Changeset 38040

Timestamp:

07/13/2016 04:12:41 AM (8 years ago)

Author:

jeremyfelt

Message:

Meta: Remove filters when meta is unregistered.

If auth and/or sanitize callbacks are specified in the arguments for
register_meta(), filters are added to handle these callbacks. These
should be removed when calling unregister_meta_key() to avoid
unintentional filtering.

See #35658.

Location:

trunk

Files:

• src/wp-includes/meta.php (modified) (1 diff)
• tests/phpunit/tests/meta/registerMeta.php (modified) (3 diffs)

trunk/src/wp-includes/meta.php

@@ -1163 +1163 @@
     }
 
+    $args = $wp_meta_keys[ $object_type ][ $object_subtype ][ $meta_key ];
+
+    if ( isset( $args['sanitize_callback'] ) && is_callable( $args['sanitize_callback'] ) ) {
+        remove_filter( "sanitize_{$object_type}_{$object_subtype}_meta_{$meta_key}", $args['sanitize_callback'] );
+    }
+
+    if ( isset( $args['auth_callback'] ) && is_callable( $args['auth_callback'] ) ) {
+        remove_filter( "auth_{$object_type}_{$object_subtype}_meta_{$meta_key}", $args['auth_callback'] );
+    }
+
     unset( $wp_meta_keys[ $object_type ][ $object_subtype ][ $meta_key ] );
 

trunk/tests/phpunit/tests/meta/registerMeta.php

@@ -33 +33 @@
     }
 
+    public function _new_auth_meta_cb( $allowed, $meta_key, $post_id, $user_id, $cap, $caps ) {
+        return $allowed;
+    }
+
     public function test_register_meta_with_valid_object_type_and_object_subtype_returns_true() {
         $result = register_meta( 'post', 'flight_number', array( 'object_subtype' => 'post' ) );
@@ -201 +205 @@
         unregister_meta_key( 'post', 'post', 'flight_number' );
 
-        remove_filter( 'sanitize_post_post_meta_flight_number', array( $this, '_new_sanitize_meta_cb') );
-        remove_filter( 'auth_post_post_meta_flight_number', '__return_true');
-
         $this->assertTrue( $result );
     }
@@ -213 +214 @@
         unregister_meta_key( 'post', 'post', 'new_sanitized_key' );
 
-        remove_filter( 'sanitize_post_post_meta_new_sanitized_key', array( $this, '_new_sanitize_meta_cb') );
-        remove_filter( 'auth_post_post_meta_new_sanitized_key', '__return_true');
-
         $this->assertEquals( 'new_sanitized_key new sanitized', $meta );
+    }
+
+    public function test_register_meta_unregistered_meta_key_removes_sanitize_filter() {
+        register_meta( 'post', 'new_sanitized_key', array( 'object_subtype' => 'post', 'sanitize_callback' => array( $this, '_new_sanitize_meta_cb' ) ) );
+        unregister_meta_key( 'post', 'post', 'new_sanitized_key' );
+
+        $has_filter = has_filter( 'sanitize_post_post_meta_new_sanitized_key', array( $this, '_new_sanitize_meta_cb' ) );
+
+        $this->assertFalse( $has_filter );
+    }
+
+    public function test_register_meta_unregistered_meta_key_removes_auth_filter() {
+        register_meta( 'post', 'new_auth_key', array( 'object_subtype' => 'post', 'auth_callback' => array( $this, '_new_auth_meta_cb' ) ) );
+        unregister_meta_key( 'post', 'post', 'new_auth_key' );
+
+        $has_filter = has_filter( 'auth_post_post_meta_new_auth_key', array( $this, '_new_auth_meta_cb' ) );
+
+        $this->assertFalse( $has_filter );
     }