Permalink
Browse files

REST API: Enable sanitize_callback to return WP_Error.

Give developers the opportunity to reject incoming data without using the validation callback. It also enables us to do sanitization and validation in one function in instances where this could be useful.

Props websupporter, rmccue.
Fixes #37560.

Built from https://develop.svn.wordpress.org/trunk@38601


git-svn-id: http://core.svn.wordpress.org/trunk@38544 1a063a9b-81f0-0310-95a4-ce76da25c4cd
  • Loading branch information...
1 parent d7f840a commit 794dd5d8cb7d3f11779cb86d1eff66fbd1947840 @joehoyle joehoyle committed Sep 14, 2016
@@ -780,10 +780,9 @@ public function set_attributes( $attributes ) {
* @since 4.4.0
* @access public
*
- * @return true|null True if there are no parameters to sanitize, null otherwise.
+ * @return true|WP_Error True if parameters were sanitized, WP_Error if an error occurred during sanitization.
*/
public function sanitize_params() {
-
$attributes = $this->get_attributes();
// No arguments set, skip sanitizing.
@@ -793,18 +792,33 @@ public function sanitize_params() {
$order = $this->get_parameter_order();
+ $invalid_params = array();
+
foreach ( $order as $type ) {
if ( empty( $this->params[ $type ] ) ) {
continue;
}
foreach ( $this->params[ $type ] as $key => $value ) {
// Check if this param has a sanitize_callback added.
- if ( isset( $attributes['args'][ $key ] ) && ! empty( $attributes['args'][ $key ]['sanitize_callback'] ) ) {
- $this->params[ $type ][ $key ] = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value, $this, $key );
+ if ( ! isset( $attributes['args'][ $key ] ) || empty( $attributes['args'][ $key ]['sanitize_callback'] ) ) {
+ continue;
+ }
+
+ $sanitized_value = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value, $this, $key );
+
+ if ( is_wp_error( $sanitized_value ) ) {
+ $invalid_params[ $key ] = $sanitized_value->get_error_message();
+ } else {
+ $this->params[ $type ][ $key ] = $sanitized_value;
}
}
}
- return null;
+
+ if ( $invalid_params ) {
+ return new WP_Error( 'rest_invalid_param', sprintf( __( 'Invalid parameter(s): %s' ), implode( ', ', array_keys( $invalid_params ) ) ), array( 'status' => 400, 'params' => $invalid_params ) );
+ }
+
+ return true;
}
/**
@@ -817,7 +831,6 @@ public function sanitize_params() {
* WP_Error if required parameters are missing.
*/
public function has_valid_params() {
-
$attributes = $this->get_attributes();
$required = array();
@@ -866,9 +866,12 @@ public function dispatch( $request ) {
$check_required = $request->has_valid_params();
if ( is_wp_error( $check_required ) ) {
$response = $check_required;
+ } else {
+ $check_sanitized = $request->sanitize_params();
+ if ( is_wp_error( $check_sanitized ) ) {
+ $response = $check_sanitized;
+ }
}
-
- $request->sanitize_params();
}
if ( ! is_wp_error( $response ) ) {
@@ -4,7 +4,7 @@
*
* @global string $wp_version
*/
-$wp_version = '4.7-alpha-38600';
+$wp_version = '4.7-alpha-38601';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.

0 comments on commit 794dd5d

Please sign in to comment.