Commit b5b8d1aeb56 for woocommerce
commit b5b8d1aeb56526aead95e25e1236664f58ebaa95
Author: Matthew de Marillac <53460562+mattdemarillac@users.noreply.github.com>
Date: Thu Oct 29 23:54:38 2026 +1000
Fix fatal error for unauthorised requests to wc-analytics attribute terms endpoint. Denied GET requests return 401 for unauthenticated users and 403 for authenticated users without the required capability. (#70310)
* Fix fatal error for unauthorised requests to wc-analytics attribute terms endpoint
ProductAttributeTerms::get_custom_attribute_permissions_check()` calls `new WP_Error` without a namespace qualifier. The file is in the `Automattic\WooCommerce\Admin\API` namespace, so PHP resolves the class to `Automattic\WooCommerce\Admin\API\WP_Error`. That class does not exist. PHP does not fall back to the global namespace for classes, so the request fails with a fatal error:
* Add changefile(s) from automation for the following project(s): woocommerce
* Update plugins/woocommerce/changelog/70310-Fix-fatal-error-for-attribute-terms-endpoint
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Add changefile(s) from automation for the following project(s): woocommerce
* Add changefile(s) from automation for the following project(s): woocommerce
* Fix fatal errors from unqualified WP_Error in the wc-analytics attribute terms and notice endpoints.
* Add changefile(s) from automation for the following project(s): woocommerce
---------
Co-authored-by: woocommercebot <woocommercebot@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
diff --git a/plugins/woocommerce/changelog/70310-Fix-fatal-error-for-attribute-terms-endpoint b/plugins/woocommerce/changelog/70310-Fix-fatal-error-for-attribute-terms-endpoint
new file mode 100644
index 00000000000..62ad02d5581
--- /dev/null
+++ b/plugins/woocommerce/changelog/70310-Fix-fatal-error-for-attribute-terms-endpoint
@@ -0,0 +1,4 @@
+Significance: patch
+Type: fix
+
+Fix fatal errors from unqualified WP_Error in the wc-analytics attribute terms and notice endpoints.
diff --git a/plugins/woocommerce/phpstan-baseline.neon b/plugins/woocommerce/phpstan-baseline.neon
index c750ed03bd8..af9fe5fa549 100644
--- a/plugins/woocommerce/phpstan-baseline.neon
+++ b/plugins/woocommerce/phpstan-baseline.neon
@@ -37683,30 +37683,6 @@ parameters:
count: 2
path: src/Admin/API/Notice.php
- -
- message: '#^Instantiated class Automattic\\WooCommerce\\Admin\\API\\WP_Error not found\.$#'
- identifier: class.notFound
- count: 1
- path: src/Admin/API/Notice.php
-
- -
- message: '#^Method Automattic\\WooCommerce\\Admin\\API\\Notice\:\:dissmiss_notice\(\) has invalid return type Automattic\\WooCommerce\\Admin\\API\\WP_Error\.$#'
- identifier: class.notFound
- count: 1
- path: src/Admin/API/Notice.php
-
- -
- message: '#^Method Automattic\\WooCommerce\\Admin\\API\\Notice\:\:dissmiss_notice\(\) has invalid return type Automattic\\WooCommerce\\Admin\\API\\WP_REST_Response\.$#'
- identifier: class.notFound
- count: 1
- path: src/Admin/API/Notice.php
-
- -
- message: '#^Method Automattic\\WooCommerce\\Admin\\API\\Notice\:\:dissmiss_notice\(\) should return Automattic\\WooCommerce\\Admin\\API\\WP_Error\|Automattic\\WooCommerce\\Admin\\API\\WP_REST_Response but returns WP_REST_Response\.$#'
- identifier: return.type
- count: 1
- path: src/Admin/API/Notice.php
-
-
message: '#^Method Automattic\\WooCommerce\\Admin\\API\\Notice\:\:register_routes\(\) has no return type specified\.$#'
identifier: missingType.return
@@ -38853,24 +38829,12 @@ parameters:
count: 1
path: src/Admin/API/ProductAttributeTerms.php
- -
- message: '#^Instantiated class Automattic\\WooCommerce\\Admin\\API\\WP_Error not found\.$#'
- identifier: class.notFound
- count: 1
- path: src/Admin/API/ProductAttributeTerms.php
-
-
message: '#^Method Automattic\\WooCommerce\\Admin\\API\\ProductAttributeTerms\:\:get_custom_attribute_by_slug\(\) should return object but returns array\.$#'
identifier: return.type
count: 1
path: src/Admin/API/ProductAttributeTerms.php
- -
- message: '#^Method Automattic\\WooCommerce\\Admin\\API\\ProductAttributeTerms\:\:get_custom_attribute_permissions_check\(\) has invalid return type Automattic\\WooCommerce\\Admin\\API\\WP_Error\.$#'
- identifier: class.notFound
- count: 1
- path: src/Admin/API/ProductAttributeTerms.php
-
-
message: '#^Method Automattic\\WooCommerce\\Admin\\API\\ProductAttributeTerms\:\:get_custom_attribute_values\(\) should return array but returns WP_Error\.$#'
identifier: return.type
diff --git a/plugins/woocommerce/src/Admin/API/Notice.php b/plugins/woocommerce/src/Admin/API/Notice.php
index fcb83864b64..422c410afed 100644
--- a/plugins/woocommerce/src/Admin/API/Notice.php
+++ b/plugins/woocommerce/src/Admin/API/Notice.php
@@ -54,12 +54,12 @@ class Notice extends \WC_REST_Data_Controller {
* Save notice dismiss information in user meta.
*
* @param WP_REST_Request $request Request object.
- * @return WP_REST_Response|WP_Error
+ * @return \WP_REST_Response|\WP_Error
*/
public function dissmiss_notice( $request ) {
if ( ! isset( $request['dismiss_notice_nonce'] )
|| ! wp_verify_nonce( $request['dismiss_notice_nonce'], 'dismiss_notice' ) ) {
- return new WP_Error( 'unauthorized', 'Invalid nonce.', array( 'status' => 401 ) );
+ return new \WP_Error( 'unauthorized', 'Invalid nonce.', array( 'status' => 401 ) );
}
$notice_id = isset( $request['notice_id'] ) ? sanitize_text_field( wp_unslash( $request['notice_id'] ) ) : '';
$dismissed = false;
diff --git a/plugins/woocommerce/src/Admin/API/ProductAttributeTerms.php b/plugins/woocommerce/src/Admin/API/ProductAttributeTerms.php
index 1ec9ce71d43..e8f6a80c36c 100644
--- a/plugins/woocommerce/src/Admin/API/ProductAttributeTerms.php
+++ b/plugins/woocommerce/src/Admin/API/ProductAttributeTerms.php
@@ -57,11 +57,11 @@ class ProductAttributeTerms extends \WC_REST_Product_Attribute_Terms_Controller
* Check if a given request has access to read a custom attribute.
*
* @param WP_REST_Request $request Full details about the request.
- * @return WP_Error|boolean
+ * @return \WP_Error|bool
*/
public function get_custom_attribute_permissions_check( $request ) {
if ( ! wc_rest_check_manager_permissions( 'attributes', 'read' ) ) {
- return new WP_Error(
+ return new \WP_Error(
'woocommerce_rest_cannot_view',
__( 'Sorry, you cannot view this resource.', 'woocommerce' ),
array(