Forms: Fix fatal error when field render value is an array

[enejb]

Fixes FORMS-670

Proposed changes

Fixes PHP Fatal error: Uncaught TypeError: Cannot access offset of type array on array in Feedback::get_legacy_extra_values().

Root cause: When a form field like email, name, or url receives array POST data (e.g. crafted requests sending email[]=a&email[]=b), get_field_value() stores the value as an array. In the submit context, get_render_submit_value() returns this raw array, which then gets used as an array key in get_legacy_extra_values() — causing a TypeError.

Fix (two layers):

1. Source enforcement (get_field_value()): For all field types except checkbox-multiple (the only type that legitimately accepts arrays), flatten array POST data to the first element. file and image-select already have dedicated early returns.

2. Defensive guard (get_legacy_extra_values()): If a render value is still an array (e.g. from pre-existing stored data), use reset() to extract the first element before using it as an array key — instead of crashing.

Tests added:

• Parameterized regression test across all 6 $non_extra_fields types (email, name, url, subject, textarea, ip) with array values in both submit and default contexts
• Verify checkbox-multiple arrays are preserved through get_legacy_extra_values() (v2 format with correct type)
• Verify legacy v1 checkbox-multiple arrays (stored with type basic) survive the round-trip and are not flattened by the reset() guard
• Assertions verify actual data correctness (field values, extra values contents), not just absence of fatal errors

Related product discussion/links

• p1775768640031599-slack-C06QF6JJDTM

Does this pull request change what data or activity we track or use?

No.

Testing instructions

1. Apply this patch to a site running the Jetpack Forms package
2. Create a contact form with fields like email, name, url, textarea
3. Submit the form normally — verify submissions work as before
4. Submit the form with array POST data for a single-value field (e.g. using a crafted request where the email parameter is an array) — verify no PHP Fatal Error occurs
5. Submit a form with a checkbox-multiple field — verify all selected options are preserved

Automated:

cd projects/packages/forms && composer test-php

Or run just the new tests:

cd projects/packages/forms && vendor/bin/phpunit-select-config phpunit.#.xml.dist --filter="test_get_legacy_extra_values_with_array_field_value_does_not_fatal|test_get_legacy_extra_values_preserves_checkbox_multiple_array|test_legacy_v1_checkbox_multiple_array_preserved"

[github-actions]

Are you an Automattician? Please test your changes on all WordPress.com environments to help mitigate accidental explosions.

• To test on WoA, go to the Plugins menu on a WoA dev site. Click on the "Upload" button and follow the upgrade flow to be able to upload, install, and activate the Jetpack Beta plugin. Once the plugin is active, go to Jetpack > Jetpack Beta, select your plugin (Jetpack), and enable the fix/forms-fatal-error branch.
• To test on Simple, run the following command on your sandbox:

bin/jetpack-downloader test jetpack fix/forms-fatal-error

Interested in more tips and information?

• In your local development environment, use the jetpack rsync command to sync your changes to a WoA dev blog.
• Read more about our development workflow here: PCYsg-eg0-p2
• Figure out when your changes will be shipped to customers here: PCYsg-eg5-p2

[github-actions]

Thank you for your PR!

When contributing to Jetpack, we have a few suggestions that can help us test and review your patch:

• ✅ Include a description of your PR changes.
  
• ✅ Add a "[Status]" label (In Progress, Needs Review, ...).
  
• ✅ Add testing instructions.
  
• ✅ Specify whether this PR includes any changes to data or privacy.
  
• ✅ Add changelog entries to affected projects
  

This comment will be updated as you work on your PR and make changes. If you think that some of those checks are not needed for your PR, please explain why you think so. Thanks for cooperation 🤖

---

Follow this PR Review Process:

1. Ensure all required checks appearing at the bottom of this PR are passing.
2. Make sure to test your changes on all platforms that it applies to. You're responsible for the quality of the code you ship.
3. You can use GitHub's Reviewers functionality to request a review.
4. When it's reviewed and merged, you will be pinged in Slack to deploy the changes to WordPress.com simple once the build is done.

If you have questions about anything, reach out in #jetpack-developers for guidance!

[jp-launch-control]

Code Coverage Summary

Coverage changed in 1 file.

File	Coverage	Δ%	Δ Uncovered
projects/packages/forms/src/contact-form/class-feedback.php	728/770 (94.55%)	-0.08%	1 ❤️‍🩹

Full summary · PHP report · JS report

[enejb]

@copilot review this PR.

[Copilot]

@copilot review this PR.

Review complete (standard depth, 152 lines, 1 project).

Verdict: Minor issues — can merge after addressing.

Two suggestions found, no blockers:

1. Changelog entry missing trailing period (projects/packages/forms/changelog/fix-forms-fatal-error line 4): entry must end with . per Jetpack conventions.

2. Changelog entry is narrower than the actual fix: the entry only mentions get_legacy_extra_values, but get_field_value() was also changed to truncate array POST data to its first element for all non-checkbox-multiple types. Both belong to the same root bug — worth reflecting both in the entry.

Everything else looks good: the two-layer fix (prevent bad state at ingestion + guard at consumption) is the right approach, test coverage is thorough across all $non_extra_fields types plus checkbox-multiple, code is PHP 7.2-compatible, security handling is correct, and no backward-compat issues were introduced.

[dhasilva]

LGTM. Tested the image select field with multiple images and it still works.