Changeset 39089

Timestamp:

11/02/2016 06:01:49 AM (8 years ago)

Author:

rmccue

Message:

REST API: Avoid default sanitization for polymorphic params.

Some parameters (title, content, etc) are objects in the output, but allow objects or strings to be sent in updates for a more ergonomic interface. This is pretty weird behaviour, so the default sanitisation doesn't handle this. We instead handle this ourselves in the preparation.

Props joehoyle, rachelbaker.
Fixes #38529.

Location:

trunk/src/wp-includes/rest-api/endpoints

Files:

• class-wp-rest-comments-controller.php (modified) (1 diff)
• class-wp-rest-posts-controller.php (modified) (3 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -1133 +1133 @@
                     'type'            => 'object',
                     'context'         => array( 'view', 'edit', 'embed' ),
+                    'arg_options'     => array(
+                        'sanitize_callback' => null, // Note: sanitization implemented in self::prepare_item_for_database()
+                    ),
                     'properties'      => array(
                         'raw'         => array(

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -1814 +1814 @@
                         'type'        => 'object',
                         'context'     => array( 'view', 'edit', 'embed' ),
+                        'arg_options' => array(
+                            'sanitize_callback' => null, // Note: sanitization implemented in self::prepare_item_for_database()
+                        ),
                         'properties'  => array(
                             'raw' => array(
@@ -1835 +1838 @@
                         'type'        => 'object',
                         'context'     => array( 'view', 'edit' ),
+                        'arg_options' => array(
+                            'sanitize_callback' => null, // Note: sanitization implemented in self::prepare_item_for_database()
+                        ),
                         'properties'  => array(
                             'raw' => array(
@@ -1870 +1876 @@
                         'type'        => 'object',
                         'context'     => array( 'view', 'edit', 'embed' ),
+                        'arg_options' => array(
+                            'sanitize_callback' => null, // Note: sanitization implemented in self::prepare_item_for_database()
+                        ),
                         'properties'  => array(
                             'raw' => array(