Changeset 50695 for trunk/src/wp-includes/rest-api/class-wp-rest-server.php

Timestamp:

04/09/2021 09:26:07 PM (3 years ago)

Author:

rachelbaker

Message:

REST API: Move the rest_jsonp_enabled filter before setting the Content-Type header.

Fixes an issue where if JSONP was disabled the Content-Type HTTP header was still set to application/javascript.

Props dd32, TimothyBlynJacobs.
Fixes #52691.

File:

• trunk/src/wp-includes/rest-api/class-wp-rest-server.php (modified) (3 diffs)

trunk/src/wp-includes/rest-api/class-wp-rest-server.php

@@ -265 +265 @@
         }
 
-        $content_type = isset( $_GET['_jsonp'] ) ? 'application/javascript' : 'application/json';
+        /**
+         * Filters whether JSONP is enabled for the REST API.
+         *
+         * @since 4.4.0
+         *
+         * @param bool $jsonp_enabled Whether JSONP is enabled. Default true.
+         */
+        $jsonp_enabled = apply_filters( 'rest_jsonp_enabled', true );
+
+        $jsonp_callback = false;
+        if ( isset( $_GET['_jsonp'] ) ) {
+            $jsonp_callback = $_GET['_jsonp'];
+        }
+
+        $content_type = ( $jsonp_callback && $jsonp_enabled ) ? 'application/javascript' : 'application/json';
         $this->send_header( 'Content-Type', $content_type . '; charset=' . get_option( 'blog_charset' ) );
         $this->send_header( 'X-Robots-Tag', 'noindex' );
@@ -356 +370 @@
         );
 
-        /**
-         * Filters whether JSONP is enabled for the REST API.
-         *
-         * @since 4.4.0
-         *
-         * @param bool $jsonp_enabled Whether JSONP is enabled. Default true.
-         */
-        $jsonp_enabled = apply_filters( 'rest_jsonp_enabled', true );
-
-        $jsonp_callback = null;
-
-        if ( isset( $_GET['_jsonp'] ) ) {
+        if ( $jsonp_callback ) {
             if ( ! $jsonp_enabled ) {
                 echo $this->json_error( 'rest_callback_disabled', __( 'JSONP support is disabled on this site.' ), 400 );
@@ -373 +376 @@
             }
 
-            $jsonp_callback = $_GET['_jsonp'];
             if ( ! wp_check_jsonp_callback( $jsonp_callback ) ) {
                 echo $this->json_error( 'rest_callback_invalid', __( 'Invalid JSONP callback function.' ), 400 );