From 6830e9094962f7866528d1027dce4e93743a2485 Mon Sep 17 00:00:00 2001 From: Jeremy Felt Date: Wed, 13 Jul 2016 04:12:41 +0000 Subject: [PATCH] Meta: Remove filters when meta is unregistered. If auth and/or sanitize callbacks are specified in the arguments for `register_meta()`, filters are added to handle these callbacks. These should be removed when calling `unregister_meta_key()` to avoid unintentional filtering. See #35658. git-svn-id: https://develop.svn.wordpress.org/trunk@38040 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/meta.php | 10 ++++++++ tests/phpunit/tests/meta/registerMeta.php | 28 ++++++++++++++++++----- 2 files changed, 32 insertions(+), 6 deletions(-) diff --git a/src/wp-includes/meta.php b/src/wp-includes/meta.php index dfc0695818..e341bd2bcc 100644 --- a/src/wp-includes/meta.php +++ b/src/wp-includes/meta.php @@ -1162,6 +1162,16 @@ function unregister_meta_key( $object_type, $object_subtype, $meta_key ) { return new WP_Error( 'invalid_meta_key', __( 'Invalid meta key' ) ); } + $args = $wp_meta_keys[ $object_type ][ $object_subtype ][ $meta_key ]; + + if ( isset( $args['sanitize_callback'] ) && is_callable( $args['sanitize_callback'] ) ) { + remove_filter( "sanitize_{$object_type}_{$object_subtype}_meta_{$meta_key}", $args['sanitize_callback'] ); + } + + if ( isset( $args['auth_callback'] ) && is_callable( $args['auth_callback'] ) ) { + remove_filter( "auth_{$object_type}_{$object_subtype}_meta_{$meta_key}", $args['auth_callback'] ); + } + unset( $wp_meta_keys[ $object_type ][ $object_subtype ][ $meta_key ] ); // Do some clean up diff --git a/tests/phpunit/tests/meta/registerMeta.php b/tests/phpunit/tests/meta/registerMeta.php index ec7d323ac1..594a57374d 100644 --- a/tests/phpunit/tests/meta/registerMeta.php +++ b/tests/phpunit/tests/meta/registerMeta.php @@ -32,6 +32,10 @@ class Tests_Meta_Register_Meta extends WP_UnitTestCase { return $meta_key . ' new sanitized'; } + public function _new_auth_meta_cb( $allowed, $meta_key, $post_id, $user_id, $cap, $caps ) { + return $allowed; + } + public function test_register_meta_with_valid_object_type_and_object_subtype_returns_true() { $result = register_meta( 'post', 'flight_number', array( 'object_subtype' => 'post' ) ); unregister_meta_key( 'post', 'post', 'flight_number' ); @@ -200,9 +204,6 @@ class Tests_Meta_Register_Meta extends WP_UnitTestCase { $result = register_meta( 'post', 'flight_number', array( 'object_subtype' => 'post', 'sanitize_callback' => array( $this, '_new_sanitize_meta_cb' ) ) ); unregister_meta_key( 'post', 'post', 'flight_number' ); - remove_filter( 'sanitize_post_post_meta_flight_number', array( $this, '_new_sanitize_meta_cb') ); - remove_filter( 'auth_post_post_meta_flight_number', '__return_true'); - $this->assertTrue( $result ); } @@ -212,12 +213,27 @@ class Tests_Meta_Register_Meta extends WP_UnitTestCase { unregister_meta_key( 'post', 'post', 'new_sanitized_key' ); - remove_filter( 'sanitize_post_post_meta_new_sanitized_key', array( $this, '_new_sanitize_meta_cb') ); - remove_filter( 'auth_post_post_meta_new_sanitized_key', '__return_true'); - $this->assertEquals( 'new_sanitized_key new sanitized', $meta ); } + public function test_register_meta_unregistered_meta_key_removes_sanitize_filter() { + register_meta( 'post', 'new_sanitized_key', array( 'object_subtype' => 'post', 'sanitize_callback' => array( $this, '_new_sanitize_meta_cb' ) ) ); + unregister_meta_key( 'post', 'post', 'new_sanitized_key' ); + + $has_filter = has_filter( 'sanitize_post_post_meta_new_sanitized_key', array( $this, '_new_sanitize_meta_cb' ) ); + + $this->assertFalse( $has_filter ); + } + + public function test_register_meta_unregistered_meta_key_removes_auth_filter() { + register_meta( 'post', 'new_auth_key', array( 'object_subtype' => 'post', 'auth_callback' => array( $this, '_new_auth_meta_cb' ) ) ); + unregister_meta_key( 'post', 'post', 'new_auth_key' ); + + $has_filter = has_filter( 'auth_post_post_meta_new_auth_key', array( $this, '_new_auth_meta_cb' ) ); + + $this->assertFalse( $has_filter ); + } + public function test_unregister_meta_key_clears_key_from_wp_meta_keys() { global $wp_meta_keys; register_meta( 'post', 'registered_key', array( 'object_subtype' => 'post' ) );