mirror_php/wordpress
1
0
Fork 0
mirror of git://develop.git.wordpress.org/ synced 2025-01-17 21:08:44 +01:00
Code Issues Actions 99 Packages Projects Releases Wiki Activity

REST API: Allow schema sanitization_callback to be set to null to bypass fallback sanitization functions.

Browse Source 
The logic in WP_REST_Request->sanitize_params() added in [39091] did not account for `null` or `false` being the sanitization_callback preventing overriding `rest_parse_request_arg()`. This fixes that oversight, allowing the built in sanitization function to be bypassed. See #38593.

Merges [39563] to the 4.7  branch.

Props kkoppenhaver, rachelbaker, jnylen0.
Fixes #39042.


git-svn-id: https://develop.svn.wordpress.org/branches/4.7@39642 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Rachel Baker 2016-12-27 17:48:10 +00:00
parent 7d2dd7c861
commit 7b4f4be327
2 changed files with 47 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/wp-includes/rest-api/class-wp-rest-request.php
View File

@ -823,17 +823,21 @@ class WP_REST_Request implements ArrayAccess {
continue;
}
foreach ( $this->params[ $type ] as $key => $value ) {
// if no sanitize_callback was specified, default to rest_parse_request_arg
// if a type was specified in the args.
if ( ! isset( $attributes['args'][ $key ]['sanitize_callback'] ) && ! empty( $attributes['args'][ $key ]['type'] ) ) {
$attributes['args'][ $key ]['sanitize_callback'] = 'rest_parse_request_arg';
if ( ! isset( $attributes['args'][ $key ] ) ) {
continue;
}
// Check if this param has a sanitize_callback added.
if ( ! isset( $attributes['args'][ $key ] ) || empty( $attributes['args'][ $key ]['sanitize_callback'] ) ) {
$param_args = $attributes['args'][ $key ];
// If the arg has a type but no sanitize_callback attribute, default to rest_parse_request_arg.
if ( ! array_key_exists( 'sanitize_callback', $param_args ) && ! empty( $param_args['type'] ) ) {
$param_args['sanitize_callback'] = 'rest_parse_request_arg';
}
// If there's still no sanitize_callback, nothing to do here.
if ( empty( $param_args['sanitize_callback'] ) ) {
continue;
}
$sanitized_value = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value, $this, $key );
$sanitized_value = call_user_func( $param_args['sanitize_callback'], $value, $this, $key );
if ( is_wp_error( $sanitized_value ) ) {
$invalid_params[ $key ] = $sanitized_value->get_error_message();

36
tests/phpunit/tests/rest-api/rest-request.php
View File

@ -344,6 +344,42 @@ class Tests_REST_Request extends WP_UnitTestCase {
$this->assertEquals( 'rest_invalid_param', $valid->get_error_code() );
}
public function test_sanitize_params_with_null_callback() {
$this->request->set_url_params( array(
'some_email' => '',
) );
$this->request->set_attributes( array(
'args' => array(
'some_email' => array(
'type' => 'string',
'format' => 'email',
'sanitize_callback' => null,
),
),
) );
$this->assertTrue( $this->request->sanitize_params() );
}
public function test_sanitize_params_with_false_callback() {
$this->request->set_url_params( array(
'some_uri' => 1.23422,
) );
$this->request->set_attributes( array(
'args' => array(
'some_uri' => array(
'type' => 'string',
'format' => 'uri',
'sanitize_callback' => false,
),
),
) );
$this->assertTrue( $this->request->sanitize_params() );
}
public function test_has_valid_params_required_flag() {
$this->request->set_attributes( array(
'args' => array(