WordPress.org

Make WordPress Core

Changeset 39563


Ignore:
Timestamp:
12/11/16 21:25:40 (12 months ago)
Author:
rachelbaker
Message:

REST API: Allow schema sanitization_callback to be set to null to bypass fallback sanitization functions.

The logic in WP_REST_Request->sanitize_params() added in [39091] did not account for null or false being the sanitization_callback preventing overriding rest_parse_request_arg(). This fixes that oversight, allowing the built in sanitization function to be bypassed. See #38593.

Props kkoppenhaver, rachelbaker, jnylen0.
Fixes #39042.

Location:
trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-includes/rest-api/class-wp-rest-request.php

    r39111 r39563  
    819819            } 
    820820            foreach ( $this->params[ $type ] as $key => $value ) { 
    821                 // if no sanitize_callback was specified, default to rest_parse_request_arg 
    822                 // if a type was specified in the args. 
    823                 if ( ! isset( $attributes['args'][ $key ]['sanitize_callback'] ) && ! empty( $attributes['args'][ $key ]['type'] ) ) { 
    824                     $attributes['args'][ $key ]['sanitize_callback'] = 'rest_parse_request_arg'; 
    825                 } 
    826                 // Check if this param has a sanitize_callback added. 
    827                 if ( ! isset( $attributes['args'][ $key ] ) || empty( $attributes['args'][ $key ]['sanitize_callback'] ) ) { 
     821                if ( ! isset( $attributes['args'][ $key ] ) ) { 
    828822                    continue; 
    829823                } 
    830  
    831                 $sanitized_value = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value, $this, $key ); 
     824                $param_args = $attributes['args'][ $key ]; 
     825 
     826                // If the arg has a type but no sanitize_callback attribute, default to rest_parse_request_arg. 
     827                if ( ! array_key_exists( 'sanitize_callback', $param_args ) && ! empty( $param_args['type'] ) ) { 
     828                    $param_args['sanitize_callback'] = 'rest_parse_request_arg'; 
     829                } 
     830                // If there's still no sanitize_callback, nothing to do here. 
     831                if ( empty( $param_args['sanitize_callback'] ) ) { 
     832                    continue; 
     833                } 
     834 
     835                $sanitized_value = call_user_func( $param_args['sanitize_callback'], $value, $this, $key ); 
    832836 
    833837                if ( is_wp_error( $sanitized_value ) ) { 
  • trunk/tests/phpunit/tests/rest-api/rest-request.php

    r39109 r39563  
    341341        $this->assertWPError( $valid ); 
    342342        $this->assertEquals( 'rest_invalid_param', $valid->get_error_code() ); 
     343    } 
     344 
     345    public function test_sanitize_params_with_null_callback() { 
     346        $this->request->set_url_params( array( 
     347            'some_email' => '', 
     348        ) ); 
     349 
     350        $this->request->set_attributes( array( 
     351            'args' => array( 
     352                'some_email' => array( 
     353                    'type'              => 'string', 
     354                    'format'            => 'email', 
     355                    'sanitize_callback' => null, 
     356                ), 
     357            ), 
     358        ) ); 
     359 
     360        $this->assertTrue( $this->request->sanitize_params() ); 
     361    } 
     362 
     363    public function test_sanitize_params_with_false_callback() { 
     364        $this->request->set_url_params( array( 
     365            'some_uri'   => 1.23422, 
     366        ) ); 
     367 
     368        $this->request->set_attributes( array( 
     369            'args' => array( 
     370                'some_uri' => array( 
     371                    'type'              => 'string', 
     372                    'format'            => 'uri', 
     373                    'sanitize_callback' => false, 
     374                ), 
     375            ), 
     376        ) ); 
     377 
     378        $this->assertTrue( $this->request->sanitize_params() ); 
    343379    } 
    344380 
Note: See TracChangeset for help on using the changeset viewer.