From fb00a36d1f5c105b19d833dd5ab5542aef27eece Mon Sep 17 00:00:00 2001
From: Peter Wilson <wilson@peterwilson.cc>
Date: Tue, 11 Jun 2024 02:14:16 +0000
Subject: [PATCH] Administration: Prevent an orderby array throwing a notice.

Prevent `WP_List_Table::search_box()` from throwing an array to string conversion notice when post list tables are loaded with an array of orderby parameters in the URL, eg: `/wp-admin/edit.php?post_type=page&orderby[menu_order]=ASC&orderby[title]=ASC`.

Follow up to [29027].

Props leonidasmilossis, rajinsharwar, swissspidy, NomNom99, pls78, SergeyBiryukov.
Fixes #59494.
See #17065.

Built from https://develop.svn.wordpress.org/trunk@58379


git-svn-id: http://core.svn.wordpress.org/trunk@57828 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-admin/includes/class-wp-list-table.php | 13 ++++++++++++-
 wp-includes/version.php                   |  2 +-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/wp-admin/includes/class-wp-list-table.php b/wp-admin/includes/class-wp-list-table.php
index e05dd77b0a..971ea7e224 100644
--- a/wp-admin/includes/class-wp-list-table.php
+++ b/wp-admin/includes/class-wp-list-table.php
@@ -388,7 +388,18 @@ class WP_List_Table {
 		$input_id = $input_id . '-search-input';
 
 		if ( ! empty( $_REQUEST['orderby'] ) ) {
-			echo '<input type="hidden" name="orderby" value="' . esc_attr( $_REQUEST['orderby'] ) . '" />';
+			if ( is_array( $_REQUEST['orderby'] ) ) {
+				foreach ( $_REQUEST['orderby'] as $key => $value ) {
+					/*
+					 * Orderby can be either an associative array or non-associative array.
+					 * In the latter case, this makes sure the key is a string before calling esc_attr().
+					 */
+					$key = (string) $key;
+					echo '<input type="hidden" name="orderby[' . esc_attr( $key ) . ']" value="' . esc_attr( $value ) . '" />';
+				}
+			} else {
+				echo '<input type="hidden" name="orderby" value="' . esc_attr( $_REQUEST['orderby'] ) . '" />';
+			}
 		}
 		if ( ! empty( $_REQUEST['order'] ) ) {
 			echo '<input type="hidden" name="order" value="' . esc_attr( $_REQUEST['order'] ) . '" />';
diff --git a/wp-includes/version.php b/wp-includes/version.php
index ab4c823506..b843cf6c04 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '6.6-beta1-58378';
+$wp_version = '6.6-beta1-58379';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.