Changeset 51408 for trunk

Timestamp:

07/12/2021 07:02:53 PM (5 years ago)

Author:

desrosj

Message:

Widgets: Use wp_sidebar_description() to retrieve a sidebar’s description.

This switches WP_REST_Sidebars_Controller to use wp_sidebar_description() for retrieving the description of a given sidebar instead of referencing the value in the $wp_registered_sidebars global variable directly.

wp_sidebar_description() uses wp_kses() to only allow the default list of $allowed_tags to be present in a sidebar’s description.

Props timothyblynjacobs, desrosj.
Fixes #53646.

Location:

trunk

Files:

• src/wp-includes/rest-api/endpoints/class-wp-rest-sidebars-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-sidebars-controller.php (modified) (1 diff)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-sidebars-controller.php

@@ -282 +282 @@
                         $sidebar['status']        = 'active';
                         $sidebar['name']          = isset( $registered_sidebar['name'] ) ? $registered_sidebar['name'] : '';
-                        $sidebar['description']   = isset( $registered_sidebar['description'] ) ? $registered_sidebar['description'] : '';
+                        $sidebar['description']   = isset( $registered_sidebar['description'] ) ? wp_sidebar_description( $id ) : '';
                         $sidebar['class']         = isset( $registered_sidebar['class'] ) ? $registered_sidebar['class'] : '';
                         $sidebar['before_widget'] = isset( $registered_sidebar['before_widget'] ) ? $registered_sidebar['before_widget'] : '';

trunk/tests/phpunit/tests/rest-api/rest-sidebars-controller.php

@@ -314 +314 @@
 
         /**
+         * @ticket 53646
+         */
+        public function test_get_items_when_descriptions_have_markup() {
+                register_sidebar(
+                        array(
+                                'name'          => 'New Sidebar',
+                                'id'            => 'new-sidebar',
+                                'description'   => '<iframe></iframe>This is a <b>description</b> with some <a href="#">markup</a>.<script></script>',
+                                'before_widget' => '',
+                                'after_widget'  => '',
+                                'before_title'  => '',
+                                'after_title'   => '',
+                        )
+                );
+
+                $request  = new WP_REST_Request( 'GET', '/wp/v2/sidebars' );
+                $response = rest_get_server()->dispatch( $request );
+                $data     = $response->get_data();
+                $data     = $this->remove_links( $data );
+                $this->assertSame(
+                        array(
+                                array(
+                                        'id'            => 'wp_inactive_widgets',
+                                        'name'          => 'Inactive widgets',
+                                        'description'   => '',
+                                        'class'         => '',
+                                        'before_widget' => '',
+                                        'after_widget'  => '',
+                                        'before_title'  => '',
+                                        'after_title'   => '',
+                                        'status'        => 'inactive',
+                                        'widgets'       => array(),
+                                ),
+                                array(
+                                        'id'            => 'new-sidebar',
+                                        'name'          => 'New Sidebar',
+                                        'description'   => 'This is a <b>description</b> with some <a href="#">markup</a>.',
+                                        'class'         => '',
+                                        'before_widget' => '',
+                                        'after_widget'  => '',
+                                        'before_title'  => '',
+                                        'after_title'   => '',
+                                        'status'        => 'active',
+                                        'widgets'       => array(),
+                                ),
+                        ),
+                        $data
+                );
+        }
+
+        /**
          * @ticket 41683
          */