Merge branch 'WordPress:trunk' into trunk

Author: dd32

src/wp-includes/class-wp-xmlrpc-server.php

@@ -2213,7 +2213,9 @@ public function wp_editTerm( $args ) {
 		/** This action is documented in wp-includes/class-wp-xmlrpc-server.php */
 		do_action( 'xmlrpc_call', 'wp.editTerm', $args, $this );
 
-		if ( ! taxonomy_exists( $content_struct['taxonomy'] ) ) {
+		if ( ! isset( $content_struct['taxonomy'] )
+			|| ! taxonomy_exists( $content_struct['taxonomy'] )
+		) {
 			return new IXR_Error( 403, __( 'Invalid taxonomy.' ) );
 		}
 

tests/phpunit/tests/xmlrpc/wp/editTerm.php

@@ -50,6 +50,38 @@ public function test_invalid_taxonomy() {
 		$this->assertSame( __( 'Invalid taxonomy.' ), $result->message );
 	}
 
+	/**
+	 * Ensures a non-array content struct is rejected rather than causing a fatal error.
+	 *
+	 * When the content struct (the fifth argument) is passed as a string instead of a
+	 * struct, the method must return an error instead of attempting to access a string
+	 * offset, which triggers "Cannot access offset of type string on string" on PHP 8+.
+	 *
+	 * @ticket 65682
+	 */
+	public function test_invalid_content_struct_should_return_error() {
+		$this->make_user_by_role( 'editor' );
+
+		$result = $this->myxmlrpcserver->wp_editTerm( array( 1, 'editor', 'editor', self::$parent_term, 'not-a-struct' ) );
+		$this->assertIXRError( $result );
+		$this->assertSame( 403, $result->code );
+		$this->assertSame( __( 'Invalid taxonomy.' ), $result->message );
+	}
+
+	/**
+	 * Ensures a missing content struct is rejected with an insufficient arguments error.
+	 *
+	 * @ticket 65682
+	 */
+	public function test_missing_content_struct_should_return_error() {
+		$this->make_user_by_role( 'editor' );
+
+		$result = $this->myxmlrpcserver->wp_editTerm( array( 1, 'editor', 'editor', self::$parent_term ) );
+		$this->assertIXRError( $result );
+		$this->assertSame( 400, $result->code );
+		$this->assertSame( __( 'Insufficient arguments passed to this XML-RPC method.' ), $result->message );
+	}
+
 	public function test_incapable_user() {
 		$this->make_user_by_role( 'subscriber' );