Make WordPress Core

Opened 7 weeks ago

Last modified 3 days ago

#48819 assigned defect (bug)

Filter response by context misses certain schemas

Reported by: TimothyBlynJacobs Owned by: TimothyBlynJacobs
Milestone: 5.4 Priority: normal
Severity: normal Version: 4.7
Component: REST API Keywords: has-patch has-unit-tests
Focuses: Cc:
PR Number:


WP_REST_Controller:filter_response_by_context is used to remove properties from a response that require a different context than requested. ie it removes edit properties if the request doesn't have an edit context. However it misses a few cases.

  • Does not check array items.
  • Does not checked multi nested properties. It only checks the first child property level.
  • Does not handle additionalProperties.
  • Does not handle type being an array of types.

Attachments (1)

48819.diff (11.8 KB) - added by TimothyBlynJacobs 7 weeks ago.

Download all attachments as: .zip

Change History (3)

#1 @TimothyBlynJacobs
7 weeks ago

  • Keywords has-patch has-unit-tests added

I did a first pass patch implementing the changes described above. I ended up extracting it to a standalone function. I think it is still helpful when not subclassing WP_REST_Controller. It also made it a bit easier to test.

This new function also uses recursion to ensure we traverse the whole schema. It seemed like it might be unsafe BC wise to implement recursion with the original method if any controllers are overwriting that method and calling the parent.

This ticket was mentioned in Slack in #core-restapi by timothybjacobs. View the logs.

3 days ago

Note: See TracTickets for help on using tickets.