Changeset 41035

Timestamp:

07/12/2017 10:50:57 PM (7 years ago)

Author:

westonruter

Message:

REST API: Remove _wpnonce value from being used in hashed oEmbed proxy cache key.

Amends [40628].
Props r-a-y, westonruter.
See #40450.
Fixes #41048.

Location:

trunk

Files:

• src/wp-includes/class-wp-oembed-controller.php (modified) (1 diff)
• tests/phpunit/tests/oembed/controller.php (modified) (4 diffs)

trunk/src/wp-includes/class-wp-oembed-controller.php

@@ -160 +160 @@
 
         // Serve oEmbed data from cache if set.
+        unset( $args['_wpnonce'] );
         $cache_key = 'oembed_' . md5( serialize( $args ) );
         $data = get_transient( $cache_key );

trunk/tests/phpunit/tests/oembed/controller.php

@@ -11 +11 @@
     protected $server;
     protected static $editor;
+    protected static $administrator;
     protected static $subscriber;
     const YOUTUBE_VIDEO_ID = 'OQSNhk5ICTI';
@@ -22 +23 @@
             'role'       => 'editor',
             'user_email' => 'editor@example.com',
+        ) );
+        self::$administrator = $factory->user->create( array(
+            'role'       => 'administrator',
+            'user_email' => 'administrator@example.com',
         ) );
     }
@@ -478 +483 @@
     public function test_proxy_with_valid_oembed_provider() {
         wp_set_current_user( self::$editor );
-
         $request = new WP_REST_Request( 'GET', '/oembed/1.0/proxy' );
         $request->set_param( 'url', 'https://www.youtube.com/watch?v=' . self::YOUTUBE_VIDEO_ID );
+        $request->set_param( '_wpnonce', wp_create_nonce( 'wp_rest' ) );
         $response = $this->server->dispatch( $request );
         $this->assertEquals( 200, $response->get_status() );
@@ -486 +491 @@
 
         // Subsequent request is cached and so it should not cause a request.
+        $this->server->dispatch( $request );
+        $this->assertEquals( 1, $this->request_count );
+
+        // Rest with another user should also be cached.
+        wp_set_current_user( self::$administrator );
+        $request = new WP_REST_Request( 'GET', '/oembed/1.0/proxy' );
+        $request->set_param( 'url', 'https://www.youtube.com/watch?v=' . self::YOUTUBE_VIDEO_ID );
+        $request->set_param( '_wpnonce', wp_create_nonce( 'wp_rest' ) );
         $response = $this->server->dispatch( $request );
         $this->assertEquals( 1, $this->request_count );