quality-debt: tests/WP_Ultimo/Helpers/Site_Duplicator_Postmeta_Test.php — PR #825 review feedback (high)

[superdav42]

Unactioned Review Feedback

Source PR: #825
File: tests/WP_Ultimo/Helpers/Site_Duplicator_Postmeta_Test.php
Reviewers: coderabbit
Findings: 1
Max severity: high

---

HIGH: coderabbit (coderabbitai[bot])

File: tests/WP_Ultimo/Helpers/Site_Duplicator_Postmeta_Test.php:317
⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

Does WordPress get_post_meta($post_id, $key, true) automatically maybe_unserialize stored values, and what happens in PHP 8+ when unserialize() is called on an array?

💡 Result:

Yes, WordPress get_post_meta($post_id, $key, true) automatically applies maybe_unserialize to the retrieved meta value when $single is true. This means complex data types like arrays and objects stored as serialized strings in the database are automatically unserialized and returned in their native PHP format. When unserialize is called on a valid serialized array in PHP 8+, it successfully reconstructs and returns the PHP array. There are no breaking changes affecting arrays specifically; unserialize continues to work as expected for arrays across PHP versions, including 8+. Recent changes (PHP 8.3+) added warnings for invalid input like trailing data after the serialized portion or excessive depth, but valid serialized arrays unserialize normally without issues.

Citations:

• 1: https://nacin.com/2010/04/18/wordpress-serializing-data/
• 2: https://stackoverflow.com/questions/68273028/unable-to-get-unserialize-data-from-wordpress-post-meta
• 3: https://developer.wordpress.org/reference/functions/get_post_meta/
• 4: https://wordpress.stackexchange.com/questions/245478/whats-the-point-of-get-post-metas-single-param
• 5: https://github.com/WordPress/wordpress-develop/blob/6.8.1/src/wp-includes/meta.php
• 6: https://www.php.net/manual/en/function.unserialize.php
• 7: https://www.family.kiwi.nz/php8/function.unserialize.html

---

🏁 Script executed:

cat -n tests/WP_Ultimo/Helpers/Site_Duplicator_Postmeta_Test.php | sed -n '310,320p'

Repository: Ultimate-Multisite/ultimate-multisite

Length of output: 632

---

🏁 Script executed:

cat -n tests/WP_Ultimo/Helpers/Site_Duplicator_Postmeta_Test.php | sed -n '950,990p'

Repository: Ultimate-Multisite/ultimate-multisite

Length of output: 1706

---

Remove unserialize() calls on get_post_meta() results.

WordPress get_post_meta($id, $key, true) automatically applies maybe_unserialize() to the retrieved value. For metadata stored as serialized data (like _elementor_page_settings and _wp_attachment_metadata), the function returns the already-unserialized array or object. Calling unserialize() again on these values will fail because unserialize() expects a serialized string, not an array.

🛠️ Proposed fix

-		$settings = get_post_meta($page_id, '_elementor_page_settings', true);
-		$this->assertIsArray(unserialize($settings));
+		$settings = get_post_meta($page_id, '_elementor_page_settings', true);
+		$this->assertIsArray($settings);

-		$meta = unserialize(get_post_meta($this->to_attachment_id, '_wp_attachment_metadata', true));
+		$meta = get_post_meta($this->to_attachment_id, '_wp_attachment_metadata', true);

-		$settings = unserialize(
-			get_post_meta($this->from_elementor_post_id, '_elementor_page_settings', true)
-		);
+		$settings = get_post_meta($this->from_elementor_post_id, '_elementor_page_settings', true);

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

		$settings = get_post_meta($page_id, '_elementor_page_settings', true);
		$this->assertIsArray($settings);

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@tests/WP_Ultimo/Helpers/Site_Duplicator_Postmeta_Test.php` around lines 316 -
317, The test is calling unserialize() on the result of get_post_meta($page_id,
'_elementor_page_settings', true) which already returns an unserialized value;
remove the extra unserialize() call and assert directly on the returned value.
Update the assertion in Site_Duplicator_Postmeta_Test to call
get_post_meta($page_id, '_elementor_page_settings', true) into $settings (or
reuse the existing $settings variable) and use $this->assertIsArray($settings)
instead of $this->assertIsArray(unserialize($settings)). Ensure any other tests
referencing get_post_meta(..., true) are similarly changed so they don't call
unserialize() again.

✅ Addressed in commit dd3461d

View comment

---

---

Auto-generated by quality-feedback-helper.sh scan-merged. Review each finding and either fix the code or dismiss with a reason.

---

aidevops.sh v3.8.22 automated scan.

[superdav42]

DISPATCH_CLAIM nonce=9634c955b81119f4d347be68368ef4ef runner=superdav42 ts=2026-04-14T08:54:24Z max_age_s=1800

[superdav42]

DISPATCH_CLAIM nonce=8f3fb657ed6b5d50220daacee47baad1 runner=superdav42 ts=2026-04-14T13:10:06Z max_age_s=1800

[superdav42]

DISPATCH_CLAIM nonce=53fb1dcf19d1583ecb0a51a9b5d77f39 runner=superdav42 ts=2026-04-14T15:26:08Z max_age_s=1800

[superdav42]

Dispatching worker (deterministic).

• Worker PID: 1903449
• Model: anthropic/claude-sonnet-4-6
• Tier: standard
• Runner: superdav42
• Issue: quality-debt: tests/WP_Ultimo/Helpers/Site_Duplicator_Postmeta_Test.php — PR #825 review feedback (high) #839