Changeset 47755

Timestamp:

05/03/2020 10:40:53 PM (4 years ago)

Author:

TimothyBlynJacobs

Message:

REST API: Validate that the oembed url parameter is a string.

This prevents a PHP warning from being issued by esc_url_raw when a non-string value is provided.

Props dd32.
Fixes #49991.

File:

• trunk/src/wp-includes/class-wp-oembed-controller.php (modified) (2 diffs)

trunk/src/wp-includes/class-wp-oembed-controller.php

@@ -41 +41 @@
                     'args'     => array(
                         'url'      => array(
-                            'required'          => true,
-                            'sanitize_callback' => 'esc_url_raw',
+                            'description' => __( 'The URL of the resource for which to fetch oEmbed data.' ),
+                            'required'    => true,
+                            'type'        => 'string',
+                            'format'      => 'uri',
                         ),
                         'format'   => array(
@@ -67 +69 @@
                     'args'                => array(
                         'url'       => array(
-                            'description'       => __( 'The URL of the resource for which to fetch oEmbed data.' ),
-                            'type'              => 'string',
-                            'required'          => true,
-                            'sanitize_callback' => 'esc_url_raw',
+                            'description' => __( 'The URL of the resource for which to fetch oEmbed data.' ),
+                            'required'    => true,
+                            'type'        => 'string',
+                            'format'      => 'uri',
                         ),
                         'format'    => array(