Changeset 38982 for trunk/tests/phpunit/tests/rest-api/rest-settings-controller.php

Timestamp:

10/27/2016 04:07:06 PM (9 years ago)

Author:

rachelbaker

Message:

REST API: Return WP_Error when a client is attempting to update an option with a non-scalar value to null.

A null value is returned in the response for any option that has a non-scalar value.

To protect clients from accidentally including the null values from a response object in a request, we do not allow options with non-scalar values to be updated to null. Without this added protection a client could mistakenly delete all options that have non-scalar values from the database.

Props joehoyle, rachelbaker.
Fixes #38527.

File:

• trunk/tests/phpunit/tests/rest-api/rest-settings-controller.php (modified) (2 diffs)

trunk/tests/phpunit/tests/rest-api/rest-settings-controller.php

@@ -160 +160 @@
     }
 
+    public function test_get_item_with_invalid_value_array_in_options() {
+        wp_set_current_user( self::$administrator );
+
+        register_setting( 'somegroup', 'mycustomsetting', array(
+            'show_in_rest' => array(
+                'name'   => 'mycustomsettinginrest',
+                'schema' => array(
+                    'enum'    => array( 'validvalue1', 'validvalue2' ),
+                    'default' => 'validvalue1',
+                ),
+            ),
+            'type'         => 'string',
+        ) );
+
+        update_option( 'mycustomsetting', array( 'A sneaky array!' ) );
+
+        $request = new WP_REST_Request( 'GET', '/wp/v2/settings' );
+        $response = $this->server->dispatch( $request );
+        $data = $response->get_data();
+        $this->assertEquals( null, $data['mycustomsettinginrest'] );
+    }
+
+    public function test_get_item_with_invalid_object_array_in_options() {
+        wp_set_current_user( self::$administrator );
+
+        register_setting( 'somegroup', 'mycustomsetting', array(
+            'show_in_rest' => array(
+                'name'   => 'mycustomsettinginrest',
+                'schema' => array(
+                    'enum'    => array( 'validvalue1', 'validvalue2' ),
+                    'default' => 'validvalue1',
+                ),
+            ),
+            'type'         => 'string',
+        ) );
+
+        update_option( 'mycustomsetting', (object) array( 'A sneaky array!' ) );
+
+        $request = new WP_REST_Request( 'GET', '/wp/v2/settings' );
+        $response = $this->server->dispatch( $request );
+        $data = $response->get_data();
+        $this->assertEquals( null, $data['mycustomsettinginrest'] );
+    }
+
+
     public function test_create_item() {
     }
@@ -249 +294 @@
     }
 
+    public function test_update_item_with_invalid_stored_value_in_options() {
+        wp_set_current_user( self::$administrator );
+
+        register_setting( 'somegroup', 'mycustomsetting', array(
+            'show_in_rest' => true,
+            'type'         => 'string',
+        ) );
+        update_option( 'mycustomsetting', array( 'A sneaky array!' ) );
+
+        wp_set_current_user( self::$administrator );
+        $request = new WP_REST_Request( 'PUT', '/wp/v2/settings' );
+        $request->set_param( 'mycustomsetting', null );
+        $response = $this->server->dispatch( $request );
+
+        $this->assertErrorResponse( 'rest_invalid_stored_value', $response, 500 );
+    }
+
     public function test_delete_item() {
     }