Changeset 40805

Timestamp:

05/19/2017 08:26:48 PM (8 years ago)

Author:

jnylen0

Message:

REST API: Avoid sending blank Last-Modified headers with authenticated requests.

This commit adds a new WP_REST_Server#remove_header method and uses it to clear the Last-Modified header when the "no caching" headers are sent (by default for all authenticated REST API requests). This matches the behavior of the nocache_headers function used in other parts of WordPress.

Previously, the REST API would send an empty Last-Modified header in this situation. Under some server and browser configurations, this causes browsers to cache authenticated REST API requests, which is undesirable.

Props iv3rson76, zinigor, rmccue, jnylen0.
Fixes #40444.

Location:

trunk

Files:

• src/wp-includes/rest-api/class-wp-rest-server.php (modified) (2 diffs)
• tests/phpunit/includes/spy-rest-server.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-server.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/class-wp-rest-server.php

@@ -253 +253 @@
         if ( $send_no_cache_headers ) {
             foreach ( wp_get_nocache_headers() as $header => $header_value ) {
-                $this->send_header( $header, $header_value );
+                if ( empty( $header_value ) ) {
+                    $this->remove_header( $header );
+                } else {
+                    $this->send_header( $header, $header_value );
+                }
             }
         }
@@ -1264 +1268 @@
 
     /**
+     * Removes an HTTP header from the current response.
+     *
+     * @since 4.8.0
+     * @access public
+     *
+     * @param string $key Header key.
+     */
+    public function remove_header( $key ) {
+        if ( function_exists( 'header_remove' ) ) {
+            // In PHP 5.3+ there is a way to remove an already set header.
+            header_remove( $key );
+        } else {
+            // In PHP 5.2, send an empty header, but only as a last resort to
+            // override a header already sent.
+            foreach ( headers_list() as $header ) {
+                if ( 0 === stripos( $header, "$key:" ) ) {
+                    $this->send_header( $key, '' );
+                    break;
+                }
+            }
+        }
+    }
+
+    /**
      * Retrieves the raw request entity (body).
      *

trunk/tests/phpunit/includes/spy-rest-server.php

@@ -30 +30 @@
     public function send_header( $header, $value ) {
         $this->sent_headers[ $header ] = $value;
+    }
+
+    public function remove_header( $header ) {
+        unset( $this->sent_headers[ $header ] );
     }
 

trunk/tests/phpunit/tests/rest-api/rest-server.php

@@ -764 +764 @@
 
         foreach ( wp_get_nocache_headers() as $header => $value ) {
+            if ( empty( $value ) ) {
+                continue;
+            }
+
             $this->assertTrue( isset( $headers[ $header ] ), sprintf( 'Header %s is not present in the response.', $header ) );
             $this->assertEquals( $value, $headers[ $header ] );
         }
+
+        // Last-Modified should be unset as per #WP23021
+        $this->assertFalse( isset( $headers['Last-Modified'] ), 'Last-Modified should not be sent.' );
     }