Changeset 39046 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-settings-controller.php

Timestamp:

10/31/2016 01:47:36 AM (10 years ago)

Author:

pento

Message:

REST API: Add support for arrays in schema validation and sanitization.

By allowing more fine-grained validation and sanitisation of endpoint args, we can ensure the correct data is being passed to endpoints.

This can easily be extended to support new data types, such as CSV fields or objects.

Props joehoyle, rachelbaker, pento.
Fixes #38531.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-settings-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-settings-controller.php

@@ -289 +289 @@
                 foreach ( $options as $option_name => $option ) {
                         $schema['properties'][ $option_name ] = $option['schema'];
+                        $schema['properties'][ $option_name ]['arg_options'] = array(
+                                'sanitize_callback' => array( $this, 'sanitize_callback' ),
+                        );
                 }
 
                 return $this->add_additional_fields_schema( $schema );
         }
+
+        /**
+         * Custom sanitize callback used for all options to allow the use of 'null'.
+         *
+         * By default, the schema of settings will throw an error if a value is set to
+         * `null` as it's not a valid value for something like "type => string". We
+         * provide a wrapper sanitizer to whitelist the use of `null`.
+         *
+         * @param  mixed           $value   The value for the setting.
+         * @param  WP_REST_Request $request The request object.
+         * @param  string          $param   The parameter name.
+         * @return mixed|WP_Error
+         */
+        public function sanitize_callback( $value, $request, $param ) {
+                if ( is_null( $value ) ) {
+                        return $value;
+                }
+                return rest_parse_request_arg( $value, $request, $param );
+        }
 }