Ticket #34999: 34999.diff

src/wp-includes/rest-api/class-wp-rest-server.php

@@ -858 +858 @@
                                         if ( null !== $dispatch_result ) {
                                                 $response = $dispatch_result;
                                         } else {
-                                                $response = call_user_func( $callback, $request );
+                                                try {
+                                                        $response = call_user_func( $callback, $request );
+                                                } catch ( Exception $e ) {
+
+                                                        /**
+                                                         * A message propagated via wp_die() is safe to show to the user, any other Exception is not
+                                                         * okay to output for information disclosure reasons.
+                                                         */
+                                                        if ( strpos( $e->getMessage(), 'wp_die():' ) === 0 ) {
+                                                                $response = new WP_Error( 'wp-die-error', $e->getMessage(), array( 'status' => $e->getCode() ) );
+                                                        } else {
+                                                                $response = new WP_Error( 'unknown-exception', __( "An unexpected error occured." ), array( 'status' => 500 ) );
+                                                        }
+                                                }
                                         }
                                 }
 

src/wp-includes/rest-api.php

@@ -117 +117 @@
         add_filter( 'rest_post_dispatch', 'rest_send_allow_header', 10, 3 );
 
         add_filter( 'rest_pre_dispatch', 'rest_handle_options_request', 10, 3 );
+        add_filter( 'rest_pre_dispatch', 'rest_add_wp_die_handler_filter' );
 }
 
 /**
@@ -648 +649 @@
 
         return array( $local, $utc );
 }
+
+
+/**
+ * Add the filter for the custom wp_die handler.
+ *
+ * This is hooked on rest_pre_dispatch, so any uses of wp_die in endpoints
+ * will be wrapped by our custom wp_die handler to output JSON rather than the
+ * usual HTML error page.
+ *
+ * @since 4.5.0
+ */
+function rest_add_wp_die_handler_filter() {
+        add_filter( 'wp_die_handler', 'rest_wp_die_handler_callback' );
+}
+
+/**
+ * Callback to set the wp_die handler to rest_wp_die_handler.
+ *
+ * @since 4.5.0
+ * @return string
+ */
+function rest_wp_die_handler_callback() {
+        return 'rest_wp_die_handler';
+}
+
+/**
+ * A custom wp_die handler for use in the REST API.
+ *
+ * When wp_die() is invoked from within an endpoint callback, we override the handler
+ * to output a valid JSON response.
+ *
+ * @since 4.5.9
+ * @param string $message
+ * @param string $title
+ * @param array $args
+ */
+function rest_wp_die_handler( $message, $title = '', $args = array() ) {
+
+        $args = wp_parse_args( $args, array( 'response' => 500 ) );
+
+        if ( $title ) {
+                $message = "$title: $message";
+        }
+
+        throw new Exception( 'wp_die(): ' . $message , $args['response'] );
+}