Filter response by context misses certain schemas

[TimothyBlynJacobs]

WP_REST_Controller:filter_response_by_context is used to remove properties from a response that require a different context than requested. ie it removes edit properties if the request doesn't have an edit context. However it misses a few cases.

• Does not check array items.
• Does not checked multi nested properties. It only checks the first child property level.
• Does not handle additionalProperties.
• Does not handle type being an array of types.

[TimothyBlynJacobs]

I did a first pass patch implementing the changes described above. I ended up extracting it to a standalone function. I think it is still helpful when not subclassing WP_REST_Controller. It also made it a bit easier to test.

This new function also uses recursion to ensure we traverse the whole schema. It seemed like it might be unsafe BC wise to implement recursion with the original method if any controllers are overwriting that method and calling the parent.

[TimothyBlynJacobs]

I've uploaded a revised version of the patch that does not traverse child schemas unless a context is set at every level. This means the performance impact of traversing the entire object will only occur if the author is utilizing that functionality.

That is, for the following schema.

<?php
array(
        '$schema'    => 'http://json-schema.org/draft-04/schema#',
        'type'       => 'object',
        'properties' => array(
                'parent' => array(
                        'type'       => 'object',
                        'context'    => array( 'view', 'edit' ),
                        'properties' => array(
                                'child' => array(
                                        'type'       => 'object',
                                        'properties' => array(
                                                'grand'  => array(
                                                        'type'    => 'string',
                                                        'context' => array( 'view', 'edit' ),
                                                ),
                                                'hidden' => array(
                                                        'type'    => 'string',
                                                        'context' => array( 'edit' ),
                                                ),
                                        ),
                                ),
                        ),
                ),
        ),
)

and the following data

<?php
array(
        'parent' => array(
                'child' => array(
                        'grand'  => 'hi',
                        'hidden' => 'there',
                ),
        ),
)

In the first patch, the hidden field would be excluded, now it isn't. Notice that no context is specified for the child schema.

[TimothyBlynJacobs]

Punting to 5.5. I think this is too large a change to land at this point in the cycle.

[davidbaumwald]

@TimothyBlynJacobs Is this still in work for early inclusion in 5.5?

[TimothyBlynJacobs]

@davidbaumwald yep. The work is done, really just needs another pair of eyes before landing. cc @kadamwhite.

Trac ticket: https://core.trac.wordpress.org/ticket/48819

Trac ticket: https://core.trac.wordpress.org/ticket/48819

[TimothyBlynJacobs]

In 47758:

REST API: Support more JSON Schemas when filtering a response by context.

The array type, multi-types, and the additional properties keyword are now supported. Additionally, the filter recurses to an infinite depth.

Fixes #48819.