sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Embeds: Enforce a valid post ID when embedding a post from the current site.

Browse Source 
Otherwise `wp_filter_pre_oembed_result()` could erroneously return the HTML of the current post instead of the intended result.

Props kraftbj.
See #36767.

git-svn-id: https://develop.svn.wordpress.org/trunk@37729 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Pascal Birchler 2016-06-16 17:17:32 +00:00
parent eefd425f66
commit 931440e375
2 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/wp-includes/embed.php
View File

@ -1100,6 +1100,10 @@ function wp_filter_pre_oembed_result( $result, $url, $args ) {
/** This filter is documented in wp-includes/class-wp-oembed-controller.php */
$post_id = apply_filters( 'oembed_request_post_id', $post_id, $url );
if ( ! $post_id ) {
return $result;
}
$width = isset( $args['width'] ) ? $args['width'] : 0;
$data = get_oembed_response_data( $post_id, $width );

18
tests/phpunit/tests/oembed/wpOembed.php
View File

@ -24,7 +24,8 @@ class Tests_WP_oEmbed extends WP_UnitTestCase {
// If this is not null, the oEmbed result has been filtered before any HTTP requests were made.
$this->pre_oembed_result_filtered = $result;
return $result;
// Return false to prevent HTTP requests during tests.
return $result ? $result : false;
}
public function test_wp_filter_pre_oembed_result_prevents_http_request_for_internal_permalinks() {
@ -53,4 +54,19 @@ class Tests_WP_oEmbed extends WP_UnitTestCase {
$this->assertTrue( false !== $this->pre_oembed_result_filtered );
$this->assertEquals( $this->pre_oembed_result_filtered, $actual );
}
public function test_wp_filter_pre_oembed_result_non_existent_post() {
$post_id = self::factory()->post->create();
$permalink = get_permalink( $post_id );
$this->go_to( $permalink );
$this->assertQueryTrue( 'is_single', 'is_singular' );
add_filter( 'pre_oembed_result', array( $this, '_filter_pre_oembed_result' ) );
$actual = $this->oembed->get_html( 'https://example.com/' );
remove_filter( 'pre_oembed_result', array( $this, '_filter_pre_oembed_result' ) );
$this->assertTrue( false !== $this->pre_oembed_result_filtered );
$this->assertFalse( $actual );
}
}