diff --git a/src/wp-includes/rest-api.php b/src/wp-includes/rest-api.php index adcca17d3b..b854d7d4b6 100644 --- a/src/wp-includes/rest-api.php +++ b/src/wp-includes/rest-api.php @@ -1158,6 +1158,11 @@ function rest_validate_value_from_schema( $value, $args, $param = '' ) { if ( $value instanceof stdClass ) { $value = (array) $value; } + + if ( $value instanceof JsonSerializable ) { + $value = $value->jsonSerialize(); + } + if ( ! is_array( $value ) ) { /* translators: 1: parameter, 2: type name */ return new WP_Error( 'rest_invalid_param', sprintf( __( '%1$s is not of type %2$s.' ), $param, 'object' ) ); @@ -1169,8 +1174,17 @@ function rest_validate_value_from_schema( $value, $args, $param = '' ) { if ( is_wp_error( $is_valid ) ) { return $is_valid; } - } elseif ( isset( $args['additionalProperties'] ) && false === $args['additionalProperties'] ) { - return new WP_Error( 'rest_invalid_param', sprintf( __( '%1$s is not a valid property of Object.' ), $property ) ); + } elseif ( isset( $args['additionalProperties'] ) ) { + if ( false === $args['additionalProperties'] ) { + return new WP_Error( 'rest_invalid_param', sprintf( __( '%1$s is not a valid property of Object.' ), $property ) ); + } + + if ( is_array( $args['additionalProperties'] ) ) { + $is_valid = rest_validate_value_from_schema( $v, $args['additionalProperties'], $param . '[' . $property . ']' ); + if ( is_wp_error( $is_valid ) ) { + return $is_valid; + } + } } } } @@ -1297,6 +1311,11 @@ function rest_sanitize_value_from_schema( $value, $args ) { if ( $value instanceof stdClass ) { $value = (array) $value; } + + if ( $value instanceof JsonSerializable ) { + $value = $value->jsonSerialize(); + } + if ( ! is_array( $value ) ) { return array(); } @@ -1304,8 +1323,12 @@ function rest_sanitize_value_from_schema( $value, $args ) { foreach ( $value as $property => $v ) { if ( isset( $args['properties'][ $property ] ) ) { $value[ $property ] = rest_sanitize_value_from_schema( $v, $args['properties'][ $property ] ); - } elseif ( isset( $args['additionalProperties'] ) && false === $args['additionalProperties'] ) { - unset( $value[ $property ] ); + } elseif ( isset( $args['additionalProperties'] ) ) { + if ( false === $args['additionalProperties'] ) { + unset( $value[ $property ] ); + } elseif ( is_array( $args['additionalProperties'] ) ) { + $value[ $property ] = rest_sanitize_value_from_schema( $v, $args['additionalProperties'] ); + } } } diff --git a/src/wp-includes/rest-api/fields/class-wp-rest-meta-fields.php b/src/wp-includes/rest-api/fields/class-wp-rest-meta-fields.php index a24a5f649c..51410a3f00 100644 --- a/src/wp-includes/rest-api/fields/class-wp-rest-meta-fields.php +++ b/src/wp-includes/rest-api/fields/class-wp-rest-meta-fields.php @@ -143,6 +143,20 @@ abstract class WP_REST_Meta_Fields { * from the database and then relying on the default value. */ if ( is_null( $meta[ $name ] ) ) { + $args = $this->get_registered_fields()[ $meta_key ]; + + if ( $args['single'] ) { + $current = get_metadata( $this->get_meta_type(), $object_id, $meta_key, true ); + + if ( is_wp_error( rest_validate_value_from_schema( $current, $args['schema'] ) ) ) { + return new WP_Error( + 'rest_invalid_stored_value', + sprintf( __( 'The %s property has an invalid stored value, and cannot be updated to null.' ), $name ), + array( 'status' => 500 ) + ); + } + } + $result = $this->delete_meta_value( $object_id, $meta_key, $name ); if ( is_wp_error( $result ) ) { return $result; @@ -150,13 +164,23 @@ abstract class WP_REST_Meta_Fields { continue; } - $is_valid = rest_validate_value_from_schema( $meta[ $name ], $args['schema'], 'meta.' . $name ); + $value = $meta[ $name ]; + + if ( ! $args['single'] && is_array( $value ) && count( array_filter( $value, 'is_null' ) ) ) { + return new WP_Error( + 'rest_invalid_stored_value', + sprintf( __( 'The %s property has an invalid stored value, and cannot be updated to null.' ), $name ), + array( 'status' => 500 ) + ); + } + + $is_valid = rest_validate_value_from_schema( $value, $args['schema'], 'meta.' . $name ); if ( is_wp_error( $is_valid ) ) { $is_valid->add_data( array( 'status' => 400 ) ); return $is_valid; } - $value = rest_sanitize_value_from_schema( $meta[ $name ], $args['schema'] ); + $value = rest_sanitize_value_from_schema( $value, $args['schema'] ); if ( $args['single'] ) { $result = $this->update_meta_value( $object_id, $meta_key, $name, $value ); @@ -261,7 +285,9 @@ abstract class WP_REST_Meta_Fields { } // `delete_metadata` removes _all_ instances of the value, so only call once. - $to_remove = array_unique( $to_remove ); + $to_remove = array_map( 'maybe_unserialize', array_unique( array_map( static function( $value ) { + return is_scalar( $value ) ? $value : maybe_serialize( $value ); + }, $to_remove ) ) ); foreach ( $to_remove as $value ) { if ( ! delete_metadata( $meta_type, $object_id, wp_slash( $meta_key ), wp_slash( $value ) ) ) { @@ -390,15 +416,21 @@ abstract class WP_REST_Meta_Fields { $type = ! empty( $rest_args['type'] ) ? $rest_args['type'] : null; $type = ! empty( $rest_args['schema']['type'] ) ? $rest_args['schema']['type'] : $type; - if ( ! in_array( $type, array( 'string', 'boolean', 'integer', 'number' ) ) ) { + if ( null === $rest_args['schema']['default'] ) { + $rest_args['schema']['default'] = $this->get_default_for_type( $type ); + } + + $rest_args['schema'] = $this->default_additional_properties_to_false( $rest_args['schema'] ); + + if ( ! in_array( $type, array( 'string', 'boolean', 'integer', 'number', 'array', 'object' ) ) ) { continue; } if ( empty( $rest_args['single'] ) ) { - $rest_args['schema']['items'] = array( - 'type' => $rest_args['type'], + $rest_args['schema'] = array( + 'type' => 'array', + 'items' => $rest_args['schema'], ); - $rest_args['schema']['type'] = 'array'; } $registered[ $name ] = $rest_args; @@ -449,34 +481,18 @@ abstract class WP_REST_Meta_Fields { * @return mixed Value prepared for output. If a non-JsonSerializable object, null. */ public static function prepare_value( $value, $request, $args ) { - $type = $args['schema']['type']; - // For multi-value fields, check the item type instead. - if ( 'array' === $type && ! empty( $args['schema']['items']['type'] ) ) { - $type = $args['schema']['items']['type']; + if ( $args['single'] ) { + $schema = $args['schema']; + } else { + $schema = $args['schema']['items']; } - switch ( $type ) { - case 'string': - $value = (string) $value; - break; - case 'integer': - $value = (int) $value; - break; - case 'number': - $value = (float) $value; - break; - case 'boolean': - $value = (bool) $value; - break; - } - - // Don't allow objects to be output. - if ( is_object( $value ) && ! ( $value instanceof JsonSerializable ) ) { + if ( is_wp_error( rest_validate_value_from_schema( $value, $schema ) ) ) { return null; } - return $value; + return rest_sanitize_value_from_schema( $value, $schema ); } /** @@ -496,4 +512,63 @@ abstract class WP_REST_Meta_Fields { return $value; } + + /** + * Recursively add additionalProperties = false to all objects in a schema if no additionalProperties setting + * is specified. + * + * This is need to restrict properties of objects in meta values to only + * registered items, as the REST API will allow additional properties by + * default. + * + * @since 5.3.0 + * + * @param array $schema The schema array. + * @return array + */ + protected function default_additional_properties_to_false( $schema ) { + switch ( $schema['type'] ) { + case 'object': + foreach ( $schema['properties'] as $key => $child_schema ) { + $schema['properties'][ $key ] = $this->default_additional_properties_to_false( $child_schema ); + } + + if ( ! isset( $schema['additionalProperties'] ) ) { + $schema['additionalProperties'] = false; + } + break; + case 'array': + $schema['items'] = $this->default_additional_properties_to_false( $schema['items'] ); + break; + } + + return $schema; + } + + /** + * Gets the default value for a schema type. + * + * @since 5.3.0 + * + * @param string $type + * @return mixed + */ + protected function get_default_for_type( $type ) { + switch ( $type ) { + case 'string': + return ''; + case 'boolean': + return false; + case 'integer': + return 0; + case 'number': + return 0.0; + case 'array': + return []; + case 'object': + return []; + default: + return null; + } + } } diff --git a/tests/phpunit/includes/class-basic-object.php b/tests/phpunit/includes/class-basic-object.php index f773c94ca1..a85a9f6596 100644 --- a/tests/phpunit/includes/class-basic-object.php +++ b/tests/phpunit/includes/class-basic-object.php @@ -7,8 +7,6 @@ * @since 4.7.0 */ -trigger_error( __FILE__ . ' is deprecated since version 5.0.0 with no alternative available.' ); - /** * Class used to test accessing methods and properties * diff --git a/tests/phpunit/includes/class-jsonserializable-object.php b/tests/phpunit/includes/class-jsonserializable-object.php new file mode 100644 index 0000000000..e58cfb9ebd --- /dev/null +++ b/tests/phpunit/includes/class-jsonserializable-object.php @@ -0,0 +1,21 @@ +data = $data; + } + + public function jsonSerialize() { + return $this->data; + } +} diff --git a/tests/phpunit/includes/functions.php b/tests/phpunit/includes/functions.php index d7c2ff47ab..0a70ca17f6 100644 --- a/tests/phpunit/includes/functions.php +++ b/tests/phpunit/includes/functions.php @@ -1,4 +1,5 @@ assertEquals( 'Hello', $data['meta']['test\'slashed\'key'] ); } + /** + * @ticket 43392 + */ + public function test_object_single() { + $this->grant_write_permission(); + + register_post_meta( 'post', 'object', [ + 'single' => true, + 'type' => 'object', + 'show_in_rest' => [ + 'schema' => [ + 'type' => 'object', + 'properties' => [ + 'project' => [ + 'type' => 'string', + ], + ], + ], + ], + ] ); + + $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) ); + $request->set_body_params( [ + 'meta' => [ + 'object' => [ + 'project' => 'WordPress', + ], + ], + ] ); + + $response = rest_get_server()->dispatch( $request ); + $data = $response->get_data(); + + $this->assertArrayHasKey( 'object', $data['meta'] ); + $this->assertArrayHasKey( 'project', $data['meta']['object'] ); + $this->assertEquals( 'WordPress', $data['meta']['object']['project'] ); + + $meta = get_post_meta( self::$post_id, 'object', true ); + $this->assertArrayHasKey( 'project', $meta ); + $this->assertEquals( 'WordPress', $meta['project'] ); + } + + /** + * @ticket 43392 + */ + public function test_object_multiple() { + $this->grant_write_permission(); + + register_post_meta( 'post', 'object', [ + 'single' => false, + 'type' => 'object', + 'show_in_rest' => [ + 'schema' => [ + 'type' => 'object', + 'properties' => [ + 'project' => [ + 'type' => 'string', + ], + ], + ], + ], + ] ); + + $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) ); + $request->set_body_params( [ + 'meta' => [ + 'object' => [ + [ + 'project' => 'WordPress', + ], + [ + 'project' => 'bbPress', + ], + ], + ], + ] ); + + $response = rest_get_server()->dispatch( $request ); + $data = $response->get_data(); + + $this->assertArrayHasKey( 'object', $data['meta'] ); + $this->assertCount( 2, $data['meta']['object'] ); + + $this->assertArrayHasKey( 'project', $data['meta']['object'][0] ); + $this->assertEquals( 'WordPress', $data['meta']['object'][0]['project'] ); + + $this->assertArrayHasKey( 'project', $data['meta']['object'][1] ); + $this->assertEquals( 'bbPress', $data['meta']['object'][1]['project'] ); + + $meta = get_post_meta( self::$post_id, 'object' ); + + $this->assertCount( 2, $meta ); + + $this->assertArrayHasKey( 'project', $meta[0] ); + $this->assertEquals( 'WordPress', $meta[0]['project'] ); + + $this->assertArrayHasKey( 'project', $meta[1] ); + $this->assertEquals( 'bbPress', $meta[1]['project'] ); + } + + /** + * @ticket 43392 + */ + public function test_array_single() { + $this->grant_write_permission(); + + register_post_meta( 'post', 'list', [ + 'single' => true, + 'type' => 'array', + 'show_in_rest' => [ + 'schema' => [ + 'type' => 'array', + 'items' => [ + 'type' => 'string', + ], + ], + ], + ] ); + + $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) ); + $request->set_body_params( [ + 'meta' => [ + 'list' => [ 'WordPress', 'bbPress' ], + ], + ] ); + + $response = rest_get_server()->dispatch( $request ); + $data = $response->get_data(); + + $this->assertArrayHasKey( 'list', $data['meta'] ); + $this->assertEquals( [ 'WordPress', 'bbPress' ], $data['meta']['list'] ); + + $meta = get_post_meta( self::$post_id, 'list', true ); + $this->assertEquals( [ 'WordPress', 'bbPress' ], $meta ); + } + + /** + * @ticket 43392 + */ + public function test_array_of_objects_multiple() { + $this->grant_write_permission(); + + register_post_meta( 'post', 'list_of_objects', [ + 'single' => false, + 'type' => 'array', + 'show_in_rest' => [ + 'schema' => [ + 'type' => 'array', + 'items' => [ + 'type' => 'object', + 'properties' => [ + 'version' => [ + 'type' => 'string', + ], + 'artist' => [ + 'type' => 'string', + ] + ] + ], + ], + ], + ] ); + + $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) ); + $request->set_body_params( [ + 'meta' => [ + 'list_of_objects' => [ + // Meta 1 + [ + [ 'version' => '5.2', 'artist' => 'Jaco' ], + [ 'version' => '5.1', 'artist' => 'Betty' ], + ], + // Meta 2 + [ + [ 'version' => '4.9', 'artist' => 'Tipton' ], + ], + ], + ], + ] ); + + + $response = rest_get_server()->dispatch( $request ); + $data = $response->get_data(); + + $this->assertArrayHasKey( 'list_of_objects', $data['meta'] ); + $this->assertCount( 2, $data['meta']['list_of_objects'] ); + + $this->assertEquals( [ + [ 'version' => '5.2', 'artist' => 'Jaco' ], + [ 'version' => '5.1', 'artist' => 'Betty' ], + ], $data['meta']['list_of_objects'][0] ); + + $this->assertEquals( [ + [ 'version' => '4.9', 'artist' => 'Tipton' ], + ], $data['meta']['list_of_objects'][1] ); + + $meta = get_post_meta( self::$post_id, 'list_of_objects' ); + + $this->assertCount( 2, $meta ); + + $this->assertEquals( [ + [ 'version' => '5.2', 'artist' => 'Jaco' ], + [ 'version' => '5.1', 'artist' => 'Betty' ], + ], $meta[0] ); + + $this->assertEquals( [ + [ 'version' => '4.9', 'artist' => 'Tipton' ], + ], $meta[1] ); + } + + /** + * @ticket 43392 + */ + public function test_php_objects_returned_as_null() { + register_post_meta( 'post', 'object', [ + 'single' => true, + 'type' => 'object', + 'show_in_rest' => [ + 'schema' => [ + 'type' => 'object', + 'properties' => [ + 'project' => [ + 'type' => 'string', + ], + ], + ], + ], + ] ); + + update_post_meta( self::$post_id, 'object', new Basic_Object( [ 'project' => 'WordPress' ] ) ); + + $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', self::$post_id ) ); + $response = rest_get_server()->dispatch( $request ); + $data = $response->get_data(); + + $this->assertArrayHasKey( 'object', $data['meta'] ); + $this->assertNull( $data['meta']['object'] ); + } + + /** + * @ticket 43392 + */ + public function test_php_objects_returned_as_null_multiple() { + register_post_meta( 'post', 'object', [ + 'single' => false, + 'type' => 'object', + 'show_in_rest' => [ + 'schema' => [ + 'type' => 'object', + 'properties' => [ + 'project' => [ + 'type' => 'string', + ], + ], + ], + ], + ] ); + + add_post_meta( self::$post_id, 'object', [ 'project' => 'bbPress' ] ); + add_post_meta( self::$post_id, 'object', new Basic_Object( [ 'project' => 'WordPress' ] ) ); + + $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', self::$post_id ) ); + $response = rest_get_server()->dispatch( $request ); + $data = $response->get_data(); + + $this->assertArrayHasKey( 'object', $data['meta'] ); + $this->assertCount( 2, $data['meta']['object'] ); + $this->assertEquals( [ 'project' => 'bbPress' ], $data['meta']['object'][0] ); + $this->assertNull( $data['meta']['object'][1] ); + } + + /** + * @ticket 43392 + */ + public function test_php_jsonserializable_object_returns_value() { + require_once __DIR__ . '/../../includes/class-jsonserializable-object.php'; + + register_post_meta( 'post', 'object', [ + 'single' => true, + 'type' => 'object', + 'show_in_rest' => [ + 'schema' => [ + 'type' => 'object', + 'properties' => [ + 'project' => [ + 'type' => 'string', + ], + ], + ], + ], + ] ); + + update_post_meta( self::$post_id, 'object', new JsonSerializable_Object( [ 'project' => 'WordPress' ] ) ); + + $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', self::$post_id ) ); + $response = rest_get_server()->dispatch( $request ); + $data = $response->get_data(); + + $this->assertArrayHasKey( 'object', $data['meta'] ); + $this->assertEquals( [ 'project' => 'WordPress' ], $data['meta']['object'] ); + } + + /** + * @ticket 43392 + */ + public function test_updating_meta_to_null_for_key_with_existing_php_object_does_not_delete_meta_value() { + $this->grant_write_permission(); + + register_post_meta( 'post', 'object', [ + 'single' => true, + 'type' => 'object', + 'show_in_rest' => [ + 'schema' => [ + 'type' => 'object', + 'properties' => [ + 'project' => [ + 'type' => 'string', + ], + ], + ], + ], + ] ); + + update_post_meta( self::$post_id, 'object', new Basic_Object( [ 'project' => 'WordPress' ] ) ); + + $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) ); + $request->set_body_params( [ + 'meta' => [ + 'object' => null, + ] + ] ); + + $response = rest_get_server()->dispatch( $request ); + $this->assertEquals( 500, $response->get_status() ); + } + + /** + * @ticket 43392 + */ + public function test_updating_non_single_meta_to_null_for_key_with_existing_php_object_does_not_set_meta_value_to_null() { + $this->grant_write_permission(); + + register_post_meta( 'post', 'object', [ + 'single' => false, + 'type' => 'object', + 'show_in_rest' => [ + 'schema' => [ + 'type' => 'object', + 'properties' => [ + 'project' => [ + 'type' => 'string', + ], + ], + ], + ], + ] ); + + add_post_meta( self::$post_id, 'object', [ 'project' => 'bbPress' ] ); + add_post_meta( self::$post_id, 'object', new Basic_Object( [ 'project' => 'WordPress' ] ) ); + + $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) ); + $request->set_body_params( [ + 'meta' => [ + 'object' => [ + [ 'project' => 'BuddyPress' ], + null, + ], + ] + ] ); + + $response = rest_get_server()->dispatch( $request ); + $this->assertEquals( 500, $response->get_status() ); + } + + /** + * @ticket 43392 + */ + public function test_object_rejects_additional_properties_by_default() { + $this->grant_write_permission(); + + register_post_meta( 'post', 'object', [ + 'single' => true, + 'type' => 'object', + 'show_in_rest' => [ + 'schema' => [ + 'type' => 'object', + 'properties' => [ + 'project' => [ + 'type' => 'string', + ], + ], + ], + ], + ] ); + + $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) ); + $request->set_body_params( [ + 'meta' => [ + 'object' => [ + 'project' => 'BuddyPress', + 'awesomeness' => 100, + ], + ] + ] ); + + $response = rest_get_server()->dispatch( $request ); + $this->assertEquals( 400, $response->get_status() ); + } + + /** + * @ticket 43392 + */ + public function test_object_allows_additional_properties_if_explicitly_set() { + $this->grant_write_permission(); + + $value = [ + 'project' => 'BuddyPress', + 'awesomeness' => 100, + ]; + + register_post_meta( 'post', 'object', [ + 'single' => true, + 'type' => 'object', + 'show_in_rest' => [ + 'schema' => [ + 'type' => 'object', + 'additionalProperties' => true, + 'properties' => [ + 'project' => [ + 'type' => 'string', + ], + ], + ], + ], + ] ); + + $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) ); + $request->set_body_params( [ + 'meta' => [ + 'object' => $value, + ] + ] ); + + $response = rest_get_server()->dispatch( $request ); + $this->assertEquals( 200, $response->get_status() ); + $this->assertEquals( $value, $response->get_data()['meta']['object'] ); + + $this->assertEquals( $value, get_post_meta( self::$post_id, 'object', true ) ); + } + + /** + * @ticket 43392 + */ + public function test_object_allows_additional_properties_and_uses_its_schema() { + $this->grant_write_permission(); + + $value = [ + 'project' => 'BuddyPress', + 'awesomeness' => 'fabulous', + ]; + + register_post_meta( 'post', 'object', [ + 'single' => true, + 'type' => 'object', + 'show_in_rest' => [ + 'schema' => [ + 'type' => 'object', + 'additionalProperties' => [ + 'type' => 'number', + ], + 'properties' => [ + 'project' => [ + 'type' => 'string', + ], + ], + ], + ], + ] ); + + $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d', self::$post_id ) ); + $request->set_body_params( [ + 'meta' => [ + 'object' => $value, + ] + ] ); + + $response = rest_get_server()->dispatch( $request ); + $this->assertEquals( 400, $response->get_status() ); + } + + public function test_invalid_meta_value_are_set_to_null_in_response() { + register_post_meta( 'post', 'email', [ + 'single' => true, + 'type' => 'string', + 'show_in_rest' => [ + 'schema' => [ + 'type' => 'string', + 'format' => 'email', + ], + ], + ] ); + + update_post_meta( self::$post_id, 'email', 'invalid_meta_value' ); + + $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', self::$post_id ) ); + $response = rest_get_server()->dispatch( $request ); + + $this->assertNull( $response->get_data()['meta']['email'] ); + } + + public function test_meta_values_are_not_set_to_null_in_response_if_type_safe() { + register_post_meta( 'post', 'boolean', [ + 'single' => true, + 'show_in_rest' => true, + 'type' => 'boolean', + ] ); + + update_post_meta( self::$post_id, 'boolean', 'true' ); + + $request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', self::$post_id ) ); + $response = rest_get_server()->dispatch( $request ); + + $this->assertTrue( $response->get_data()['meta']['boolean'] ); + } + /** * Internal function used to disable an insert query which * will trigger a wpdb error for testing purposes.