Changeset 39401

Timestamp:

12/01/2016 02:18:41 AM (8 years ago)

Author:

rachelbaker

Message:

REST API: Fix incorrect uses of rest_sanitize_value_from_schema().

In the check_username() and check_password() callbacks in the Users controller cast the provided request value to a string. The rest_sanitize_value_from_schema() function was being used incorrectly which was causing unintended request parsing.
In rest_sanitize_request_arg() do not pass nonexistent third parameter for the rest_sanitize_value_from_schema() function.

Props jnylen0, joehoyle, rachelbaker, ocean90.

Merges [39400] to the 4.7 branch.
Fixes #38984 for 4.7.

Location:

branches/4.7/src/wp-includes

Files:

• rest-api.php (modified) (1 diff)
• rest-api/endpoints/class-wp-rest-users-controller.php (modified) (2 diffs)

branches/4.7/src/wp-includes/rest-api.php

@@ -841 +841 @@
     $args = $attributes['args'][ $param ];
 
-    return rest_sanitize_value_from_schema( $value, $args, $param );
+    return rest_sanitize_value_from_schema( $value, $args );
 }
 

branches/4.7/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -1028 +1028 @@
      */
     public function check_username( $value, $request, $param ) {
-        $username = (string) rest_sanitize_value_from_schema( $value, $request, $param );
+        $username = (string) $value;
 
         if ( ! validate_username( $username ) ) {
@@ -1057 +1057 @@
      */
     public function check_user_password( $value, $request, $param ) {
-        $password = (string) rest_sanitize_value_from_schema( $value, $request, $param );
+        $password = (string) $value;
 
         if ( empty( $password ) ) {