Skip to content

Fix deprecated create_function() call (fatal on PHP 8.0+) #30

@lex127

Description

@lex127

Problem

The file vendor/class.settings-api.php at line 99 uses create_function():

$callback = create_function('', 'echo "' . str_replace( '"', '\"', $section['desc'] ) . '";');

create_function() was deprecated in PHP 7.2 and removed in PHP 8.0. On any site running PHP 8+, this causes a fatal error the moment the settings page tries to render a section description.

Why it is not crashing today

The current get_settings_sections() in includes/class-wsc-settings.php does not set desc on the section, so the bad branch is never reached. This is a latent bug — as soon as someone adds a section description, the plugin breaks on PHP 8.

Fix

Replace the call with an anonymous function and use wp_kses_post() for safe output:

$desc = $section['desc'];
$callback = function () use ( $desc ) {
    echo wp_kses_post( $desc );
};

Acceptance

  • grep -r create_function returns no hits in the plugin source
  • Settings page renders without errors on PHP 8.0 / 8.1 / 8.2 / 8.3
  • A test section with 'desc' => '<p>Hello "world"</p>' renders correctly

Scope

Small, stability-only fix. One file, a few lines. Should ship in the next patch release.

Metadata

Metadata

Assignees

Labels

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions