Changeset 38601

Timestamp:

09/14/2016 03:49:37 PM (8 years ago)

Author:

joehoyle

Message:

REST API: Enable sanitize_callback to return WP_Error.

Give developers the opportunity to reject incoming data without using the validation callback. It also enables us to do sanitization and validation in one function in instances where this could be useful.

Props websupporter, rmccue.
Fixes #37560.

Location:

trunk

Files:

• src/wp-includes/rest-api/class-wp-rest-request.php (modified) (4 diffs)
• src/wp-includes/rest-api/class-wp-rest-server.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-request.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/class-wp-rest-request.php

@@ -781 +781 @@
      * @access public
      *
-     * @return true|null True if there are no parameters to sanitize, null otherwise.
+     * @return true|WP_Error True if parameters were sanitized, WP_Error if an error occurred during sanitization.
      */
     public function sanitize_params() {
-
         $attributes = $this->get_attributes();
 
@@ -793 +792 @@
 
         $order = $this->get_parameter_order();
+
+        $invalid_params = array();
 
         foreach ( $order as $type ) {
@@ -800 +801 @@
             foreach ( $this->params[ $type ] as $key => $value ) {
                 // Check if this param has a sanitize_callback added.
-                if ( isset( $attributes['args'][ $key ] ) && ! empty( $attributes['args'][ $key ]['sanitize_callback'] ) ) {
-                    $this->params[ $type ][ $key ] = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value, $this, $key );
+                if ( ! isset( $attributes['args'][ $key ] ) || empty( $attributes['args'][ $key ]['sanitize_callback'] ) ) {
+                    continue;
+                }
+
+                $sanitized_value = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value, $this, $key );
+
+                if ( is_wp_error( $sanitized_value ) ) {
+                    $invalid_params[ $key ] = $sanitized_value->get_error_message();
+                } else {
+                    $this->params[ $type ][ $key ] = $sanitized_value;
                 }
             }
         }
-        return null;
+
+        if ( $invalid_params ) {
+            return new WP_Error( 'rest_invalid_param', sprintf( __( 'Invalid parameter(s): %s' ), implode( ', ', array_keys( $invalid_params ) ) ), array( 'status' => 400, 'params' => $invalid_params ) );
+        }
+
+        return true;
     }
 
@@ -818 +832 @@
      */
     public function has_valid_params() {
-
         $attributes = $this->get_attributes();
         $required = array();

trunk/src/wp-includes/rest-api/class-wp-rest-server.php

@@ -867 +867 @@
                     if ( is_wp_error( $check_required ) ) {
                         $response = $check_required;
+                    } else {
+                        $check_sanitized = $request->sanitize_params();
+                        if ( is_wp_error( $check_sanitized ) ) {
+                            $response = $check_sanitized;
+                        }
                     }
-
-                    $request->sanitize_params();
                 }
 

trunk/tests/phpunit/tests/rest-api/rest-request.php

@@ -308 +308 @@
         $this->assertEquals( 123, $this->request->get_param( 'someinteger' ) );
         $this->assertEquals( 0, $this->request->get_param( 'somestring' ) );
+    }
+
+    public function test_sanitize_params_error() {
+        $this->request->set_url_params( array(
+            'successparam' => '123',
+            'failparam'    => '123',
+        ));
+        $this->request->set_attributes( array(
+            'args' => array(
+                'successparam' => array(
+                    'sanitize_callback' => 'absint',
+                ),
+                'failparam' => array(
+                    'sanitize_callback' => array( $this, '_return_wp_error_on_validate_callback' ),
+                ),
+            ),
+        ));
+
+        $valid = $this->request->sanitize_params();
+        $this->assertWPError( $valid );
+        $this->assertEquals( 'rest_invalid_param', $valid->get_error_code() );
     }