REST API: Filter responses based on the `_fields` parameter, before data is processed.

Historically, the REST API would generate the entire response object, including running expensive filters, then it would apply the `_fields` parameter, discarding the fields that weren't specificed.

This change causes `_fields` to be applied earlier, so that only requested fields are processed.

Props danielbachhuber.
See #43874.



git-svn-id: https://develop.svn.wordpress.org/trunk@43087 602fd350-edb4-49c9-b593-d223f7449a82

src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

@@ -284,62 +284,84 @@ class WP_REST_Attachments_Controller extends WP_REST_Posts_Controller {
 	 */
 	public function prepare_item_for_response( $post, $request ) {
 		$response = parent::prepare_item_for_response( $post, $request );
+		$fields   = $this->get_fields_for_response( $request );
 		$data     = $response->get_data();
 
-		$data['description'] = array(
-			'raw'      => $post->post_content,
+		if ( in_array( 'description', $fields, true ) ) {
+			$data['description'] = array(
+				'raw'      => $post->post_content,
+				/** This filter is documented in wp-includes/post-template.php */
+				'rendered' => apply_filters( 'the_content', $post->post_content ),
+			);
+		}
+
+		if ( in_array( 'caption', $fields, true ) ) {
 			/** This filter is documented in wp-includes/post-template.php */
-			'rendered' => apply_filters( 'the_content', $post->post_content ),
-		);
+			$caption         = apply_filters( 'the_excerpt', apply_filters( 'get_the_excerpt', $post->post_excerpt, $post ) );
+			$data['caption'] = array(
+				'raw'      => $post->post_excerpt,
+				'rendered' => $caption,
+			);
+		}
 
-		/** This filter is documented in wp-includes/post-template.php */
-		$caption         = apply_filters( 'the_excerpt', apply_filters( 'get_the_excerpt', $post->post_excerpt, $post ) );
-		$data['caption'] = array(
-			'raw'      => $post->post_excerpt,
-			'rendered' => $caption,
-		);
+		if ( in_array( 'alt_text', $fields, true ) ) {
+			$data['alt_text'] = get_post_meta( $post->ID, '_wp_attachment_image_alt', true );
+		}
 
-		$data['alt_text']      = get_post_meta( $post->ID, '_wp_attachment_image_alt', true );
-		$data['media_type']    = wp_attachment_is_image( $post->ID ) ? 'image' : 'file';
-		$data['mime_type']     = $post->post_mime_type;
-		$data['media_details'] = wp_get_attachment_metadata( $post->ID );
-		$data['post']          = ! empty( $post->post_parent ) ? (int) $post->post_parent : null;
-		$data['source_url']    = wp_get_attachment_url( $post->ID );
+		if ( in_array( 'media_type', $fields, true ) ) {
+			$data['media_type'] = wp_attachment_is_image( $post->ID ) ? 'image' : 'file';
+		}
 
-		// Ensure empty details is an empty object.
-		if ( empty( $data['media_details'] ) ) {
-			$data['media_details'] = new stdClass;
-		} elseif ( ! empty( $data['media_details']['sizes'] ) ) {
+		if ( in_array( 'mime_type', $fields, true ) ) {
+			$data['mime_type'] = $post->post_mime_type;
+		}
 
-			foreach ( $data['media_details']['sizes'] as $size => &$size_data ) {
+		if ( in_array( 'media_details', $fields, true ) ) {
+			$data['media_details'] = wp_get_attachment_metadata( $post->ID );
 
-				if ( isset( $size_data['mime-type'] ) ) {
-					$size_data['mime_type'] = $size_data['mime-type'];
-					unset( $size_data['mime-type'] );
+			// Ensure empty details is an empty object.
+			if ( empty( $data['media_details'] ) ) {
+				$data['media_details'] = new stdClass;
+			} elseif ( ! empty( $data['media_details']['sizes'] ) ) {
+
+				foreach ( $data['media_details']['sizes'] as $size => &$size_data ) {
+
+					if ( isset( $size_data['mime-type'] ) ) {
+						$size_data['mime_type'] = $size_data['mime-type'];
+						unset( $size_data['mime-type'] );
+					}
+
+					// Use the same method image_downsize() does.
+					$image_src = wp_get_attachment_image_src( $post->ID, $size );
+					if ( ! $image_src ) {
+						continue;
+					}
+
+					$size_data['source_url'] = $image_src[0];
 				}
 
-				// Use the same method image_downsize() does.
-				$image_src = wp_get_attachment_image_src( $post->ID, $size );
-				if ( ! $image_src ) {
-					continue;
+				$full_src = wp_get_attachment_image_src( $post->ID, 'full' );
+
+				if ( ! empty( $full_src ) ) {
+					$data['media_details']['sizes']['full'] = array(
+						'file'       => wp_basename( $full_src[0] ),
+						'width'      => $full_src[1],
+						'height'     => $full_src[2],
+						'mime_type'  => $post->post_mime_type,
+						'source_url' => $full_src[0],
+					);
 				}
-
-				$size_data['source_url'] = $image_src[0];
+			} else {
+				$data['media_details']['sizes'] = new stdClass;
 			}
+		}
 
-			$full_src = wp_get_attachment_image_src( $post->ID, 'full' );
+		if ( in_array( 'post', $fields, true ) ) {
+			$data['post'] = ! empty( $post->post_parent ) ? (int) $post->post_parent : null;
+		}
 
-			if ( ! empty( $full_src ) ) {
-				$data['media_details']['sizes']['full'] = array(
-					'file'       => wp_basename( $full_src[0] ),
-					'width'      => $full_src[1],
-					'height'     => $full_src[2],
-					'mime_type'  => $post->post_mime_type,
-					'source_url' => $full_src[0],
-				);
-			}
-		} else {
-			$data['media_details']['sizes'] = new stdClass;
+		if ( in_array( 'source_url', $fields, true ) ) {
+			$data['source_url'] = wp_get_attachment_url( $post->ID );
 		}
 
 		$context = ! empty( $request['context'] ) ? $request['context'] : 'view';

src/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php

@@ -862,35 +862,79 @@ class WP_REST_Comments_Controller extends WP_REST_Controller {
 	 * @return WP_REST_Response Response object.
 	 */
 	public function prepare_item_for_response( $comment, $request ) {
-		$data = array(
-			'id'                => (int) $comment->comment_ID,
-			'post'              => (int) $comment->comment_post_ID,
-			'parent'            => (int) $comment->comment_parent,
-			'author'            => (int) $comment->user_id,
-			'author_name'       => $comment->comment_author,
-			'author_email'      => $comment->comment_author_email,
-			'author_url'        => $comment->comment_author_url,
-			'author_ip'         => $comment->comment_author_IP,
-			'author_user_agent' => $comment->comment_agent,
-			'date'              => mysql_to_rfc3339( $comment->comment_date ),
-			'date_gmt'          => mysql_to_rfc3339( $comment->comment_date_gmt ),
-			'content'           => array(
+
+		$fields = $this->get_fields_for_response( $request );
+		$data   = array();
+
+		if ( in_array( 'id', $fields, true ) ) {
+			$data['id'] = (int) $comment->comment_ID;
+		}
+
+		if ( in_array( 'post', $fields, true ) ) {
+			$data['post'] = (int) $comment->comment_post_ID;
+		}
+
+		if ( in_array( 'parent', $fields, true ) ) {
+			$data['parent'] = (int) $comment->comment_parent;
+		}
+
+		if ( in_array( 'author', $fields, true ) ) {
+			$data['author'] = (int) $comment->user_id;
+		}
+
+		if ( in_array( 'author_name', $fields, true ) ) {
+			$data['author_name'] = $comment->comment_author;
+		}
+
+		if ( in_array( 'author_email', $fields, true ) ) {
+			$data['author_email'] = $comment->comment_author_email;
+		}
+
+		if ( in_array( 'author_url', $fields, true ) ) {
+			$data['author_url'] = $comment->comment_author_url;
+		}
+
+		if ( in_array( 'author_ip', $fields, true ) ) {
+			$data['author_ip'] = $comment->comment_author_IP;
+		}
+
+		if ( in_array( 'author_user_agent', $fields, true ) ) {
+			$data['author_user_agent'] = $comment->comment_agent;
+		}
+
+		if ( in_array( 'date', $fields, true ) ) {
+			$data['date'] = mysql_to_rfc3339( $comment->comment_date );
+		}
+
+		if ( in_array( 'date_gmt', $fields, true ) ) {
+			$data['date_gmt'] = mysql_to_rfc3339( $comment->comment_date_gmt );
+		}
+
+		if ( in_array( 'content', $fields, true ) ) {
+			$data['content'] = array(
 				/** This filter is documented in wp-includes/comment-template.php */
 				'rendered' => apply_filters( 'comment_text', $comment->comment_content, $comment ),
 				'raw'      => $comment->comment_content,
-			),
-			'link'              => get_comment_link( $comment ),
-			'status'            => $this->prepare_status_response( $comment->comment_approved ),
-			'type'              => get_comment_type( $comment->comment_ID ),
-		);
+			);
+		}
 
-		$schema = $this->get_item_schema();
+		if ( in_array( 'link', $fields, true ) ) {
+			$data['link'] = get_comment_link( $comment );
+		}
 
-		if ( ! empty( $schema['properties']['author_avatar_urls'] ) ) {
+		if ( in_array( 'status', $fields, true ) ) {
+			$data['status'] = $this->prepare_status_response( $comment->comment_approved );
+		}
+
+		if ( in_array( 'type', $fields, true ) ) {
+			$data['type'] = get_comment_type( $comment->comment_ID );
+		}
+
+		if ( in_array( 'author_avatar_urls', $fields, true ) ) {
 			$data['author_avatar_urls'] = rest_get_avatar_urls( $comment->comment_author_email );
 		}
 
-		if ( ! empty( $schema['properties']['meta'] ) ) {
+		if ( in_array( 'meta', $fields, true ) ) {
 			$data['meta'] = $this->meta->get_value( $comment->comment_ID, $request );
 		}
 

src/wp-includes/rest-api/endpoints/class-wp-rest-controller.php

@@ -505,6 +505,35 @@ abstract class WP_REST_Controller {
 		return $schema['title'];
 	}
 
+	/**
+	 * Gets an array of fields to be included on the response.
+	 *
+	 * Included fields are based on item schema and `_fields=` request argument.
+	 *
+	 * @since 4.9.6
+	 *
+	 * @param WP_REST_Request $request Full details about the request.
+	 * @return array Fields to be included in the response.
+	 */
+	public function get_fields_for_response( $request ) {
+		$schema = $this->get_item_schema();
+		$fields = isset( $schema['properties'] ) ? array_keys( $schema['properties'] ) : array();
+		if ( ! isset( $request['_fields'] ) ) {
+			return $fields;
+		}
+		$requested_fields = is_array( $request['_fields'] ) ? $request['_fields'] : preg_split( '/[\s,]+/', $request['_fields'] );
+		if ( 0 === count( $requested_fields ) ) {
+			return $fields;
+		}
+		// Trim off outside whitespace from the comma delimited list.
+		$requested_fields = array_map( 'trim', $requested_fields );
+		// Always persist 'id', because it can be needed for add_additional_fields_to_object().
+		if ( in_array( 'id', $fields, true ) ) {
+			$requested_fields[] = 'id';
+		}
+		return array_intersect( $fields, $requested_fields );
+	}
+
 	/**
 	 * Retrieves an array of endpoint arguments from the item schema for the controller.
 	 *

src/wp-includes/rest-api/endpoints/class-wp-rest-post-statuses-controller.php

@@ -199,15 +199,36 @@ class WP_REST_Post_Statuses_Controller extends WP_REST_Controller {
 	 */
 	public function prepare_item_for_response( $status, $request ) {
 
-		$data = array(
-			'name'         => $status->label,
-			'private'      => (bool) $status->private,
-			'protected'    => (bool) $status->protected,
-			'public'       => (bool) $status->public,
-			'queryable'    => (bool) $status->publicly_queryable,
-			'show_in_list' => (bool) $status->show_in_admin_all_list,
-			'slug'         => $status->name,
-		);
+		$fields = $this->get_fields_for_response( $request );
+		$data   = array();
+
+		if ( in_array( 'name', $fields, true ) ) {
+			$data['name'] = $status->label;
+		}
+
+		if ( in_array( 'private', $fields, true ) ) {
+			$data['private'] = (bool) $status->private;
+		}
+
+		if ( in_array( 'protected', $fields, true ) ) {
+			$data['protected'] = (bool) $status->protected;
+		}
+
+		if ( in_array( 'public', $fields, true ) ) {
+			$data['public'] = (bool) $status->public;
+		}
+
+		if ( in_array( 'queryable', $fields, true ) ) {
+			$data['queryable'] = (bool) $status->publicly_queryable;
+		}
+
+		if ( in_array( 'show_in_list', $fields, true ) ) {
+			$data['show_in_list'] = (bool) $status->show_in_admin_all_list;
+		}
+
+		if ( in_array( 'slug', $fields, true ) ) {
+			$data['slug'] = $status->name;
+		}
 
 		$context = ! empty( $request['context'] ) ? $request['context'] : 'view';
 		$data    = $this->add_additional_fields_to_object( $data, $request );

src/wp-includes/rest-api/endpoints/class-wp-rest-post-types-controller.php

@@ -155,18 +155,49 @@ class WP_REST_Post_Types_Controller extends WP_REST_Controller {
 		$base       = ! empty( $post_type->rest_base ) ? $post_type->rest_base : $post_type->name;
 		$supports   = get_all_post_type_supports( $post_type->name );
 
-		$data    = array(
-			'capabilities' => $post_type->cap,
-			'description'  => $post_type->description,
-			'hierarchical' => $post_type->hierarchical,
-			'viewable'     => is_post_type_viewable( $post_type ),
-			'labels'       => $post_type->labels,
-			'name'         => $post_type->label,
-			'slug'         => $post_type->name,
-			'supports'     => $supports,
-			'taxonomies'   => array_values( $taxonomies ),
-			'rest_base'    => $base,
-		);
+		$fields = $this->get_fields_for_response( $request );
+		$data   = array();
+
+		if ( in_array( 'capabilities', $fields, true ) ) {
+			$data['capabilities'] = $post_type->cap;
+		}
+
+		if ( in_array( 'description', $fields, true ) ) {
+			$data['description'] = $post_type->description;
+		}
+
+		if ( in_array( 'hierarchical', $fields, true ) ) {
+			$data['hierarchical'] = $post_type->hierarchical;
+		}
+
+		if ( in_array( 'viewable', $fields, true ) ) {
+			$data['viewable'] = is_post_type_viewable( $post_type );
+		}
+
+		if ( in_array( 'labels', $fields, true ) ) {
+			$data['labels'] = $post_type->labels;
+		}
+
+		if ( in_array( 'name', $fields, true ) ) {
+			$data['name'] = $post_type->label;
+		}
+
+		if ( in_array( 'slug', $fields, true ) ) {
+			$data['slug'] = $post_type->name;
+		}
+
+		if ( in_array( 'supports', $fields, true ) ) {
+			$data['supports'] = $supports;
+		}
+
+		if ( in_array( 'taxonomies', $fields, true ) ) {
+			$data['taxonomies'] = array_values( $taxonomies );
+		}
+
+		if ( in_array( 'rest_base', $fields, true ) ) {
+			$data['rest_base'] = $base;
+		}
+
 		$context = ! empty( $request['context'] ) ? $request['context'] : 'view';
 		$data    = $this->add_additional_fields_to_object( $data, $request );
 		$data    = $this->filter_response_by_context( $data, $context );

src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -1408,20 +1408,20 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 
 		setup_postdata( $post );
 
-		$schema = $this->get_item_schema();
+		$fields = $this->get_fields_for_response( $request );
 
 		// Base fields for every post.
 		$data = array();
 
-		if ( ! empty( $schema['properties']['id'] ) ) {
+		if ( in_array( 'id', $fields, true ) ) {
 			$data['id'] = $post->ID;
 		}
 
-		if ( ! empty( $schema['properties']['date'] ) ) {
+		if ( in_array( 'date', $fields, true ) ) {
 			$data['date'] = $this->prepare_date_response( $post->post_date_gmt, $post->post_date );
 		}
 
-		if ( ! empty( $schema['properties']['date_gmt'] ) ) {
+		if ( in_array( 'date_gmt', $fields, true ) ) {
 			// For drafts, `post_date_gmt` may not be set, indicating that the
 			// date of the draft should be updated each time it is saved (see
 			// #38883).  In this case, shim the value based on the `post_date`
@@ -1434,7 +1434,7 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 			$data['date_gmt'] = $this->prepare_date_response( $post_date_gmt );
 		}
 
-		if ( ! empty( $schema['properties']['guid'] ) ) {
+		if ( in_array( 'guid', $fields, true ) ) {
 			$data['guid'] = array(
 				/** This filter is documented in wp-includes/post-template.php */
 				'rendered' => apply_filters( 'get_the_guid', $post->guid, $post->ID ),
@@ -1442,11 +1442,11 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 			);
 		}
 
-		if ( ! empty( $schema['properties']['modified'] ) ) {
+		if ( in_array( 'modified', $fields, true ) ) {
 			$data['modified'] = $this->prepare_date_response( $post->post_modified_gmt, $post->post_modified );
 		}
 
-		if ( ! empty( $schema['properties']['modified_gmt'] ) ) {
+		if ( in_array( 'modified_gmt', $fields, true ) ) {
 			// For drafts, `post_modified_gmt` may not be set (see
 			// `post_date_gmt` comments above).  In this case, shim the value
 			// based on the `post_modified` field with the site's timezone
@@ -1459,27 +1459,27 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 			$data['modified_gmt'] = $this->prepare_date_response( $post_modified_gmt );
 		}
 
-		if ( ! empty( $schema['properties']['password'] ) ) {
+		if ( in_array( 'password', $fields, true ) ) {
 			$data['password'] = $post->post_password;
 		}
 
-		if ( ! empty( $schema['properties']['slug'] ) ) {
+		if ( in_array( 'slug', $fields, true ) ) {
 			$data['slug'] = $post->post_name;
 		}
 
-		if ( ! empty( $schema['properties']['status'] ) ) {
+		if ( in_array( 'status', $fields, true ) ) {
 			$data['status'] = $post->post_status;
 		}
 
-		if ( ! empty( $schema['properties']['type'] ) ) {
+		if ( in_array( 'type', $fields, true ) ) {
 			$data['type'] = $post->post_type;
 		}
 
-		if ( ! empty( $schema['properties']['link'] ) ) {
+		if ( in_array( 'link', $fields, true ) ) {
 			$data['link'] = get_permalink( $post->ID );
 		}
 
-		if ( ! empty( $schema['properties']['title'] ) ) {
+		if ( in_array( 'title', $fields, true ) ) {
 			add_filter( 'protected_title_format', array( $this, 'protected_title_format' ) );
 
 			$data['title'] = array(
@@ -1499,7 +1499,7 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 			$has_password_filter = true;
 		}
 
-		if ( ! empty( $schema['properties']['content'] ) ) {
+		if ( in_array( 'content', $fields, true ) ) {
 			$data['content'] = array(
 				'raw'       => $post->post_content,
 				/** This filter is documented in wp-includes/post-template.php */
@@ -1508,7 +1508,7 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 			);
 		}
 
-		if ( ! empty( $schema['properties']['excerpt'] ) ) {
+		if ( in_array( 'excerpt', $fields, true ) ) {
 			/** This filter is documented in wp-includes/post-template.php */
 			$excerpt         = apply_filters( 'the_excerpt', apply_filters( 'get_the_excerpt', $post->post_excerpt, $post ) );
 			$data['excerpt'] = array(
@@ -1523,35 +1523,35 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 			remove_filter( 'post_password_required', '__return_false' );
 		}
 
-		if ( ! empty( $schema['properties']['author'] ) ) {
+		if ( in_array( 'author', $fields, true ) ) {
 			$data['author'] = (int) $post->post_author;
 		}
 
-		if ( ! empty( $schema['properties']['featured_media'] ) ) {
+		if ( in_array( 'featured_media', $fields, true ) ) {
 			$data['featured_media'] = (int) get_post_thumbnail_id( $post->ID );
 		}
 
-		if ( ! empty( $schema['properties']['parent'] ) ) {
+		if ( in_array( 'parent', $fields, true ) ) {
 			$data['parent'] = (int) $post->post_parent;
 		}
 
-		if ( ! empty( $schema['properties']['menu_order'] ) ) {
+		if ( in_array( 'menu_order', $fields, true ) ) {
 			$data['menu_order'] = (int) $post->menu_order;
 		}
 
-		if ( ! empty( $schema['properties']['comment_status'] ) ) {
+		if ( in_array( 'comment_status', $fields, true ) ) {
 			$data['comment_status'] = $post->comment_status;
 		}
 
-		if ( ! empty( $schema['properties']['ping_status'] ) ) {
+		if ( in_array( 'ping_status', $fields, true ) ) {
 			$data['ping_status'] = $post->ping_status;
 		}
 
-		if ( ! empty( $schema['properties']['sticky'] ) ) {
+		if ( in_array( 'sticky', $fields, true ) ) {
 			$data['sticky'] = is_sticky( $post->ID );
 		}
 
-		if ( ! empty( $schema['properties']['template'] ) ) {
+		if ( in_array( 'template', $fields, true ) ) {
 			if ( $template = get_page_template_slug( $post->ID ) ) {
 				$data['template'] = $template;
 			} else {
@@ -1559,7 +1559,7 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 			}
 		}
 
-		if ( ! empty( $schema['properties']['format'] ) ) {
+		if ( in_array( 'format', $fields, true ) ) {
 			$data['format'] = get_post_format( $post->ID );
 
 			// Fill in blank post format.
@@ -1568,7 +1568,7 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 			}
 		}
 
-		if ( ! empty( $schema['properties']['meta'] ) ) {
+		if ( in_array( 'meta', $fields, true ) ) {
 			$data['meta'] = $this->meta->get_value( $post->ID, $request );
 		}
 
@@ -1577,7 +1577,7 @@ class WP_REST_Posts_Controller extends WP_REST_Controller {
 		foreach ( $taxonomies as $taxonomy ) {
 			$base = ! empty( $taxonomy->rest_base ) ? $taxonomy->rest_base : $taxonomy->name;
 
-			if ( ! empty( $schema['properties'][ $base ] ) ) {
+			if ( in_array( $base, $fields, true ) ) {
 				$terms         = get_the_terms( $post, $taxonomy->name );
 				$data[ $base ] = $terms ? array_values( wp_list_pluck( $terms, 'term_id' ) ) : array();
 			}

src/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php

@@ -340,43 +340,42 @@ class WP_REST_Revisions_Controller extends WP_REST_Controller {
 
 		setup_postdata( $post );
 
-		$schema = $this->get_item_schema();
+		$fields = $this->get_fields_for_response( $request );
+		$data   = array();
 
-		$data = array();
-
-		if ( ! empty( $schema['properties']['author'] ) ) {
+		if ( in_array( 'author', $fields, true ) ) {
 			$data['author'] = (int) $post->post_author;
 		}
 
-		if ( ! empty( $schema['properties']['date'] ) ) {
+		if ( in_array( 'date', $fields, true ) ) {
 			$data['date'] = $this->prepare_date_response( $post->post_date_gmt, $post->post_date );
 		}
 
-		if ( ! empty( $schema['properties']['date_gmt'] ) ) {
+		if ( in_array( 'date_gmt', $fields, true ) ) {
 			$data['date_gmt'] = $this->prepare_date_response( $post->post_date_gmt );
 		}
 
-		if ( ! empty( $schema['properties']['id'] ) ) {
+		if ( in_array( 'id', $fields, true ) ) {
 			$data['id'] = $post->ID;
 		}
 
-		if ( ! empty( $schema['properties']['modified'] ) ) {
+		if ( in_array( 'modified', $fields, true ) ) {
 			$data['modified'] = $this->prepare_date_response( $post->post_modified_gmt, $post->post_modified );
 		}
 
-		if ( ! empty( $schema['properties']['modified_gmt'] ) ) {
+		if ( in_array( 'modified_gmt', $fields, true ) ) {
 			$data['modified_gmt'] = $this->prepare_date_response( $post->post_modified_gmt );
 		}
 
-		if ( ! empty( $schema['properties']['parent'] ) ) {
+		if ( in_array( 'parent', $fields, true ) ) {
 			$data['parent'] = (int) $post->post_parent;
 		}
 
-		if ( ! empty( $schema['properties']['slug'] ) ) {
+		if ( in_array( 'slug', $fields, true ) ) {
 			$data['slug'] = $post->post_name;
 		}
 
-		if ( ! empty( $schema['properties']['guid'] ) ) {
+		if ( in_array( 'guid', $fields, true ) ) {
 			$data['guid'] = array(
 				/** This filter is documented in wp-includes/post-template.php */
 				'rendered' => apply_filters( 'get_the_guid', $post->guid, $post->ID ),
@@ -384,14 +383,14 @@ class WP_REST_Revisions_Controller extends WP_REST_Controller {
 			);
 		}
 
-		if ( ! empty( $schema['properties']['title'] ) ) {
+		if ( in_array( 'title', $fields, true ) ) {
 			$data['title'] = array(
 				'raw'      => $post->post_title,
 				'rendered' => get_the_title( $post->ID ),
 			);
 		}
 
-		if ( ! empty( $schema['properties']['content'] ) ) {
+		if ( in_array( 'content', $fields, true ) ) {
 
 			$data['content'] = array(
 				'raw'      => $post->post_content,
@@ -400,7 +399,7 @@ class WP_REST_Revisions_Controller extends WP_REST_Controller {
 			);
 		}
 
-		if ( ! empty( $schema['properties']['excerpt'] ) ) {
+		if ( in_array( 'excerpt', $fields, true ) ) {
 			$data['excerpt'] = array(
 				'raw'      => $post->post_excerpt,
 				'rendered' => $this->prepare_excerpt_response( $post->post_excerpt, $post ),

src/wp-includes/rest-api/endpoints/class-wp-rest-taxonomies-controller.php

@@ -181,25 +181,56 @@ class WP_REST_Taxonomies_Controller extends WP_REST_Controller {
 	 */
 	public function prepare_item_for_response( $taxonomy, $request ) {
 		$base = ! empty( $taxonomy->rest_base ) ? $taxonomy->rest_base : $taxonomy->name;
-		$data = array(
-			'name'         => $taxonomy->label,
-			'slug'         => $taxonomy->name,
-			'capabilities' => $taxonomy->cap,
-			'description'  => $taxonomy->description,
-			'labels'       => $taxonomy->labels,
-			'types'        => $taxonomy->object_type,
-			'show_cloud'   => $taxonomy->show_tagcloud,
-			'hierarchical' => $taxonomy->hierarchical,
-			'rest_base'    => $base,
-			'visibility'   => array(
+
+		$fields = $this->get_fields_for_response( $request );
+		$data   = array();
+
+		if ( in_array( 'name', $fields, true ) ) {
+			$data['name'] = $taxonomy->label;
+		}
+
+		if ( in_array( 'slug', $fields, true ) ) {
+			$data['slug'] = $taxonomy->name;
+		}
+
+		if ( in_array( 'capabilities', $fields, true ) ) {
+			$data['capabilities'] = $taxonomy->cap;
+		}
+
+		if ( in_array( 'description', $fields, true ) ) {
+			$data['description'] = $taxonomy->description;
+		}
+
+		if ( in_array( 'labels', $fields, true ) ) {
+			$data['labels'] = $taxonomy->labels;
+		}
+
+		if ( in_array( 'types', $fields, true ) ) {
+			$data['types'] = $taxonomy->object_type;
+		}
+
+		if ( in_array( 'show_cloud', $fields, true ) ) {
+			$data['show_cloud'] = $taxonomy->show_tagcloud;
+		}
+
+		if ( in_array( 'hierarchical', $fields, true ) ) {
+			$data['hierarchical'] = $taxonomy->hierarchical;
+		}
+
+		if ( in_array( 'rest_base', $fields, true ) ) {
+			$data['rest_base'] = $base;
+		}
+
+		if ( in_array( 'visibility', $fields, true ) ) {
+			$data['visibility'] = array(
 				'public'             => (bool) $taxonomy->public,
 				'publicly_queryable' => (bool) $taxonomy->publicly_queryable,
 				'show_admin_column'  => (bool) $taxonomy->show_admin_column,
 				'show_in_nav_menus'  => (bool) $taxonomy->show_in_nav_menus,
 				'show_in_quick_edit' => (bool) $taxonomy->show_in_quick_edit,
 				'show_ui'            => (bool) $taxonomy->show_ui,
-			),
-		);
+			);
+		}
 
 		$context = ! empty( $request['context'] ) ? $request['context'] : 'view';
 		$data    = $this->add_additional_fields_to_object( $data, $request );

src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php

@@ -691,42 +691,42 @@ class WP_REST_Terms_Controller extends WP_REST_Controller {
 	 */
 	public function prepare_item_for_response( $item, $request ) {
 
-		$schema = $this->get_item_schema();
+		$fields = $this->get_fields_for_response( $request );
 		$data   = array();
 
-		if ( ! empty( $schema['properties']['id'] ) ) {
+		if ( in_array( 'id', $fields, true ) ) {
 			$data['id'] = (int) $item->term_id;
 		}
 
-		if ( ! empty( $schema['properties']['count'] ) ) {
+		if ( in_array( 'count', $fields, true ) ) {
 			$data['count'] = (int) $item->count;
 		}
 
-		if ( ! empty( $schema['properties']['description'] ) ) {
+		if ( in_array( 'description', $fields, true ) ) {
 			$data['description'] = $item->description;
 		}
 
-		if ( ! empty( $schema['properties']['link'] ) ) {
+		if ( in_array( 'link', $fields, true ) ) {
 			$data['link'] = get_term_link( $item );
 		}
 
-		if ( ! empty( $schema['properties']['name'] ) ) {
+		if ( in_array( 'name', $fields, true ) ) {
 			$data['name'] = $item->name;
 		}
 
-		if ( ! empty( $schema['properties']['slug'] ) ) {
+		if ( in_array( 'slug', $fields, true ) ) {
 			$data['slug'] = $item->slug;
 		}
 
-		if ( ! empty( $schema['properties']['taxonomy'] ) ) {
+		if ( in_array( 'taxonomy', $fields, true ) ) {
 			$data['taxonomy'] = $item->taxonomy;
 		}
 
-		if ( ! empty( $schema['properties']['parent'] ) ) {
+		if ( in_array( 'parent', $fields, true ) ) {
 			$data['parent'] = (int) $item->parent;
 		}
 
-		if ( ! empty( $schema['properties']['meta'] ) ) {
+		if ( in_array( 'meta', $fields, true ) ) {
 			$data['meta'] = $this->meta->get_value( $item->term_id, $request );
 		}
 

src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -846,78 +846,78 @@ class WP_REST_Users_Controller extends WP_REST_Controller {
 	public function prepare_item_for_response( $user, $request ) {
 
 		$data   = array();
-		$schema = $this->get_item_schema();
+		$fields = $this->get_fields_for_response( $request );
 
-		if ( ! empty( $schema['properties']['id'] ) ) {
+		if ( in_array( 'id', $fields, true ) ) {
 			$data['id'] = $user->ID;
 		}
 
-		if ( ! empty( $schema['properties']['username'] ) ) {
+		if ( in_array( 'username', $fields, true ) ) {
 			$data['username'] = $user->user_login;
 		}
 
-		if ( ! empty( $schema['properties']['name'] ) ) {
+		if ( in_array( 'name', $fields, true ) ) {
 			$data['name'] = $user->display_name;
 		}
 
-		if ( ! empty( $schema['properties']['first_name'] ) ) {
+		if ( in_array( 'first_name', $fields, true ) ) {
 			$data['first_name'] = $user->first_name;
 		}
 
-		if ( ! empty( $schema['properties']['last_name'] ) ) {
+		if ( in_array( 'last_name', $fields, true ) ) {
 			$data['last_name'] = $user->last_name;
 		}
 
-		if ( ! empty( $schema['properties']['email'] ) ) {
+		if ( in_array( 'email', $fields, true ) ) {
 			$data['email'] = $user->user_email;
 		}
 
-		if ( ! empty( $schema['properties']['url'] ) ) {
+		if ( in_array( 'url', $fields, true ) ) {
 			$data['url'] = $user->user_url;
 		}
 
-		if ( ! empty( $schema['properties']['description'] ) ) {
+		if ( in_array( 'description', $fields, true ) ) {
 			$data['description'] = $user->description;
 		}
 
-		if ( ! empty( $schema['properties']['link'] ) ) {
+		if ( in_array( 'link', $fields, true ) ) {
 			$data['link'] = get_author_posts_url( $user->ID, $user->user_nicename );
 		}
 
-		if ( ! empty( $schema['properties']['locale'] ) ) {
+		if ( in_array( 'locale', $fields, true ) ) {
 			$data['locale'] = get_user_locale( $user );
 		}
 
-		if ( ! empty( $schema['properties']['nickname'] ) ) {
+		if ( in_array( 'nickname', $fields, true ) ) {
 			$data['nickname'] = $user->nickname;
 		}
 
-		if ( ! empty( $schema['properties']['slug'] ) ) {
+		if ( in_array( 'slug', $fields, true ) ) {
 			$data['slug'] = $user->user_nicename;
 		}
 
-		if ( ! empty( $schema['properties']['roles'] ) ) {
+		if ( in_array( 'roles', $fields, true ) ) {
 			// Defensively call array_values() to ensure an array is returned.
 			$data['roles'] = array_values( $user->roles );
 		}
 
-		if ( ! empty( $schema['properties']['registered_date'] ) ) {
+		if ( in_array( 'registered_date', $fields, true ) ) {
 			$data['registered_date'] = date( 'c', strtotime( $user->user_registered ) );
 		}
 
-		if ( ! empty( $schema['properties']['capabilities'] ) ) {
+		if ( in_array( 'capabilities', $fields, true ) ) {
 			$data['capabilities'] = (object) $user->allcaps;
 		}
 
-		if ( ! empty( $schema['properties']['extra_capabilities'] ) ) {
+		if ( in_array( 'extra_capabilities', $fields, true ) ) {
 			$data['extra_capabilities'] = (object) $user->caps;
 		}
 
-		if ( ! empty( $schema['properties']['avatar_urls'] ) ) {
+		if ( in_array( 'avatar_urls', $fields, true ) ) {
 			$data['avatar_urls'] = rest_get_avatar_urls( $user->user_email );
 		}
 
-		if ( ! empty( $schema['properties']['meta'] ) ) {
+		if ( in_array( 'meta', $fields, true ) ) {
 			$data['meta'] = $this->meta->get_value( $user->ID, $request );
 		}
 

tests/phpunit/tests/rest-api/rest-attachments-controller.php

@@ -1178,6 +1178,27 @@ class WP_Test_REST_Attachments_Controller extends WP_Test_REST_Post_Type_Control
 		$this->check_post_data( $attachment, $data, 'embed', $response->get_links() );
 	}
 
+	public function test_prepare_item_limit_fields() {
+		$attachment_id = $this->factory->attachment->create_object(
+			$this->test_file, 0, array(
+				'post_mime_type' => 'image/jpeg',
+				'post_excerpt'   => 'A sample caption',
+				'post_author'    => self::$editor_id,
+			)
+		);
+		wp_set_current_user( self::$editor_id );
+		$endpoint = new WP_REST_Attachments_Controller( 'post' );
+		$request  = new WP_REST_Request( 'GET', sprintf( '/wp/v2/media/%d', $attachment_id ) );
+		$request->set_param( 'context', 'edit' );
+		$request->set_param( '_fields', 'id,slug' );
+		$obj      = get_post( $attachment_id );
+		$response = $endpoint->prepare_item_for_response( $obj, $request );
+		$this->assertEquals( array(
+			'id',
+			'slug',
+		), array_keys( $response->get_data() ) );
+	}
+
 	public function test_get_item_schema() {
 		$request    = new WP_REST_Request( 'OPTIONS', '/wp/v2/media' );
 		$response   = rest_get_server()->dispatch( $request );

tests/phpunit/tests/rest-api/rest-categories-controller.php

@@ -882,6 +882,18 @@ class WP_Test_REST_Categories_Controller extends WP_Test_REST_Controller_Testcas
 		$this->check_taxonomy_term( $term, $data, $response->get_links() );
 	}
 
+	public function test_prepare_item_limit_fields() {
+		$request  = new WP_REST_Request;
+		$endpoint = new WP_REST_Terms_Controller( 'category' );
+		$request->set_param( '_fields', 'id,name' );
+		$term     = get_term( 1, 'category' );
+		$response = $endpoint->prepare_item_for_response( $term, $request );
+		$this->assertEquals( array(
+			'id',
+			'name',
+		), array_keys( $response->get_data() ) );
+	}
+
 	public function test_prepare_taxonomy_term_child() {
 		$child = $this->factory->category->create(
 			array(

tests/phpunit/tests/rest-api/rest-comments-controller.php

@@ -847,6 +847,20 @@ class WP_Test_REST_Comments_Controller extends WP_Test_REST_Controller_Testcase
 		$this->check_comment_data( $data, 'edit', $response->get_links() );
 	}
 
+	public function test_prepare_item_limit_fields() {
+		wp_set_current_user( self::$admin_id );
+		$endpoint = new WP_REST_Comments_Controller;
+		$request  = new WP_REST_Request( 'GET', sprintf( '/wp/v2/comments/%d', self::$approved_id ) );
+		$request->set_param( 'context', 'edit' );
+		$request->set_param( '_fields', 'id,status' );
+		$obj      = get_comment( self::$approved_id );
+		$response = $endpoint->prepare_item_for_response( $obj, $request );
+		$this->assertEquals( array(
+			'id',
+			'status',
+		), array_keys( $response->get_data() ) );
+	}
+
 	public function test_get_comment_author_avatar_urls() {
 		$request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/comments/%d', self::$approved_id ) );
 

tests/phpunit/tests/rest-api/rest-controller.php

@@ -200,4 +200,27 @@ class WP_Test_REST_Controller extends WP_Test_REST_TestCase {
 
 		$this->assertEquals( 'a', $args['somedefault']['default'] );
 	}
+
+	public function test_get_fields_for_response() {
+		$controller = new WP_REST_Test_Controller();
+		$request    = new WP_REST_Request( 'GET', '/wp/v2/testroute' );
+		$fields     = $controller->get_fields_for_response( $request );
+		$this->assertEquals( array(
+			'somestring',
+			'someinteger',
+			'someboolean',
+			'someurl',
+			'somedate',
+			'someemail',
+			'someenum',
+			'someargoptions',
+			'somedefault',
+		), $fields );
+		$request->set_param( '_fields', 'somestring,someinteger' );
+		$fields = $controller->get_fields_for_response( $request );
+		$this->assertEquals( array(
+			'somestring',
+			'someinteger',
+		), $fields );
+	}
 }

tests/phpunit/tests/rest-api/rest-pages-controller.php

@@ -451,6 +451,26 @@ class WP_Test_REST_Pages_Controller extends WP_Test_REST_Post_Type_Controller_Te
 
 	}
 
+	public function test_prepare_item_limit_fields() {
+		wp_set_current_user( self::$editor_id );
+		$page_id  = $this->factory->post->create(
+			array(
+				'post_status' => 'publish',
+				'post_type'   => 'page',
+			)
+		);
+		$endpoint = new WP_REST_Posts_Controller( 'page' );
+		$request  = new WP_REST_Request( 'GET', sprintf( '/wp/v2/pages/%d', $page_id ) );
+		$request->set_param( 'context', 'edit' );
+		$request->set_param( '_fields', 'id,slug' );
+		$obj      = get_post( $page_id );
+		$response = $endpoint->prepare_item_for_response( $obj, $request );
+		$this->assertEquals( array(
+			'id',
+			'slug',
+		), array_keys( $response->get_data() ) );
+	}
+
 	public function test_get_pages_params() {
 		$this->factory->post->create_many(
 			8, array(

tests/phpunit/tests/rest-api/rest-post-statuses-controller.php

@@ -131,6 +131,19 @@ class WP_Test_REST_Post_Statuses_Controller extends WP_Test_REST_Controller_Test
 		$this->check_post_status_obj( $obj, $data->get_data(), $data->get_links() );
 	}
 
+	public function test_prepare_item_limit_fields() {
+		$obj      = get_post_status_object( 'publish' );
+		$request  = new WP_REST_Request;
+		$endpoint = new WP_REST_Post_Statuses_Controller;
+		$request->set_param( 'context', 'edit' );
+		$request->set_param( '_fields', 'id,name' );
+		$response = $endpoint->prepare_item_for_response( $obj, $request );
+		$this->assertEquals( array(
+			// 'id' doesn't exist in this context.
+			'name',
+		), array_keys( $response->get_data() ) );
+	}
+
 	public function test_get_item_schema() {
 		$request    = new WP_REST_Request( 'OPTIONS', '/wp/v2/statuses' );
 		$response   = rest_get_server()->dispatch( $request );

tests/phpunit/tests/rest-api/rest-post-types-controller.php

@@ -123,6 +123,19 @@ class WP_Test_REST_Post_Types_Controller extends WP_Test_REST_Controller_Testcas
 		$this->check_post_type_obj( 'edit', $obj, $response->get_data(), $response->get_links() );
 	}
 
+	public function test_prepare_item_limit_fields() {
+		$obj      = get_post_type_object( 'post' );
+		$request  = new WP_REST_Request;
+		$endpoint = new WP_REST_Post_Types_Controller;
+		$request->set_param( 'context', 'edit' );
+		$request->set_param( '_fields', 'id,name' );
+		$response = $endpoint->prepare_item_for_response( $obj, $request );
+		$this->assertEquals( array(
+			// 'id' doesn't exist in this context.
+			'name',
+		), array_keys( $response->get_data() ) );
+	}
+
 	public function test_get_item_schema() {
 		$request    = new WP_REST_Request( 'OPTIONS', '/wp/v2/types' );
 		$response   = rest_get_server()->dispatch( $request );

tests/phpunit/tests/rest-api/rest-posts-controller.php

@@ -1499,6 +1499,20 @@ class WP_Test_REST_Posts_Controller extends WP_Test_REST_Post_Type_Controller_Te
 		$this->check_get_post_response( $response, 'edit' );
 	}
 
+	public function test_prepare_item_limit_fields() {
+		wp_set_current_user( self::$editor_id );
+		$endpoint = new WP_REST_Posts_Controller( 'post' );
+		$request  = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', self::$post_id ) );
+		$request->set_param( 'context', 'edit' );
+		$request->set_param( '_fields', 'id,slug' );
+		$obj      = get_post( self::$post_id );
+		$response = $endpoint->prepare_item_for_response( $obj, $request );
+		$this->assertEquals( array(
+			'id',
+			'slug',
+		), array_keys( $response->get_data() ) );
+	}
+
 	public function test_create_item() {
 		wp_set_current_user( self::$editor_id );
 

tests/phpunit/tests/rest-api/rest-revisions-controller.php

@@ -237,6 +237,20 @@ class WP_Test_REST_Revisions_Controller extends WP_Test_REST_Controller_Testcase
 		$this->check_get_revision_response( $response, $this->revision_1 );
 	}
 
+	public function test_prepare_item_limit_fields() {
+		wp_set_current_user( self::$editor_id );
+		$request  = new WP_REST_Request( 'GET', '/wp/v2/posts/' . self::$post_id . '/revisions/' . $this->revision_id1 );
+		$endpoint = new WP_REST_Revisions_Controller( 'post' );
+		$request->set_param( 'context', 'edit' );
+		$request->set_param( '_fields', 'id,slug' );
+		$revision = get_post( $this->revision_id1 );
+		$response = $endpoint->prepare_item_for_response( $revision, $request );
+		$this->assertEquals( array(
+			'id',
+			'slug',
+		), array_keys( $response->get_data() ) );
+	}
+
 	public function test_get_item_schema() {
 		$request    = new WP_REST_Request( 'OPTIONS', '/wp/v2/posts/' . self::$post_id . '/revisions' );
 		$response   = rest_get_server()->dispatch( $request );

tests/phpunit/tests/rest-api/rest-tags-controller.php

@@ -968,6 +968,18 @@ class WP_Test_REST_Tags_Controller extends WP_Test_REST_Controller_Testcase {
 		$this->check_taxonomy_term( $term, $data, $response->get_links() );
 	}
 
+	public function test_prepare_item_limit_fields() {
+		$request  = new WP_REST_Request;
+		$endpoint = new WP_REST_Terms_Controller( 'post_tag' );
+		$request->set_param( '_fields', 'id,name' );
+		$term     = get_term_by( 'id', $this->factory->tag->create(), 'post_tag' );
+		$response = $endpoint->prepare_item_for_response( $term, $request );
+		$this->assertEquals( array(
+			'id',
+			'name',
+		), array_keys( $response->get_data() ) );
+	}
+
 	public function test_get_item_schema() {
 		$request    = new WP_REST_Request( 'OPTIONS', '/wp/v2/tags' );
 		$response   = rest_get_server()->dispatch( $request );

tests/phpunit/tests/rest-api/rest-taxonomies-controller.php

@@ -162,6 +162,19 @@ class WP_Test_REST_Taxonomies_Controller extends WP_Test_REST_Controller_Testcas
 		$this->check_taxonomy_object( 'edit', $tax, $response->get_data(), $response->get_links() );
 	}
 
+	public function test_prepare_item_limit_fields() {
+		$tax      = get_taxonomy( 'category' );
+		$request  = new WP_REST_Request;
+		$endpoint = new WP_REST_Taxonomies_Controller;
+		$request->set_param( 'context', 'edit' );
+		$request->set_param( '_fields', 'id,name' );
+		$response = $endpoint->prepare_item_for_response( $tax, $request );
+		$this->assertEquals( array(
+			// 'id' doesn't exist in this context.
+			'name',
+		), array_keys( $response->get_data() ) );
+	}
+
 	public function test_get_item_schema() {
 		$request    = new WP_REST_Request( 'OPTIONS', '/wp/v2/taxonomies' );
 		$response   = rest_get_server()->dispatch( $request );

tests/phpunit/tests/rest-api/rest-users-controller.php

@@ -849,6 +849,19 @@ class WP_Test_REST_Users_Controller extends WP_Test_REST_Controller_Testcase {
 		$this->check_get_user_response( $data, 'edit' );
 	}
 
+	public function test_prepare_item_limit_fields() {
+		wp_set_current_user( self::$user );
+		$request = new WP_REST_Request;
+		$request->set_param( 'context', 'edit' );
+		$request->set_param( '_fields', 'id,name' );
+		$user     = get_user_by( 'id', get_current_user_id() );
+		$response = $this->endpoint->prepare_item_for_response( $user, $request );
+		$this->assertEquals( array(
+			'id',
+			'name',
+		), array_keys( $response->get_data() ) );
+	}
+
 	public function test_get_user_avatar_urls() {
 		wp_set_current_user( self::$user );