Ticket #43208: 43208.2.diff

src/wp-includes/formatting.php

@@ -4314 +4314 @@
 }
 
 /**
+ * Validates an option value based on the nature of the option.
+ *
+ * The {@see 'validate_option_$option'} filter should be used to add errors
+ * to the `WP_Error` object passed-through.
+ *
+ * @since 5.0.0
+ *
+ * @param string $option The name of the option.
+ * @param string $value  The unsanitized value.
+ * @return true|WP_Error True if the input was validated, otherwise WP_Error.
+ */
+function validate_option( $option, $value ) {
+        $validity = new WP_Error();
+
+        /**
+         * Validates an option value.
+         *
+         * Plugins should amend the `$validity` object via its `WP_Error::add()` method.
+         *
+         * The dynamic portion of the hook name, `$option`, refers to the option name.
+         *
+         * @since 5.0.0
+         *
+         * @param WP_Error $validity Filtered from `true` to `WP_Error` when invalid.
+         * @param mixed    $value    The option value.
+         */
+        $validity = apply_filters( "validate_option_{$option}", $validity, $value );
+
+        if ( is_wp_error( $validity ) && empty( $validity->errors ) ) {
+                $validity = true;
+        }
+
+        return $validity;
+}
+
+/**
  * Sanitises various option values based on the nature of the option.
  *
  * This is basically a switch statement which will pass $value through a number

src/wp-includes/option.php

@@ -2032 +2032 @@
  *
  * @since 2.7.0
  * @since 4.7.0 `$args` can be passed to set flags on the setting, similar to `register_meta()`.
+ * @since 5.0.0 Introduced the `$validate_callback` argument.
  *
  * @global array $new_whitelist_options
  * @global array $wp_registered_settings
@@ -2045 +2046 @@
  *     @type string   $type              The type of data associated with this setting.
  *                                       Valid values are 'string', 'boolean', 'integer', and 'number'.
  *     @type string   $description       A description of the data attached to this setting.
+ *     @type callable $validate_callback A callback that checks validity of the option's value.
  *     @type callable $sanitize_callback A callback function that sanitizes the option's value.
  *     @type bool     $show_in_rest      Whether data associated with this setting should be included in the REST API.
  *     @type mixed    $default           Default value when calling `get_option()`.
@@ -2057 +2059 @@
                 'type'              => 'string',
                 'group'             => $option_group,
                 'description'       => '',
+                'validate_callback' => null,
                 'sanitize_callback' => null,
                 'show_in_rest'      => false,
         );
@@ -2110 +2113 @@
         }
 
         $new_whitelist_options[ $option_group ][] = $option_name;
+        if ( ! empty( $args['validate_callback'] ) ) {
+                add_filter( "validate_option_{$option_name}", $args['validate_callback'], 10, 3 );
+        }
         if ( ! empty( $args['sanitize_callback'] ) ) {
                 add_filter( "sanitize_option_{$option_name}", $args['sanitize_callback'] );
         }
@@ -2177 +2183 @@
         }
 
         if ( isset( $wp_registered_settings[ $option_name ] ) ) {
+                // Remove the validate callback if one was set during registration.
+                if ( ! empty( $wp_registered_settings[ $option_name ]['validate_callback'] ) ) {
+                        remove_filter( "validate_option_{$option_name}", $wp_registered_settings[ $option_name ]['validate_callback'], 10 );
+                }
+
                 // Remove the sanitize callback if one was set during registration.
                 if ( ! empty( $wp_registered_settings[ $option_name ]['sanitize_callback'] ) ) {
                         remove_filter( "sanitize_option_{$option_name}", $wp_registered_settings[ $option_name ]['sanitize_callback'] );