Changeset 42000 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-controller.php

Timestamp:

10/24/2017 09:04:50 PM (7 years ago)

Author:

joehoyle

Message:

REST API: Don’t remove unregistered properties from objects in schema.

In r41727 the ability to sanitise and validate objects from JSON schema was added, with a whitelist approach. It was decided we should pass through all non-registered properties to reflect the behaviour of the root object in register_rest_route. To prevent arbitrary extra data via setting objects, we force additionalProperties to false in the settings endpoint.

See #38583.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-controller.php

@@ -546 +546 @@
             }
 
-            foreach ( array( 'type', 'format', 'enum', 'items', 'properties' ) as $schema_prop ) {
+            foreach ( array( 'type', 'format', 'enum', 'items', 'properties', 'additionalProperties' ) as $schema_prop ) {
                 if ( isset( $params[ $schema_prop ] ) ) {
                     $endpoint_args[ $field_id ][ $schema_prop ] = $params[ $schema_prop ];