Changeset 39642

Timestamp:

12/27/2016 05:48:10 PM (10 years ago)

Author:

rachelbaker

Message:

REST API: Allow schema sanitization_callback to be set to null to bypass fallback sanitization functions.

The logic in WP_REST_Request->sanitize_params() added in [39091] did not account for null or false being the sanitization_callback preventing overriding rest_parse_request_arg(). This fixes that oversight, allowing the built in sanitization function to be bypassed. See #38593.

Merges [39563] to the 4.7 branch.

Props kkoppenhaver, rachelbaker, jnylen0.
Fixes #39042.

Location:

branches/4.7

Files:

• . (modified) (1 prop)
• src/wp-includes/rest-api/class-wp-rest-request.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-request.php (modified) (1 diff)

branches/4.7/src/wp-includes/rest-api/class-wp-rest-request.php

@@ -824 +824 @@
                         }
                         foreach ( $this->params[ $type ] as $key => $value ) {
-                                // if no sanitize_callback was specified, default to rest_parse_request_arg
-                                // if a type was specified in the args.
-                                if ( ! isset( $attributes['args'][ $key ]['sanitize_callback'] ) && ! empty( $attributes['args'][ $key ]['type'] ) ) {
-                                        $attributes['args'][ $key ]['sanitize_callback'] = 'rest_parse_request_arg';
-                                }
-                                // Check if this param has a sanitize_callback added.
-                                if ( ! isset( $attributes['args'][ $key ] ) || empty( $attributes['args'][ $key ]['sanitize_callback'] ) ) {
+                                if ( ! isset( $attributes['args'][ $key ] ) ) {
                                         continue;
                                 }
-
-                                $sanitized_value = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value, $this, $key );
+                                $param_args = $attributes['args'][ $key ];
+
+                                // If the arg has a type but no sanitize_callback attribute, default to rest_parse_request_arg.
+                                if ( ! array_key_exists( 'sanitize_callback', $param_args ) && ! empty( $param_args['type'] ) ) {
+                                        $param_args['sanitize_callback'] = 'rest_parse_request_arg';
+                                }
+                                // If there's still no sanitize_callback, nothing to do here.
+                                if ( empty( $param_args['sanitize_callback'] ) ) {
+                                        continue;
+                                }
+
+                                $sanitized_value = call_user_func( $param_args['sanitize_callback'], $value, $this, $key );
 
                                 if ( is_wp_error( $sanitized_value ) ) {

branches/4.7/tests/phpunit/tests/rest-api/rest-request.php

@@ -343 +343 @@
                 $this->assertWPError( $valid );
                 $this->assertEquals( 'rest_invalid_param', $valid->get_error_code() );
+        }
+
+        public function test_sanitize_params_with_null_callback() {
+                $this->request->set_url_params( array(
+                        'some_email' => '',
+                ) );
+
+                $this->request->set_attributes( array(
+                        'args' => array(
+                                'some_email' => array(
+                                        'type'              => 'string',
+                                        'format'            => 'email',
+                                        'sanitize_callback' => null,
+                                ),
+                        ),
+                ) );
+
+                $this->assertTrue( $this->request->sanitize_params() );
+        }
+
+        public function test_sanitize_params_with_false_callback() {
+                $this->request->set_url_params( array(
+                        'some_uri'   => 1.23422,
+                ) );
+
+                $this->request->set_attributes( array(
+                        'args' => array(
+                                'some_uri' => array(
+                                        'type'              => 'string',
+                                        'format'            => 'uri',
+                                        'sanitize_callback' => false,
+                                ),
+                        ),
+                ) );
+
+                $this->assertTrue( $this->request->sanitize_params() );
         }