Skip to content

Network_Container incorrectly validates site_id using blog_id check #1304

@ericbrissette

Description

@ericbrissette

The Network_Container class has a bug where it confuses WordPress multisite's site_id (network ID) with blog_id (individual site/blog ID). This causes the container to fail when setting a valid network ID via SITE_ID_CURRENT_SITE.

Environment

  • WordPress Multisite installation
  • Carbon Fields version: 3.6.9
  • WordPress version: 6.8.3

Steps to Reproduce

  1. Set up a WordPress multisite installation with multiple, or a single network with a site_id of something other than 1 (e.g., 6)
  2. In wp-config.php, define the network ID constant (e.g., define('SITE_ID_CURRENT_SITE', 6);)
  3. Verify in the database that the network exists in the wp_site table with id = 6 and that there is no blog with a blog_id = 6
  4. Create a Network_Container in Carbon Fields
  5. Observe the error: The specified site id #6 does not exist

Expected Behavior

The Network_Container should accept a valid network ID from SITE_ID_CURRENT_SITE and validate it against the wp_site table (network table), not the wp_blogs table.

Actual Behavior

The container throws an Incorrect_Syntax_Exception stating the site doesn't exist, even when the network ID is valid.

Root Cause

The bug is in the site_exists() method in Network_Container.php (lines 51-58):

protected function site_exists( $id ) {
    if ( ! function_exists( 'get_blog_status' ) ) {
        return false;
    }

    $blog_domain = get_blog_status( $id, 'domain' );
    return ! empty( $blog_domain );
}

The problem: get_blog_status() expects a blog_id (from wp_blogs table), but the method receives a site_id (network ID from wp_site table). These are different entities in WordPress multisite:

  • site_id: Network ID (stored in wp_site table)
  • blog_id: Individual site/blog ID (stored in wp_blogs table)

The class variable is named $site_id, the constant is SITE_ID_CURRENT_SITE, and the class is Network_Container, all suggesting this should work with network IDs, not blog IDs.

Suggested Fix

The site_exists() method should validate network IDs, not blog IDs. Here's a corrected implementation:

protected function site_exists( $id ) {
    global $wpdb;
    
    // Check if the network (site) exists in wp_site table
    $network = $wpdb->get_row( $wpdb->prepare(
        "SELECT id FROM {$wpdb->site} WHERE id = %d",
        $id
    ) );
    
    return ! empty( $network );
}

Impact

This bug prevents Carbon Fields Network Containers from working correctly on multisite installations where:

  • There are multiple networks
  • The network ID doesn't happen to match an existing blog ID
  • Custom network configurations are used

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions