WordPress.org

Make WordPress Core


Ignore:
Timestamp:
12/11/2016 09:25:40 PM (3 years ago)
Author:
rachelbaker
Message:

REST API: Allow schema sanitization_callback to be set to null to bypass fallback sanitization functions.

The logic in WP_REST_Request->sanitize_params() added in [39091] did not account for null or false being the sanitization_callback preventing overriding rest_parse_request_arg(). This fixes that oversight, allowing the built in sanitization function to be bypassed. See #38593.

Props kkoppenhaver, rachelbaker, jnylen0.
Fixes #39042.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/tests/phpunit/tests/rest-api/rest-request.php

    r39109 r39563  
    341341        $this->assertWPError( $valid );
    342342        $this->assertEquals( 'rest_invalid_param', $valid->get_error_code() );
     343    }
     344
     345    public function test_sanitize_params_with_null_callback() {
     346        $this->request->set_url_params( array(
     347            'some_email' => '',
     348        ) );
     349
     350        $this->request->set_attributes( array(
     351            'args' => array(
     352                'some_email' => array(
     353                    'type'              => 'string',
     354                    'format'            => 'email',
     355                    'sanitize_callback' => null,
     356                ),
     357            ),
     358        ) );
     359
     360        $this->assertTrue( $this->request->sanitize_params() );
     361    }
     362
     363    public function test_sanitize_params_with_false_callback() {
     364        $this->request->set_url_params( array(
     365            'some_uri'   => 1.23422,
     366        ) );
     367
     368        $this->request->set_attributes( array(
     369            'args' => array(
     370                'some_uri' => array(
     371                    'type'              => 'string',
     372                    'format'            => 'uri',
     373                    'sanitize_callback' => false,
     374                ),
     375            ),
     376        ) );
     377
     378        $this->assertTrue( $this->request->sanitize_params() );
    343379    }
    344380
Note: See TracChangeset for help on using the changeset viewer.