Summary
Page::__construct() manually extracts class, style, and overview from the $meta array but never stores the full array into $this->__meta. Every other container class (Fieldset, MultiField, Navigation, Note) calls $this->__meta = $meta in its constructor.
The result: getMeta() always reads an empty array, which breaks getShortHeader() — it calls $this->getMeta("summaryLabel", null) and always gets null, falling back to the full header regardless of what was passed.
Root cause
classes/ValidFormBuilder/Page.php:76-85:
public function __construct($id = "", $header = "", $meta = array())
{
$this->__header = $header;
$this->__class = (isset($meta["class"])) ? $meta["class"] : "";
$this->__style = (isset($meta["style"])) ? $meta["style"] : "";
$this->__id = (empty($id)) ? $this->getRandomId("vf__page") : $id;
$this->__isOverview = (isset($meta["overview"])) ? $meta["overview"] : false;
$this->__elements = new Collection();
// Missing: $this->__meta = $meta;
}
Compare with Fieldset, MultiField, Navigation, Note — all of which include:
$this->__meta = $meta;
$this->__initializeMeta();
Reproduction
$page = new Page('p1', 'Long Page Title', ['summaryLabel' => 'Short']);
echo $page->getShortHeader(); // "Long Page Title" — summaryLabel is lost
echo $page->getMeta('summaryLabel'); // "" — meta array is empty
Expected fix
Add the meta storage (one line) and optionally the meta initialization:
public function __construct($id = "", $header = "", $meta = array())
{
$this->__header = $header;
+ $this->__meta = $meta;
+ $this->__initializeMeta();
+
$this->__class = (isset($meta["class"])) ? $meta["class"] : "";
The existing manual reads for class/style/overview can either stay (they pre-date the __meta pattern) or be migrated to use $this->getMeta() for consistency.
Impact
Low. Affects only ValidWizard users who set summaryLabel on a Page expecting a shorter tab label. The wizard renders the full header instead, which is visually suboptimal but not a security issue.
Discovered while writing PageTest in #154.
Summary
Page::__construct()manually extractsclass,style, andoverviewfrom the$metaarray but never stores the full array into$this->__meta. Every other container class (Fieldset,MultiField,Navigation,Note) calls$this->__meta = $metain its constructor.The result:
getMeta()always reads an empty array, which breaksgetShortHeader()— it calls$this->getMeta("summaryLabel", null)and always gets null, falling back to the full header regardless of what was passed.Root cause
classes/ValidFormBuilder/Page.php:76-85:Compare with Fieldset, MultiField, Navigation, Note — all of which include:
Reproduction
Expected fix
Add the meta storage (one line) and optionally the meta initialization:
public function __construct($id = "", $header = "", $meta = array()) { $this->__header = $header; + $this->__meta = $meta; + $this->__initializeMeta(); + $this->__class = (isset($meta["class"])) ? $meta["class"] : "";The existing manual reads for class/style/overview can either stay (they pre-date the __meta pattern) or be migrated to use
$this->getMeta()for consistency.Impact
Low. Affects only ValidWizard users who set
summaryLabelon a Page expecting a shorter tab label. The wizard renders the full header instead, which is visually suboptimal but not a security issue.Discovered while writing
PageTestin #154.