Changeset 38982 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-settings-controller.php

Timestamp:

10/27/2016 04:07:06 PM (9 years ago)

Author:

rachelbaker

Message:

REST API: Return WP_Error when a client is attempting to update an option with a non-scalar value to null.

A null value is returned in the response for any option that has a non-scalar value.

To protect clients from accidentally including the null values from a response object in a request, we do not allow options with non-scalar values to be updated to null. Without this added protection a client could mistakenly delete all options that have non-scalar values from the database.

Props joehoyle, rachelbaker.
Fixes #38527.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-settings-controller.php (modified) (2 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-settings-controller.php

@@ -96 +96 @@
      */
     protected function prepare_value( $value, $schema ) {
+        // If the value is not a scalar, it's not possible to cast it to
+        // anything.
+        if ( ! is_scalar( $value ) ) {
+            return null;
+        }
+
         switch ( $schema['type'] ) {
             case 'string':
@@ -142 +148 @@
             }
 
-            // A null value means reset the option, which is essentially deleting it
-            // from the database and then relying on the default value.
+            /**
+            * A `null` value for an option would have the same effect as
+            * deleting the option from the database, and relying on the
+            * default value.
+            */
             if ( is_null( $request[ $name ] ) ) {
+                /**
+                 * A `null` value is returned in the response for any option
+                 * that has a non-scalar value.
+                 *
+                 * To protect clients from accidentally including the `null`
+                 * values from a response object in a request, we do not allow
+                 * options with non-scalar values to be updated to `null`.
+                 * Without this added protection a client could mistakenly
+                 * delete all options that have non-scalar values from the
+                 * database.
+                 */
+                if ( ! is_scalar( get_option( $args['option_name'], false ) ) ) {
+                    return new WP_Error(
+                        'rest_invalid_stored_value', sprintf( __( 'The %s property has an invalid stored value, and cannot be updated to null.' ), $name ), array( 'status' => 500 )
+                    );
+                }
+
                 delete_option( $args['option_name'] );
             } else {