Changeset 52016 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-sidebars-controller.php

Timestamp:

11/05/2021 02:14:07 AM (5 years ago)

Author:

TimothyBlynJacobs

Message:

REST API: Allow sidebars and their widgets to be public.

By default, only users with the edit_theme_options capability can access the sidebars and widgets REST API endpoints. In this commit, A new show_in_rest parameter is added to the register_sidebar function. When enabled, all users will be able to access that sidebar and any widgets belonging to that sidebar.

This commit reduces the context for a widget's instance information to only edit. This is to ensure that internal widget data is not inadvertently exposed to the public. A future ticket may expose additional APIs to allow widget authors to indicate that their instance data can be safely exposed. REST API consumers intending to access this instance information should take care to explicitly set the context parameter to edit.

Props spacedmonkey, zieladam.
Fixes #53915.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-sidebars-controller.php (modified) (6 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-sidebars-controller.php

@@ -18 +18 @@
  */
 class WP_REST_Sidebars_Controller extends WP_REST_Controller {
+
+        /**
+         * Tracks whether {@see retrieve_widgets()} has been called in the current request.
+         *
+         * @since 5.9.0
+         * @var bool
+         */
+        protected $widgets_retrieved = false;
 
         /**
@@ -87 +95 @@
          */
         public function get_items_permissions_check( $request ) {
-                return $this->do_permissions_check();
-        }
-
-        /**
-         * Retrieves the list of sidebars (active or inactive).
-         *
-         * @since 5.8.0
-         *
-         * @param WP_REST_Request $request Full details about the request.
-         * @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
-         */
-        public function get_items( $request ) {
-                retrieve_widgets();
-
-                $data = array();
+                $this->retrieve_widgets();
                 foreach ( wp_get_sidebars_widgets() as $id => $widgets ) {
                         $sidebar = $this->get_sidebar( $id );
@@ -109 +103 @@
                         }
 
+                        if ( $this->check_read_permission( $sidebar ) ) {
+                                return true;
+                        }
+                }
+
+                return $this->do_permissions_check();
+        }
+
+        /**
+         * Retrieves the list of sidebars (active or inactive).
+         *
+         * @since 5.8.0
+         *
+         * @param WP_REST_Request $request Full details about the request.
+         * @return WP_REST_Response Response object on success.
+         */
+        public function get_items( $request ) {
+                $this->retrieve_widgets();
+
+                $data              = array();
+                $permissions_check = $this->do_permissions_check();
+
+                foreach ( wp_get_sidebars_widgets() as $id => $widgets ) {
+                        $sidebar = $this->get_sidebar( $id );
+
+                        if ( ! $sidebar ) {
+                                continue;
+                        }
+
+                        if ( is_wp_error( $permissions_check ) && ! $this->check_read_permission( $sidebar ) ) {
+                                continue;
+                        }
+
                         $data[] = $this->prepare_response_for_collection(
                                 $this->prepare_item_for_response( $sidebar, $request )
@@ -126 +153 @@
          */
         public function get_item_permissions_check( $request ) {
+                $this->retrieve_widgets();
+
+                $sidebar = $this->get_sidebar( $request['id'] );
+                if ( $sidebar && $this->check_read_permission( $sidebar ) ) {
+                        return true;
+                }
+
                 return $this->do_permissions_check();
         }
 
         /**
+         * Checks if a sidebar can be read publicly.
+         *
+         * @since 5.9.0
+         *
+         * @param array $sidebar The registered sidebar configuration.
+         * @return bool Whether the side can be read.
+         */
+        protected function check_read_permission( $sidebar ) {
+                return ! empty( $sidebar['show_in_rest'] );
+        }
+
+        /**
          * Retrieves one sidebar from the collection.
          *
@@ -138 +184 @@
          */
         public function get_item( $request ) {
-                retrieve_widgets();
+                $this->retrieve_widgets();
 
                 $sidebar = $this->get_sidebar( $request['id'] );
-
                 if ( ! $sidebar ) {
                         return new WP_Error( 'rest_sidebar_not_found', __( 'No sidebar exists with that id.' ), array( 'status' => 404 ) );
@@ -235 +280 @@
          * @since 5.8.0
          *
-         * @global array $wp_registered_sidebars The registered sidebars.
-         *
          * @param string|int $id ID of the sidebar.
          * @return array|null The discovered sidebar, or null if it is not registered.
          */
         protected function get_sidebar( $id ) {
-                global $wp_registered_sidebars;
-
-                foreach ( (array) $wp_registered_sidebars as $sidebar ) {
-                        if ( $sidebar['id'] === $id ) {
-                                return $sidebar;
-                        }
-                }
-
-                if ( 'wp_inactive_widgets' === $id ) {
-                        return array(
-                                'id'   => 'wp_inactive_widgets',
-                                'name' => __( 'Inactive widgets' ),
-                        );
-                }
-
-                return null;
+                return wp_get_sidebar( $id );
+        }
+
+        /**
+         * Looks for "lost" widgets once per request.
+         *
+         * @since 5.9.0
+         *
+         * @see retrieve_widgets()
+         */
+        protected function retrieve_widgets() {
+                if ( ! $this->widgets_retrieved ) {
+                        retrieve_widgets();
+                        $this->widgets_retrieved = true;
+                }
         }