Changeset 52016 for trunk/tests/phpunit/tests/rest-api/rest-sidebars-controller.php

Timestamp:

11/05/2021 02:14:07 AM (3 years ago)

Author:

TimothyBlynJacobs

Message:

REST API: Allow sidebars and their widgets to be public.

By default, only users with the edit_theme_options capability can access the sidebars and widgets REST API endpoints. In this commit, A new show_in_rest parameter is added to the register_sidebar function. When enabled, all users will be able to access that sidebar and any widgets belonging to that sidebar.

This commit reduces the context for a widget's instance information to only edit. This is to ensure that internal widget data is not inadvertently exposed to the public. A future ticket may expose additional APIs to allow widget authors to indicate that their instance data can be safely exposed. REST API consumers intending to access this instance information should take care to explicitly set the context parameter to edit.

Props spacedmonkey, zieladam.
Fixes #53915.

File:

• trunk/tests/phpunit/tests/rest-api/rest-sidebars-controller.php (modified) (4 diffs)

trunk/tests/phpunit/tests/rest-api/rest-sidebars-controller.php

@@ -166 +166 @@
 
     /**
+     * @ticket 53915
+     */
+    public function test_get_items_no_permission_show_in_rest() {
+        $this->setup_sidebar(
+            'sidebar-1',
+            array(
+                'name'         => 'Test sidebar',
+                'show_in_rest' => true,
+            )
+        );
+        wp_set_current_user( 0 );
+        $request  = new WP_REST_Request( 'GET', '/wp/v2/sidebars' );
+        $response = rest_get_server()->dispatch( $request );
+        $data     = $response->get_data();
+        $data     = $this->remove_links( $data );
+        $this->assertSame(
+            array(
+                array(
+                    'id'            => 'sidebar-1',
+                    'name'          => 'Test sidebar',
+                    'description'   => '',
+                    'class'         => '',
+                    'before_widget' => '',
+                    'after_widget'  => '',
+                    'before_title'  => '',
+                    'after_title'   => '',
+                    'status'        => 'active',
+                    'widgets'       => array(),
+                ),
+            ),
+            $data
+        );
+    }
+
+    /**
+     * @ticket 53915
+     */
+    public function test_get_items_without_show_in_rest_are_removed_from_the_list() {
+        $this->setup_sidebar(
+            'sidebar-1',
+            array(
+                'name'         => 'Test sidebar 1',
+                'show_in_rest' => true,
+            )
+        );
+        $this->setup_sidebar(
+            'sidebar-2',
+            array(
+                'name'         => 'Test sidebar 2',
+                'show_in_rest' => false,
+            )
+        );
+        $this->setup_sidebar(
+            'sidebar-3',
+            array(
+                'name'         => 'Test sidebar 3',
+                'show_in_rest' => true,
+            )
+        );
+        wp_set_current_user( self::$author_id );
+        $request  = new WP_REST_Request( 'GET', '/wp/v2/sidebars' );
+        $response = rest_get_server()->dispatch( $request );
+        $data     = $response->get_data();
+        $data     = $this->remove_links( $data );
+        $this->assertSame(
+            array(
+                array(
+                    'id'            => 'sidebar-1',
+                    'name'          => 'Test sidebar 1',
+                    'description'   => '',
+                    'class'         => '',
+                    'before_widget' => '',
+                    'after_widget'  => '',
+                    'before_title'  => '',
+                    'after_title'   => '',
+                    'status'        => 'active',
+                    'widgets'       => array(),
+                ),
+                array(
+                    'id'            => 'sidebar-3',
+                    'name'          => 'Test sidebar 3',
+                    'description'   => '',
+                    'class'         => '',
+                    'before_widget' => '',
+                    'after_widget'  => '',
+                    'before_title'  => '',
+                    'after_title'   => '',
+                    'status'        => 'active',
+                    'widgets'       => array(),
+                ),
+            ),
+            $data
+        );
+    }
+
+    /**
      * @ticket 41683
      */
@@ -193 +289 @@
             array(
                 array(
+                    'id'            => 'wp_inactive_widgets',
+                    'name'          => 'Inactive widgets',
+                    'description'   => '',
+                    'class'         => '',
+                    'before_widget' => '',
+                    'after_widget'  => '',
+                    'before_title'  => '',
+                    'after_title'   => '',
+                    'status'        => 'inactive',
+                    'widgets'       => array(),
+                ),
+                array(
                     'id'            => 'sidebar-1',
                     'name'          => 'Test sidebar',
@@ -207 +315 @@
             $data
         );
+
     }
 
@@ -411 +520 @@
         $response = rest_get_server()->dispatch( $request );
         $this->assertErrorResponse( 'rest_cannot_manage_widgets', $response, 401 );
+    }
+
+    /**
+     * @ticket 41683
+     */
+    public function test_get_item_no_permission_public() {
+        wp_set_current_user( 0 );
+        $this->setup_sidebar(
+            'sidebar-1',
+            array(
+                'name'         => 'Test sidebar',
+                'show_in_rest' => true,
+            )
+        );
+
+        $request  = new WP_REST_Request( 'GET', '/wp/v2/sidebars/sidebar-1' );
+        $response = rest_get_server()->dispatch( $request );
+        $data     = $response->get_data();
+        $data     = $this->remove_links( $data );
+        $this->assertSame(
+            array(
+                'id'            => 'sidebar-1',
+                'name'          => 'Test sidebar',
+                'description'   => '',
+                'class'         => '',
+                'before_widget' => '',
+                'after_widget'  => '',
+                'before_title'  => '',
+                'after_title'   => '',
+                'status'        => 'active',
+                'widgets'       => array(),
+            ),
+            $data
+        );
     }