_get = $_GET;
+		try {
+			$_GET['module_tag'] = array( 'x' );
+			$table              = $this->getMockBuilder( Jetpack_Modules_List_Table::class )
+				->disableOriginalConstructor()
+				->onlyMethods( array( 'get_views' ) )
+				->getMock();
+			$table->expects( $this->once() )->method( 'get_views' )->willReturn( array( 'all' => 'All' ) );
+			$this->expectOutputRegex( "/\A<ul class='subsubsub'>\s*<li class='all current'>All<\/li>\s*<\/ul>\z/" );
+			$table->views();
+		} finally {
+			$_GET = $original_get;
+		}
+	}
+
+	/**
+	 * Ignore an array tag in the module filter.
+	 */
+	public function test_array_module_tag_does_not_filter_modules() {
+		$original_request = $_REQUEST;
+		try {
+			$_REQUEST['module_tag'] = array( 'x' );
+			$this->assertTrue( Jetpack_Modules_List_Table::is_module_displayed( array( 'module_tags' => array( 'Social' ) ) ) );
+		} finally {
+			$_REQUEST = $original_request;
+		}
+	}
 }