Changeset 39320 for trunk/src/wp-includes/class-wp-customize-manager.php

Timestamp:

11/19/2016 10:38:40 PM (8 years ago)

Author:

westonruter

Message:

Customize: Ensure that WP_Customize_Manager::save_changeset_post() returns setting_validities even for supplied values that are unchanged from values in changeset.

Check setting existence and authorization via WP_Customize_Manager::validate_setting_values() even for null values to account for custom params being added to settings, preventing failures from being silently ignored.

See #38705, #30937.
Fixes #38865.

File:

• trunk/src/wp-includes/class-wp-customize-manager.php (modified) (6 diffs)

trunk/src/wp-includes/class-wp-customize-manager.php

@@ -1729 +1729 @@
                 continue;
             }
-            if ( is_null( $unsanitized_value ) ) {
-                continue;
-            }
             if ( $options['validate_capability'] && ! current_user_can( $setting->capability ) ) {
                 $validity = new WP_Error( 'unauthorized', __( 'Unauthorized to modify setting due to capability.' ) );
             } else {
+                if ( is_null( $unsanitized_value ) ) {
+                    continue;
+                }
                 $validity = $setting->validate( $unsanitized_value );
             }
@@ -2031 +2031 @@
             }
         }
-        $post_values = wp_array_slice_assoc( $post_values, $changed_setting_ids );
 
         /**
@@ -2047 +2046 @@
 
         // Validate settings.
-        $setting_validities = $this->validate_setting_values( $post_values, array(
+        $validated_values = array_merge(
+            array_fill_keys( array_keys( $args['data'] ), null ), // Make sure existence/capability checks are done on value-less setting updates.
+            $post_values
+        );
+        $setting_validities = $this->validate_setting_values( $validated_values, array(
             'validate_capability' => true,
             'validate_existence' => true,
@@ -2065 +2068 @@
         }
 
-        $response = array(
-            'setting_validities' => $setting_validities,
-        );
-
         // Obtain/merge data for changeset.
         $original_changeset_data = $this->get_changeset_post_data( $changeset_post_id );
@@ -2106 +2105 @@
                 unset( $data[ $changeset_setting_id ] );
             } else {
-                // Merge any additional setting params that have been supplied with the existing params.
+
                 if ( ! isset( $data[ $changeset_setting_id ] ) ) {
                     $data[ $changeset_setting_id ] = array();
                 }
 
+                // Merge any additional setting params that have been supplied with the existing params.
+                $merged_setting_params = array_merge( $data[ $changeset_setting_id ], $setting_params );
+
+                // Skip updating setting params if unchanged (ensuring the user_id is not overwritten).
+                if ( $data[ $changeset_setting_id ] === $merged_setting_params ) {
+                    continue;
+                }
+
                 $data[ $changeset_setting_id ] = array_merge(
-                    $data[ $changeset_setting_id ],
-                    $setting_params,
+                    $merged_setting_params,
                     array(
                         'type' => $setting->type,
@@ -2220 +2226 @@
 
         remove_filter( 'wp_save_post_revision_post_has_changed', array( $this, '_filter_revision_post_has_changed' ) );
+
+        $response = array(
+            'setting_validities' => $setting_validities,
+        );
 
         if ( is_wp_error( $r ) ) {