AdvancedCustomFields / acf

Advanced Custom Fields
http://advancedcustomfields.com/
823 stars 168 forks source link

potential infinite loop in acf_get_field_ancestors() #898

Open jhard opened 4 months ago

jhard commented 4 months ago

acf_get_field_ancestors($field) (acf-field-functions.php) can cause an infinite loop if the field setup is broken and includes a recursive reference.

To Reproduce Set up a field as {"name": "my_field", "parent": "my_field"} call acf_get_field_ancestors($field)

Expected behavior Returns the fields found until recursion is encountered (or throws an exception upon recursion).

// Loop over parents.
while ( $field['parent'] && $field = acf_get_field( $field['parent'] ) ) {
        $ancestors[] = $field['ID'] ? $field['ID'] : $field['key'];
} 

This part would need a check whether the ID/key is already included, i.e.

// Loop over parents.
while ( $field['parent'] && $field = acf_get_field( $field['parent'] ) ) {
    $idOrKey = $field['ID'] ? $field['ID'] : $field['key'];
    if(in_array($idOrKey, $ancestors, true)) {
        break;
    }
    $ancestors[] = $idOrKey;
} 

Version Information: