Changeset 52016 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-widgets-controller.php

Timestamp:

11/05/2021 02:14:07 AM (3 years ago)

Author:

TimothyBlynJacobs

Message:

REST API: Allow sidebars and their widgets to be public.

By default, only users with the edit_theme_options capability can access the sidebars and widgets REST API endpoints. In this commit, A new show_in_rest parameter is added to the register_sidebar function. When enabled, all users will be able to access that sidebar and any widgets belonging to that sidebar.

This commit reduces the context for a widget's instance information to only edit. This is to ensure that internal widget data is not inadvertently exposed to the public. A future ticket may expose additional APIs to allow widget authors to indicate that their instance data can be safely exposed. REST API consumers intending to access this instance information should take care to explicitly set the context parameter to edit.

Props spacedmonkey, zieladam.
Fixes #53915.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-widgets-controller.php (modified) (11 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-widgets-controller.php

@@ -16 +16 @@
  */
 class WP_REST_Widgets_Controller extends WP_REST_Controller {
+
+    /**
+     * Tracks whether {@see retrieve_widgets()} has been called in the current request.
+     *
+     * @since 5.9.0
+     * @var bool
+     */
+    protected $widgets_retrieved = false;
 
     /**
@@ -98 +106 @@
      */
     public function get_items_permissions_check( $request ) {
+        $this->retrieve_widgets();
+        if ( isset( $request['sidebar'] ) && $this->check_read_sidebar_permission( $request['sidebar'] ) ) {
+            return true;
+        }
+
+        foreach ( wp_get_sidebars_widgets() as $sidebar_id => $widget_ids ) {
+            if ( $this->check_read_sidebar_permission( $sidebar_id ) ) {
+                return true;
+            }
+        }
+
         return $this->permissions_check( $request );
     }
@@ -110 +129 @@
      */
     public function get_items( $request ) {
-        retrieve_widgets();
-
-        $prepared = array();
+        $this->retrieve_widgets();
+
+        $prepared          = array();
+        $permissions_check = $this->permissions_check( $request );
 
         foreach ( wp_get_sidebars_widgets() as $sidebar_id => $widget_ids ) {
@@ -119 +139 @@
             }
 
+            if ( is_wp_error( $permissions_check ) && ! $this->check_read_sidebar_permission( $sidebar_id ) ) {
+                continue;
+            }
+
             foreach ( $widget_ids as $widget_id ) {
                 $response = $this->prepare_item_for_response( compact( 'sidebar_id', 'widget_id' ), $request );
@@ -140 +164 @@
      */
     public function get_item_permissions_check( $request ) {
+        $this->retrieve_widgets();
+
+        $widget_id  = $request['id'];
+        $sidebar_id = wp_find_widgets_sidebar( $widget_id );
+
+        if ( $sidebar_id && $this->check_read_sidebar_permission( $sidebar_id ) ) {
+            return true;
+        }
+
         return $this->permissions_check( $request );
     }
 
     /**
+     * Checks if a sidebar can be read publicly.
+     *
+     * @since 5.9.0
+     *
+     * @param string $sidebar_id The sidebar id.
+     * @return bool Whether the sidebar can be read.
+     */
+    protected function check_read_sidebar_permission( $sidebar_id ) {
+        $sidebar = wp_get_sidebar( $sidebar_id );
+
+        return ! empty( $sidebar['show_in_rest'] );
+    }
+
+    /**
      * Gets an individual widget.
      *
@@ -152 +199 @@
      */
     public function get_item( $request ) {
-        retrieve_widgets();
+        $this->retrieve_widgets();
 
         $widget_id  = $request['id'];
@@ -248 +295 @@
          */
         wp_get_sidebars_widgets();
-
-        retrieve_widgets();
+        $this->retrieve_widgets();
 
         $widget_id  = $request['id'];
@@ -324 +370 @@
          */
         wp_get_sidebars_widgets();
-
-        retrieve_widgets();
+        $this->retrieve_widgets();
 
         $widget_id  = $request['id'];
@@ -438 +483 @@
 
         return true;
+    }
+
+    /**
+     * Looks for "lost" widgets once per request.
+     *
+     * @since 5.9.0
+     *
+     * @see retrieve_widgets()
+     */
+    protected function retrieve_widgets() {
+        if ( ! $this->widgets_retrieved ) {
+            retrieve_widgets();
+            $this->widgets_retrieved = true;
+        }
     }
 
@@ -768 +827 @@
                     'description' => __( 'Instance settings of the widget, if supported.' ),
                     'type'        => 'object',
-                    'context'     => array( 'view', 'edit', 'embed' ),
+                    'context'     => array( 'edit' ),
                     'default'     => null,
                     'properties'  => array(
@@ -774 +833 @@
                             'description' => __( 'Base64 encoded representation of the instance settings.' ),
                             'type'        => 'string',
-                            'context'     => array( 'view', 'edit', 'embed' ),
+                            'context'     => array( 'edit' ),
                         ),
                         'hash'    => array(
                             'description' => __( 'Cryptographic hash of the instance settings.' ),
                             'type'        => 'string',
-                            'context'     => array( 'view', 'edit', 'embed' ),
+                            'context'     => array( 'edit' ),
                         ),
                         'raw'     => array(
                             'description' => __( 'Unencoded instance settings, if supported.' ),
                             'type'        => 'object',
-                            'context'     => array( 'view', 'edit', 'embed' ),
+                            'context'     => array( 'edit' ),
                         ),
                     ),