Changeset 52016 for trunk/src/wp-includes/widgets.php

Timestamp:

11/05/2021 02:14:07 AM (3 years ago)

Author:

TimothyBlynJacobs

Message:

REST API: Allow sidebars and their widgets to be public.

By default, only users with the edit_theme_options capability can access the sidebars and widgets REST API endpoints. In this commit, A new show_in_rest parameter is added to the register_sidebar function. When enabled, all users will be able to access that sidebar and any widgets belonging to that sidebar.

This commit reduces the context for a widget's instance information to only edit. This is to ensure that internal widget data is not inadvertently exposed to the public. A future ticket may expose additional APIs to allow widget authors to indicate that their instance data can be safely exposed. REST API consumers intending to access this instance information should take care to explicitly set the context parameter to edit.

Props spacedmonkey, zieladam.
Fixes #53915.

File:

• trunk/src/wp-includes/widgets.php (modified) (4 diffs)

trunk/src/wp-includes/widgets.php

@@ -221 +221 @@
  * @since 2.2.0
  * @since 5.6.0 Added the `before_sidebar` and `after_sidebar` arguments.
+ * @since 5.9.0 Added the `show_in_rest` argument.
  *
  * @global array $wp_registered_sidebars Registered sidebars.
@@ -251 +252 @@
  *                                  Outputs before the {@see 'dynamic_sidebar_after'} action.
  *                                  Default empty string.
+ *     @type bool $show_in_rest     Whether to show this sidebar publicly in the REST API.
+ *                                  Defaults to only showing the sidebar to administrator users.
  * }
  * @return string Sidebar ID added to $wp_registered_sidebars global.
@@ -273 +276 @@
         'before_sidebar' => '',
         'after_sidebar'  => '',
+        'show_in_rest'   => false,
     );
 
@@ -1037 +1041 @@
 
 /**
+ * Retrieves the registered sidebar with the given id.
+ *
+ * @since 5.9.0
+ *
+ * @global array $wp_registered_sidebars The registered sidebars.
+ *
+ * @param string $id The sidebar id.
+ * @return array|null The discovered sidebar, or null if it is not registered.
+ */
+function wp_get_sidebar( $id ) {
+    global $wp_registered_sidebars;
+
+    foreach ( (array) $wp_registered_sidebars as $sidebar ) {
+        if ( $sidebar['id'] === $id ) {
+            return $sidebar;
+        }
+    }
+
+    if ( 'wp_inactive_widgets' === $id ) {
+        return array(
+            'id'   => 'wp_inactive_widgets',
+            'name' => __( 'Inactive widgets' ),
+        );
+    }
+
+    return null;
+}
+
+/**
  * Set the sidebar widget option to update sidebars.
  *