Ticket #37560: 37560.diff

src/wp-includes/rest-api/class-wp-rest-request.php

@@ -793 +793 @@
 
                 $order = $this->get_parameter_order();
 
+                $invalid_params = array();
+
                 foreach ( $order as $type ) {
                         if ( empty( $this->params[ $type ] ) ) {
                                 continue;
@@ -800 +802 @@
                         foreach ( $this->params[ $type ] as $key => $value ) {
                                 // Check if this param has a sanitize_callback added.
                                 if ( isset( $attributes['args'][ $key ] ) && ! empty( $attributes['args'][ $key ]['sanitize_callback'] ) ) {
-                                        $this->params[ $type ][ $key ] = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value, $this, $key );
+                                        $sanitized_value = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value, $this, $key );
+                                        if ( is_wp_error( $sanitized_value ) ) {
+                                                $invalid_params[ $key ] = $sanitized_value->get_error_message();
+                                        } else {
+                                                $this->params[ $type ][ $key ] = $sanitized_value;
+                                        }
+
                                 }
                         }
                 }
-                return null;
-        }
+                if( $invalid_params )
+                        return new WP_Error( 'rest_invalid_param', sprintf( __( 'Invalid parameter(s): %s' ), implode( ', ', array_keys( $invalid_params ) ) ), array( 'status' => 400, 'params' => $invalid_params ) );
+                return null
+;       }
 
         /**
          * Checks whether this request is valid according to its attributes.

src/wp-includes/rest-api/class-wp-rest-server.php

@@ -866 +866 @@
                                         $check_required = $request->has_valid_params();
                                         if ( is_wp_error( $check_required ) ) {
                                                 $response = $check_required;
+                                        } else {
+                                                $check_sanitized = $request->sanitize_params();
+                                                if ( is_wp_error( $check_sanitized ) ) {
+                                                        $response = $check_sanitized;
+                                                }
                                         }
-
-                                        $request->sanitize_params();
                                 }
 
                                 if ( ! is_wp_error( $response ) ) {