Changeset 52399 for trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-themes-controller.php

Timestamp:

12/21/2021 04:12:06 AM (3 years ago)

Author:

hellofromTonya

Message:

REST API: Support . in theme directory names in WP_REST_Global_Styles_Controller, WP_REST_Templates_Controller, and WP_REST_Themes_Controller.

Regex changes from [52376] are reverted to restore the original regex patterns. Why? [52376] used an include characters pattern, which was too limiting. It did not account for localized characters, such as é, or other valid directory name characters.

The original theme directory regex pattern, i.e. [^.\/]+(?:\/[^.\/]+)? excluded the period . character. Removing the . character resolves the reported issue by allowing matching for themes/theme-dirname-1.0/ or themes/<subdirname>/theme-dirname-1.0/.

As the pattern used an exclude approach, all characters are valid for matching except for /. However, not all characters are cross-platform valid for directory names. For example, the characters /:<>*?"| are not valid on Windows OS. The pattern now excludes those characters.

The theme's directory (or subdirectory) name pattern matching is now used in WP_REST_Global_Styles_Controller, WP_REST_Templates_Controller, and WP_REST_Themes_Controller.

Follow-up to [51003], [52051], [52275], [52376].

Props costdev, hellofromTonya, spacedmonkey, TimothyBlynJacobs, bijayyadav, kafleg.
Fixes #54596.

File:

• trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-themes-controller.php (modified) (3 diffs)

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-themes-controller.php

@@ -17 +17 @@
 class WP_REST_Themes_Controller extends WP_REST_Controller {
 
-    const PATTERN = '[^.\/]+(?:\/[^.\/]+)?';
+    /**
+     * Matches theme's directory: `/themes/<subdirectory>/<theme>/` or `/themes/<theme>/`.
+     * Excludes invalid directory name characters: `/:<>*?"|`.
+     */
+    const PATTERN = '[^\/:<>\*\?"\|]+(?:\/[^\/:<>\*\?"\|]+)?';
 
     /**
@@ -57 +61 @@
                 'args'   => array(
                     'stylesheet' => array(
-                        'description' => __( "The theme's stylesheet. This uniquely identifies the theme." ),
-                        'type'        => 'string',
+                        'description'       => __( "The theme's stylesheet. This uniquely identifies the theme." ),
+                        'type'              => 'string',
+                        'sanitize_callback' => array( $this, '_sanitize_stylesheet_callback' ),
                     ),
                 ),
@@ -69 +74 @@
             )
         );
+    }
+
+    /**
+     * Sanitize the stylesheet to decode endpoint.
+     *
+     * @since 5.9.0
+     *
+     * @param string $stylesheet The stylesheet name.
+     * @return string Sanitized stylesheet.
+     */
+    public function _sanitize_stylesheet_callback( $stylesheet ) {
+        return urldecode( $stylesheet );
     }