Ticket #34659: 34659.2.diff

src/wp-includes/rest-api/class-wp-rest-request.php

@@ -794 +794 @@
                         foreach ( $this->params[ $type ] as $key => $value ) {
                                 // Check if this param has a sanitize_callback added.
                                 if ( isset( $attributes['args'][ $key ] ) && ! empty( $attributes['args'][ $key ]['sanitize_callback'] ) ) {
-                                        $this->params[ $type ][ $key ] = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value, $this, $key );
+                                        /**
+                                         * Filter sanitization callbacks which should only be supplied one argument
+                                         *
+                                         * Some functions used as sanitization callbacks (e.g. is_numeric()), throw
+                                         * errors when supplied more than one argument.
+                                         *
+                                         * @since 4.4.0
+                                         *
+                                         * @param array    $single_argument_callbacks
+                                         */
+                                        $single_argument_callbacks = apply_filters( 'rest_request_sanitize_callbacks_single_argument', array( 'intval', 'sanitize_title' ) );
+                                        if ( in_array( $attributes['args'][ $key ]['sanitize_callback'], $single_argument_callbacks ) ) {
+                                                $this->params[ $type ][ $key ] = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value );
+                                        } else {
+                                                $this->params[ $type ][ $key ] = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value, $this, $key );
+                                        }
                                 }
                         }
                 }
@@ -844 +859 @@
                         $param = $this->get_param( $key );
 
                         if ( null !== $param && ! empty( $arg['validate_callback'] ) ) {
-                                $valid_check = call_user_func( $arg['validate_callback'], $param, $this, $key );
+
+                                /**
+                                 * Filter validation callbacks which should only be supplied one argument
+                                 *
+                                 * Some functions used as validation callbacks (e.g. is_numeric()), throw
+                                 * errors when supplied more than one argument.
+                                 *
+                                 * @since 4.4.0
+                                 *
+                                 * @param array    $single_argument_callbacks
+                                 */
+                                $single_argument_callbacks = apply_filters( 'rest_request_validate_callbacks_single_argument', array( 'is_numeric' ) );
+                                if ( in_array( $arg['validate_callback'], $single_argument_callbacks ) ) {
+                                        $valid_check = call_user_func( $arg['validate_callback'], $param );
+                                } else {
+                                        $valid_check = call_user_func( $arg['validate_callback'], $param, $this, $key );
+                                }
 
                                 if ( false === $valid_check ) {
                                         $invalid_params[ $key ] = __( 'Invalid param.' );

tests/phpunit/tests/rest-api/rest-request.php

@@ -307 +307 @@
                 $this->assertEquals( 0, $this->request->get_param( 'somestring' ) );
         }
 
+        public function test_sanitize_callback_only_pass_value() {
+                $this->request->set_url_params( array(
+                        'foo'          => '3',
+                        ) );
+                $this->request->set_attributes( array(
+                        'args' => array(
+                                'foo' => array(
+                                        'sanitize_callback' => 'intval',
+                                ),
+                        ),
+                ));
+
+                $this->request->sanitize_params();
+                $this->assertEquals( 3, $this->request->get_param( 'foo' ) );
+
+        }
+
         public function test_has_valid_params_required_flag() {
                 $this->request->set_attributes( array(
                         'args' => array(
@@ -391 +408 @@
                 $this->assertArrayHasKey( 'someinteger', $data['params'] );
                 $this->assertArrayHasKey( 'someotherinteger', $data['params'] );
         }
+
+        public function test_validate_callback_only_pass_value() {
+                $this->request->set_url_params( array(
+                        'numeric_value'         => '123',
+                        'non_numeric_value'     => 'foo-bar',
+                        ) );
+                $this->request->set_attributes( array(
+                        'args' => array(
+                                'numeric_value' => array(
+                                        'validate_callback' => 'is_numeric',
+                                ),
+                                'non_numeric_value' => array(
+                                        'validate_callback' => 'is_numeric',
+                                ),
+                        ),
+                ));
+
+                $valid = $this->request->has_valid_params();
+
+                $this->assertWPError( $valid );
+                $this->assertEquals( 'rest_invalid_param', $valid->get_error_code() );
+                $data = $valid->get_error_data( 'rest_invalid_param' );
+                $this->assertArrayHasKey( 'non_numeric_value', $data['params'] );
+                $this->assertFalse( array_key_exists( 'numeric_value', $data ) );
+
+        }
+
 }