WordPress.org

Make WordPress Core


Ignore:
Timestamp:
12/27/2016 05:48:10 PM (3 years ago)
Author:
rachelbaker
Message:

REST API: Allow schema sanitization_callback to be set to null to bypass fallback sanitization functions.

The logic in WP_REST_Request->sanitize_params() added in [39091] did not account for null or false being the sanitization_callback preventing overriding rest_parse_request_arg(). This fixes that oversight, allowing the built in sanitization function to be bypassed. See #38593.

Merges [39563] to the 4.7 branch.

Props kkoppenhaver, rachelbaker, jnylen0.
Fixes #39042.

Location:
branches/4.7
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.7

  • branches/4.7/tests/phpunit/tests/rest-api/rest-request.php

    r39609 r39642  
    343343        $this->assertWPError( $valid );
    344344        $this->assertEquals( 'rest_invalid_param', $valid->get_error_code() );
     345    }
     346
     347    public function test_sanitize_params_with_null_callback() {
     348        $this->request->set_url_params( array(
     349            'some_email' => '',
     350        ) );
     351
     352        $this->request->set_attributes( array(
     353            'args' => array(
     354                'some_email' => array(
     355                    'type'              => 'string',
     356                    'format'            => 'email',
     357                    'sanitize_callback' => null,
     358                ),
     359            ),
     360        ) );
     361
     362        $this->assertTrue( $this->request->sanitize_params() );
     363    }
     364
     365    public function test_sanitize_params_with_false_callback() {
     366        $this->request->set_url_params( array(
     367            'some_uri'   => 1.23422,
     368        ) );
     369
     370        $this->request->set_attributes( array(
     371            'args' => array(
     372                'some_uri' => array(
     373                    'type'              => 'string',
     374                    'format'            => 'uri',
     375                    'sanitize_callback' => false,
     376                ),
     377            ),
     378        ) );
     379
     380        $this->assertTrue( $this->request->sanitize_params() );
    345381    }
    346382
Note: See TracChangeset for help on using the changeset viewer.