Changeset 47755

Timestamp:

05/03/2020 10:40:53 PM (6 years ago)

Author:

TimothyBlynJacobs

Message:

REST API: Validate that the oembed url parameter is a string.

This prevents a PHP warning from being issued by esc_url_raw when a non-string value is provided.

Props dd32.
Fixes #49991.

File:

• trunk/src/wp-includes/class-wp-oembed-controller.php (modified) (2 diffs)

trunk/src/wp-includes/class-wp-oembed-controller.php

@@ -41 +41 @@
                                         'args'     => array(
                                                 'url'      => array(
-                                                        'required'          => true,
-                                                        'sanitize_callback' => 'esc_url_raw',
+                                                        'description' => __( 'The URL of the resource for which to fetch oEmbed data.' ),
+                                                        'required'    => true,
+                                                        'type'        => 'string',
+                                                        'format'      => 'uri',
                                                 ),
                                                 'format'   => array(
@@ -67 +69 @@
                                         'args'                => array(
                                                 'url'       => array(
-                                                        'description'       => __( 'The URL of the resource for which to fetch oEmbed data.' ),
-                                                        'type'              => 'string',
-                                                        'required'          => true,
-                                                        'sanitize_callback' => 'esc_url_raw',
+                                                        'description' => __( 'The URL of the resource for which to fetch oEmbed data.' ),
+                                                        'required'    => true,
+                                                        'type'        => 'string',
+                                                        'format'      => 'uri',
                                                 ),
                                                 'format'    => array(