Changeset 39320 for trunk/src/wp-includes/class-wp-customize-manager.php

Timestamp:

11/19/2016 10:38:40 PM (10 years ago)

Author:

westonruter

Message:

Customize: Ensure that WP_Customize_Manager::save_changeset_post() returns setting_validities even for supplied values that are unchanged from values in changeset.

Check setting existence and authorization via WP_Customize_Manager::validate_setting_values() even for null values to account for custom params being added to settings, preventing failures from being silently ignored.

See #38705, #30937.
Fixes #38865.

File:

• trunk/src/wp-includes/class-wp-customize-manager.php (modified) (6 diffs)

trunk/src/wp-includes/class-wp-customize-manager.php

@@ -1729 +1729 @@
                                 continue;
                         }
-                        if ( is_null( $unsanitized_value ) ) {
-                                continue;
-                        }
                         if ( $options['validate_capability'] && ! current_user_can( $setting->capability ) ) {
                                 $validity = new WP_Error( 'unauthorized', __( 'Unauthorized to modify setting due to capability.' ) );
                         } else {
+                                if ( is_null( $unsanitized_value ) ) {
+                                        continue;
+                                }
                                 $validity = $setting->validate( $unsanitized_value );
                         }
@@ -2031 +2031 @@
                         }
                 }
-                $post_values = wp_array_slice_assoc( $post_values, $changed_setting_ids );
 
                 /**
@@ -2047 +2046 @@
 
                 // Validate settings.
-                $setting_validities = $this->validate_setting_values( $post_values, array(
+                $validated_values = array_merge(
+                        array_fill_keys( array_keys( $args['data'] ), null ), // Make sure existence/capability checks are done on value-less setting updates.
+                        $post_values
+                );
+                $setting_validities = $this->validate_setting_values( $validated_values, array(
                         'validate_capability' => true,
                         'validate_existence' => true,
@@ -2065 +2068 @@
                 }
 
-                $response = array(
-                        'setting_validities' => $setting_validities,
-                );
-
                 // Obtain/merge data for changeset.
                 $original_changeset_data = $this->get_changeset_post_data( $changeset_post_id );
@@ -2106 +2105 @@
                                 unset( $data[ $changeset_setting_id ] );
                         } else {
-                                // Merge any additional setting params that have been supplied with the existing params.
+
                                 if ( ! isset( $data[ $changeset_setting_id ] ) ) {
                                         $data[ $changeset_setting_id ] = array();
                                 }
 
+                                // Merge any additional setting params that have been supplied with the existing params.
+                                $merged_setting_params = array_merge( $data[ $changeset_setting_id ], $setting_params );
+
+                                // Skip updating setting params if unchanged (ensuring the user_id is not overwritten).
+                                if ( $data[ $changeset_setting_id ] === $merged_setting_params ) {
+                                        continue;
+                                }
+
                                 $data[ $changeset_setting_id ] = array_merge(
-                                        $data[ $changeset_setting_id ],
-                                        $setting_params,
+                                        $merged_setting_params,
                                         array(
                                                 'type' => $setting->type,
@@ -2220 +2226 @@
 
                 remove_filter( 'wp_save_post_revision_post_has_changed', array( $this, '_filter_revision_post_has_changed' ) );
+
+                $response = array(
+                        'setting_validities' => $setting_validities,
+                );
 
                 if ( is_wp_error( $r ) ) {