PageFinder HY093 error on consecutive find() calls as non-superuser when content templates have useRoles + childTemplates

[adrianbj]

Hi @ryancramerdesign - apologies for the Claude written issue below. I found this issue on an old site of mine that I upgraded to 3.0.257 and then 3.0.258.

Non-superusers couldn't load the admin without SQLSTATE[HY093]: Invalid parameter number: number of bound variables does not match number of tokens error and also couldn't load certain pages on the frontend.

I switched to PageFinder2.php just to see if that helped but it didn't. After implementing the proposed fix, everything is fine again. That said, I couldn't seem to replicate this on any other site on the same server and with a symlinked wire folder so I don't really know what is different with this site - perhaps it is template user access restrictions, but maybe not exactly as described below?

Anyway, it would be great if you could implement the fix - btw, I implemented it into PageFinder2.php even though Claude built it for the original PageFinder.php file.

PS - initially I thought the error seemed like it might be related to PDO::ATTR_EMULATE_PREPARES but this is enabled.

PW Version: 3.0.257+

PageFinder HY093 error on consecutive find() calls as non-superuser when content templates have useRoles + childTemplates

Consecutive Pages::find() calls with different parent_id values throw a PDO exception for non-superuser users when content templates have useRoles=1 combined with
childTemplates. The first call always succeeds; the second always fails. Superusers are unaffected as they bypass access control.

Setup to reproduce

1. Create template "parent-tpl" with useRoles=1, assign view access to guest + a custom role, and set childTemplates to restrict children to a specific template
2. Create template "child-tpl" (no useRoles)
3. On "parent-tpl", set childTemplates=[child-tpl]
4. Create two parent pages (/parent-a/, /parent-b/) using "parent-tpl"
5. Create at least one child page under each parent using "child-tpl"
6. Ensure pages_access is properly populated
7. Create a non-superuser with the custom role

Test (run as non-superuser)

  // Same parent twice — works fine                                                                                                                                      
  $r1 = $pages->find("parent_id={parent-a-id}, limit=1"); // OK                                                                                                            
  $r2 = $pages->find("parent_id={parent-a-id}, limit=1"); // OK                                                                                                            

  // Different parents — second call fails                                                                                                                                 
  $r1 = $pages->find("parent_id={parent-a-id}, limit=1"); // OK                                                                                                            
  $r2 = $pages->find("parent_id={parent-b-id}, limit=1"); // FAILS                                                                                                         

Expected: Both calls return results.

Actual: Second call throws:
SQLSTATE[HY093]: Invalid parameter number: number of bound variables
does not match number of tokens
at wire/core/PageFinder.php:853

Root Cause

In PageFinder::getQueryAllowedTemplates() (line ~2278), static variables cache access control SQL across all PageFinder calls within a request:

  static $where = null;                                                                                                                                                    
  static $where2 = null;                                                                                                                                                   
  static $leftjoin = null;
  static $cacheUserID = null;                                                                                                                                              

On the cached path (lines 2300-2308), the static $where and $where2 variables are passed through the hookable getQueryAllowedTemplatesWhere() method and the return
values are written back to the static variables:

  if(!is_null($where)) {                                                                                                                                                 
      if($hasWhereHook) {
          $where = $this->getQueryAllowedTemplatesWhere($query, $where);   // mutates static
          $where2 = $this->getQueryAllowedTemplatesWhere($query, $where2); // mutates static                                                                               
      }
      $query->where($where);                                                                                                                                               
      $query->where($where2);                                                                                                                                              
      $query->leftjoin($leftjoin);
      return;                                                                                                                                                              
  }                                                                                                                                                                      

Each pass through the hook can add bind parameter placeholders to the $where strings, but the corresponding bind values only exist on the current query object. The
static strings accumulate placeholders from previous calls, causing a mismatch when the next query is executed.

The same parent works twice because PagesLoader (line ~409) has a selector string cache that returns results before reaching PageFinder on a cache hit, so the bug path
is never reached.

Proposed Fix

Use local copies instead of mutating the statics (lines 2300-2308):

  if(!is_null($where)) {                                                                                                                                                   
      $localWhere = $where;                                                                                                                                              
      $localWhere2 = $where2;
      if($hasWhereHook) {
          $localWhere = $this->getQueryAllowedTemplatesWhere($query, $localWhere);
          $localWhere2 = $this->getQueryAllowedTemplatesWhere($query, $localWhere2);                                                                                       
      }
      $query->where($localWhere);                                                                                                                                          
      if($localWhere2) $query->where($localWhere2);                                                                                                                        
      if($leftjoin) $query->leftjoin($leftjoin);
      return;                                                                                                                                                              
  }                                                                                                                                                                      

Notes

• Works as superuser (access control bypassed entirely at line 2276)
• Works when only system templates (admin, home, user) have useRoles
• Works when check_access=0 is added to the selector
• Not caused by third-party modules (tested with all disabled)
• Same wire/ folder works on other sites that don't have useRoles + childTemplates on content templates

[ryancramerdesign]

Thanks for the thorough writeup and the proposed fix — your root cause analysis was spot on. The fix has been applied to both PageFinder.php and PageFinder2.php in the dev branch (commit b25dc343). It uses local copies of the static variables on the cached path so the hook return values cannot accumulate placeholders across calls.

-Claude

[adrianbj]

@ryancramerdesign - I don't see these changes in the repo and I can't find commit b25dc343 anywhere.