Ticket #40450: 40450.diff

src/wp-includes/class-oembed.php

@@ -319 +319 @@
         }
 
         /**
-         * The do-it-all function that takes a URL and attempts to return the HTML.
+         * Takes a URL and attempts to return the oEmbed data.
          *
          * @see WP_oEmbed::fetch()
-         * @see WP_oEmbed::data2html()
          *
-         * @since 2.9.0
+         * @since 4.8.0
          * @access public
          *
          * @param string       $url  The URL to the content that should be attempted to be embedded.
          * @param array|string $args Optional. Arguments, usually passed from a shortcode. Default empty.
-         * @return false|string False on failure, otherwise the UNSANITIZED (and potentially unsafe) HTML that should be used to embed.
+         * @return array|false oEmbed data array on success, false on failure.
          */
-        public function get_html( $url, $args = '' ) {
+        public function get_data( $url, $args = '' ) {
                 $args = wp_parse_args( $args );
 
                 /**
@@ -357 +356 @@
 
                 $provider = $this->get_provider( $url, $args );
 
-                if ( ! $provider || false === $data = $this->fetch( $provider, $url, $args ) ) {
+                if ( ! $provider ) {
+                        return false;
+                }
+
+                $data = $this->fetch( $provider, $url, $args );
+
+                if ( false === $data ) {
+                        return false;
+                }
+
+                return (array) $data;
+        }
+
+        /**
+         * The do-it-all function that takes a URL and attempts to return the HTML.
+         *
+         * @see WP_oEmbed::fetch()
+         * @see WP_oEmbed::data2html()
+         *
+         * @since 2.9.0
+         * @access public
+         *
+         * @param string       $url  The URL to the content that should be attempted to be embedded.
+         * @param array|string $args Optional. Arguments, usually passed from a shortcode. Default empty.
+         * @return false|string False on failure, otherwise the UNSANITIZED (and potentially unsafe) HTML that should be used to embed.
+         */
+        public function get_html( $url, $args = '' ) {
+                $data = $this->get_data( $url, $args );
+
+                if ( false === $data ) {
                         return false;
                 }
 

src/wp-includes/class-wp-oembed-controller.php

@@ -52 +52 @@
                                 ),
                         ),
                 ) );
+
+                register_rest_route( 'oembed/1.0', '/proxy', array(
+                        array(
+                                'methods'  => WP_REST_Server::READABLE,
+                                'callback' => array( $this, 'get_proxy_item' ),
+                                'permission_callback' => array( $this, 'get_proxy_item_permissions_check' ),
+                                'args'     => array(
+                                        'url'      => array(
+                                                'required'          => true,
+                                                'sanitize_callback' => 'esc_url_raw',
+                                        ),
+                                        'format'   => array(
+                                                'default'           => 'json',
+                                                'sanitize_callback' => 'wp_oembed_ensure_format',
+                                        ),
+                                        'maxwidth' => array(
+                                                'default'           => $maxwidth,
+                                                'sanitize_callback' => 'absint',
+                                        ),
+                                        'maxheight' => array(
+                                                'sanitize_callback' => 'absint',
+                                        ),
+                                ),
+                        ),
+                ) );
         }
 
         /**
-         * Callback for the API endpoint.
+         * Callback for the embed API endpoint.
          *
          * Returns the JSON object for the post.
          *
@@ -86 +111 @@
 
                 return $data;
         }
+
+        /**
+         * Checks if current user can make a proxy oEmbed request.
+         *
+         * @since 4.8.0
+         * @access public
+         *
+         * @return true|WP_Error True if the request has read access, WP_Error object otherwise.
+         */
+        function get_proxy_item_permissions_check() {
+
+                if ( ! current_user_can( 'edit_posts' ) ) {
+                        return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to make proxied oEmbed requests.' ), array( 'status' => rest_authorization_required_code() ) );
+                }
+                return true;
+        }
+
+        /**
+         * Callback for the proxy API endpoint.
+         *
+         * Returns the JSON object for the proxied item.
+         *
+         * @since 4.8.0
+         * @access public
+         *
+         * @see WP_oEmbed::get_html()
+         * @param WP_REST_Request $request Full data about the request.
+         * @return WP_Error|array oEmbed response data or WP_Error on failure.
+         */
+        public function get_proxy_item( $request ) {
+                $url = $request['url'];
+                $args = $request->get_params();
+                unset( $args['url'] );
+
+                $data = _wp_oembed_get_object()->get_data( $url, $args );
+
+                if ( false === $data ) {
+                        return new WP_Error( 'oembed_invalid_url', get_status_header_desc( 404 ), array( 'status' => 404 ) );
+                }
+
+                return $data;
+        }
 }