Ticket #48264: 48264.diff

src/wp-includes/formatting.php

@@ -5403 +5403 @@
         return stripslashes_deep( $value );
 }
 
+/**
+ * Adds slashes to only string values in an array of values.
+ *
+ * This should be used when preparing data for core API that expects slashed data.
+ * This should not be used to escape data going directly into an SQL query.
+ *
+ * @since 5.3.0
+ *
+ * @param mixed $value Scalar or array of scalars.
+ * @return mixed Slashes $value
+ */
+function wp_slash_strings_only( $value ) {
+        return map_deep( $value, 'addslashes_strings_only' );
+}
+
+/**
+ * Adds slashes to only string values.
+ *
+ * @since 5.3.0
+ *
+ * @param mixed $value
+ * @return mixed
+ */
+function addslashes_strings_only( $value ) {
+        return is_string( $value ) ? addslashes( $value ) : $value;
+}
+
 /**
  * Extract and return the first URL from passed content.
  *

src/wp-includes/rest-api/fields/class-wp-rest-meta-fields.php

@@ -365 +365 @@
                         }
                 }
 
-                if ( ! update_metadata( $meta_type, $object_id, wp_slash( $meta_key ), wp_slash( $value ) ) ) {
+                if ( ! update_metadata( $meta_type, $object_id, wp_slash( $meta_key ), wp_slash_strings_only( $value ) ) ) {
                         return new WP_Error(
                                 'rest_meta_database_error',
                                 /* translators: %s: Custom field key. */

tests/phpunit/tests/rest-api/rest-post-meta-fields.php

@@ -2264 +2264 @@
                 self::assertFalse( $registered );
         }
 
+        /**
+         * @ticket 48264
+         */
+        public function test_update_array_of_ints_meta() {
+                $this->grant_write_permission();
+                register_post_meta(
+                        'post',
+                        'items',
+                        array(
+                                'single'       => true,
+                                'type'         => 'array',
+                                'show_in_rest' => array(
+                                        'schema' => array(
+                                                'items' => array(
+                                                        'type' => 'integer',
+                                                ),
+                                        ),
+                                ),
+                        )
+                );
+
+                $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) );
+                $request->set_body_params(
+                        array(
+                                'meta' => array(
+                                        'items' => array( 1, 2, 3 ),
+                                ),
+                        )
+                );
+
+                rest_get_server()->dispatch( $request );
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+        }
+
+        /**
+         * @ticket 48264
+         */
+        public function test_update_array_of_ints_meta_stored_strings_are_updated() {
+                $this->grant_write_permission();
+                register_post_meta(
+                        'post',
+                        'items',
+                        array(
+                                'single'       => true,
+                                'type'         => 'array',
+                                'show_in_rest' => array(
+                                        'schema' => array(
+                                                'items' => array(
+                                                        'type' => 'integer',
+                                                ),
+                                        ),
+                                ),
+                        )
+                );
+
+                update_post_meta( self::$post_id, 'items', array( '1', '2', '3' ) );
+
+                $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) );
+                $request->set_body_params(
+                        array(
+                                'meta' => array(
+                                        'items' => array( 1, 2, 3 ),
+                                ),
+                        )
+                );
+
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+                $this->assertSame( array( 1, 2, 3 ), get_post_meta( self::$post_id, 'items', true ) );
+        }
+
+        /**
+         * @ticket 48264
+         */
+        public function test_update_array_of_ints_meta_string_request_data_is_set_as_ints() {
+                $this->grant_write_permission();
+                register_post_meta(
+                        'post',
+                        'items',
+                        array(
+                                'single'       => true,
+                                'type'         => 'array',
+                                'show_in_rest' => array(
+                                        'schema' => array(
+                                                'items' => array(
+                                                        'type' => 'integer',
+                                                ),
+                                        ),
+                                ),
+                        )
+                );
+
+                update_post_meta( self::$post_id, 'items', array( 1, 2, 3 ) );
+
+                $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) );
+                $request->set_body_params(
+                        array(
+                                'meta' => array(
+                                        'items' => array( '1', '2', '3' ),
+                                ),
+                        )
+                );
+
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+                $this->assertSame( array( 1, 2, 3 ), get_post_meta( self::$post_id, 'items', true ) );
+        }
+
+        /**
+         * @ticket 48264
+         */
+        public function test_update_array_of_ints_meta_string_request_data_and_string_stored_data() {
+                $this->grant_write_permission();
+                register_post_meta(
+                        'post',
+                        'items',
+                        array(
+                                'single'       => true,
+                                'type'         => 'array',
+                                'show_in_rest' => array(
+                                        'schema' => array(
+                                                'items' => array(
+                                                        'type' => 'integer',
+                                                ),
+                                        ),
+                                ),
+                        )
+                );
+
+                update_post_meta( self::$post_id, 'items', array( '1', '2', '3' ) );
+
+                $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) );
+                $request->set_body_params(
+                        array(
+                                'meta' => array(
+                                        'items' => array( '1', '2', '3' ),
+                                ),
+                        )
+                );
+
+                $response = rest_get_server()->dispatch( $request );
+                $this->assertEquals( 200, $response->get_status() );
+                $this->assertSame( array( 1, 2, 3 ), get_post_meta( self::$post_id, 'items', true ) );
+        }
+
         /**
          * Internal function used to disable an insert query which
          * will trigger a wpdb error for testing purposes.

tests/qunit/fixtures/wp-api-generated.js

@@ -2304 +2304 @@
                 }
             ]
         },
-        "/wp/v2/media/(?P<id>[\\d+])/post-process": {
+        "/wp/v2/media/(?P<id>[\\d]+)/post-process": {
             "namespace": "wp/v2",
             "methods": [
                 "POST"