WordPress.org

Make WordPress Core


Ignore:
Timestamp:
12/27/2016 05:48:10 PM (3 years ago)
Author:
rachelbaker
Message:

REST API: Allow schema sanitization_callback to be set to null to bypass fallback sanitization functions.

The logic in WP_REST_Request->sanitize_params() added in [39091] did not account for null or false being the sanitization_callback preventing overriding rest_parse_request_arg(). This fixes that oversight, allowing the built in sanitization function to be bypassed. See #38593.

Merges [39563] to the 4.7 branch.

Props kkoppenhaver, rachelbaker, jnylen0.
Fixes #39042.

Location:
branches/4.7
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.7

  • branches/4.7/src/wp-includes/rest-api/class-wp-rest-request.php

    r39609 r39642  
    824824            }
    825825            foreach ( $this->params[ $type ] as $key => $value ) {
    826                 // if no sanitize_callback was specified, default to rest_parse_request_arg
    827                 // if a type was specified in the args.
    828                 if ( ! isset( $attributes['args'][ $key ]['sanitize_callback'] ) && ! empty( $attributes['args'][ $key ]['type'] ) ) {
    829                     $attributes['args'][ $key ]['sanitize_callback'] = 'rest_parse_request_arg';
    830                 }
    831                 // Check if this param has a sanitize_callback added.
    832                 if ( ! isset( $attributes['args'][ $key ] ) || empty( $attributes['args'][ $key ]['sanitize_callback'] ) ) {
     826                if ( ! isset( $attributes['args'][ $key ] ) ) {
    833827                    continue;
    834828                }
    835 
    836                 $sanitized_value = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value, $this, $key );
     829                $param_args = $attributes['args'][ $key ];
     830
     831                // If the arg has a type but no sanitize_callback attribute, default to rest_parse_request_arg.
     832                if ( ! array_key_exists( 'sanitize_callback', $param_args ) && ! empty( $param_args['type'] ) ) {
     833                    $param_args['sanitize_callback'] = 'rest_parse_request_arg';
     834                }
     835                // If there's still no sanitize_callback, nothing to do here.
     836                if ( empty( $param_args['sanitize_callback'] ) ) {
     837                    continue;
     838                }
     839
     840                $sanitized_value = call_user_func( $param_args['sanitize_callback'], $value, $this, $key );
    837841
    838842                if ( is_wp_error( $sanitized_value ) ) {
Note: See TracChangeset for help on using the changeset viewer.