Changeset 41035

Timestamp:

07/12/2017 10:50:57 PM (9 years ago)

Author:

westonruter

Message:

REST API: Remove _wpnonce value from being used in hashed oEmbed proxy cache key.

Amends [40628].
Props r-a-y, westonruter.
See #40450.
Fixes #41048.

Location:

trunk

Files:

• src/wp-includes/class-wp-oembed-controller.php (modified) (1 diff)
• tests/phpunit/tests/oembed/controller.php (modified) (4 diffs)

trunk/src/wp-includes/class-wp-oembed-controller.php

@@ -160 +160 @@
 
                 // Serve oEmbed data from cache if set.
+                unset( $args['_wpnonce'] );
                 $cache_key = 'oembed_' . md5( serialize( $args ) );
                 $data = get_transient( $cache_key );

trunk/tests/phpunit/tests/oembed/controller.php

@@ -11 +11 @@
         protected $server;
         protected static $editor;
+        protected static $administrator;
         protected static $subscriber;
         const YOUTUBE_VIDEO_ID = 'OQSNhk5ICTI';
@@ -22 +23 @@
                         'role'       => 'editor',
                         'user_email' => 'editor@example.com',
+                ) );
+                self::$administrator = $factory->user->create( array(
+                        'role'       => 'administrator',
+                        'user_email' => 'administrator@example.com',
                 ) );
         }
@@ -478 +483 @@
         public function test_proxy_with_valid_oembed_provider() {
                 wp_set_current_user( self::$editor );
-
                 $request = new WP_REST_Request( 'GET', '/oembed/1.0/proxy' );
                 $request->set_param( 'url', 'https://www.youtube.com/watch?v=' . self::YOUTUBE_VIDEO_ID );
+                $request->set_param( '_wpnonce', wp_create_nonce( 'wp_rest' ) );
                 $response = $this->server->dispatch( $request );
                 $this->assertEquals( 200, $response->get_status() );
@@ -486 +491 @@
 
                 // Subsequent request is cached and so it should not cause a request.
+                $this->server->dispatch( $request );
+                $this->assertEquals( 1, $this->request_count );
+
+                // Rest with another user should also be cached.
+                wp_set_current_user( self::$administrator );
+                $request = new WP_REST_Request( 'GET', '/oembed/1.0/proxy' );
+                $request->set_param( 'url', 'https://www.youtube.com/watch?v=' . self::YOUTUBE_VIDEO_ID );
+                $request->set_param( '_wpnonce', wp_create_nonce( 'wp_rest' ) );
                 $response = $this->server->dispatch( $request );
                 $this->assertEquals( 1, $this->request_count );