sergiotarxz
/
Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

REST API: Deliver parameters unadulterated instead of slashed. 

We goofed, and parameters accessed through the REST API's methods
were slashed (inconsistently, even). This unslashes the data, so
you get the un-messed-with data that was sent.

Props joehoyle.
Fixes #36419.

git-svn-id: https://develop.svn.wordpress.org/trunk@37163 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Mark Jaquith 2016-04-06 21:01:11 +00:00
parent 28699803ee
commit 9deec9e723
3 changed files with 142 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/wp-includes/rest-api/class-wp-rest-server.php
View File

@ -303,10 +303,10 @@ class WP_REST_Server {
$request = new WP_REST_Request( $_SERVER['REQUEST_METHOD'], $path );
$request->set_query_params( $_GET );
$request->set_body_params( $_POST );
$request->set_query_params( wp_unslash( $_GET ) );
$request->set_body_params( wp_unslash( $_POST ) );
$request->set_file_params( $_FILES );
$request->set_headers( $this->get_headers( $_SERVER ) );
$request->set_headers( $this->get_headers( wp_unslash( $_SERVER ) ) );
$request->set_body( $this->get_raw_data() );
/*

12
tests/phpunit/includes/spy-rest-server.php
View File

@ -4,6 +4,7 @@ class Spy_REST_Server extends WP_REST_Server {
public $sent_headers = array();
public $sent_body = '';
public $last_request = null;
/**
* Get the raw $endpoints data from the server
@ -29,6 +30,17 @@ class Spy_REST_Server extends WP_REST_Server {
$this->sent_headers[ $header ] = $value;
}
/**
* Override the dispatch method so we can get a handle on the request object.
*
* @param WP_REST_Request $request
* @return WP_REST_Response Response returned by the callback.
*/
public function dispatch( $request ) {
$this->last_request = $request;
return parent::dispatch( $request );
}
public function serve_request( $path = null ) {
ob_start();

127
tests/phpunit/tests/rest-api/rest-server.php
View File

@ -743,6 +743,133 @@ class Tests_REST_Server extends WP_Test_REST_TestCase {
}
}
public function test_serve_request_url_params_are_unslashed() {
$this->server->register_route( 'test', '/test/(?P<data>.*)', array(
array(
'methods' => WP_REST_Server::READABLE,
'callback' => '__return_false',
'args' => array(
'data' => array(),
),
),
) );
$result = $this->server->serve_request( '/test/data\\with\\slashes' );
$url_params = $this->server->last_request->get_url_params();
$this->assertEquals( 'data\\with\\slashes', $url_params['data'] );
}
public function test_serve_request_query_params_are_unslashed() {
$this->server->register_route( 'test', '/test', array(
array(
'methods' => WP_REST_Server::READABLE,
'callback' => '__return_false',
'args' => array(
'data' => array(),
),
),
) );
// WordPress internally will slash the superglobals on bootstrap
$_GET = wp_slash( array(
'data' => 'data\\with\\slashes',
) );
$result = $this->server->serve_request( '/test' );
$query_params = $this->server->last_request->get_query_params();
$this->assertEquals( 'data\\with\\slashes', $query_params['data'] );
}
public function test_serve_request_body_params_are_unslashed() {
$this->server->register_route( 'test', '/test', array(
array(
'methods' => WP_REST_Server::READABLE,
'callback' => '__return_false',
'args' => array(
'data' => array(),
),
),
) );
// WordPress internally will slash the superglobals on bootstrap
$_POST = wp_slash( array(
'data' => 'data\\with\\slashes',
) );
$result = $this->server->serve_request( '/test/data' );
$body_params = $this->server->last_request->get_body_params();
$this->assertEquals( 'data\\with\\slashes', $body_params['data'] );
}
public function test_serve_request_json_params_are_unslashed() {
$this->server->register_route( 'test', '/test', array(
array(
'methods' => WP_REST_Server::READABLE,
'callback' => '__return_false',
'args' => array(
'data' => array(),
),
),
) );
$_SERVER['HTTP_CONTENT_TYPE'] = 'application/json';
$GLOBALS['HTTP_RAW_POST_DATA'] = json_encode( array(
'data' => 'data\\with\\slashes',
) );
$result = $this->server->serve_request( '/test' );
$json_params = $this->server->last_request->get_json_params();
$this->assertEquals( 'data\\with\\slashes', $json_params['data'] );
}
public function test_serve_request_file_params_are_unslashed() {
$this->server->register_route( 'test', '/test', array(
array(
'methods' => WP_REST_Server::READABLE,
'callback' => '__return_false',
'args' => array(
'data' => array(),
),
),
) );
// WordPress internally will slash the superglobals on bootstrap
$_FILES = array(
'data' => array(
'name' => 'data\\with\\slashes',
),
);
$result = $this->server->serve_request( '/test/data\\with\\slashes' );
$file_params = $this->server->last_request->get_file_params();
$this->assertEquals( 'data\\with\\slashes', $file_params['data']['name'] );
}
public function test_serve_request_headers_are_unslashed() {
$this->server->register_route( 'test', '/test', array(
array(
'methods' => WP_REST_Server::READABLE,
'callback' => '__return_false',
'args' => array(
'data' => array(),
),
),
) );
// WordPress internally will slash the superglobals on bootstrap
$_SERVER['HTTP_X_MY_HEADER'] = wp_slash( 'data\\with\\slashes' );
$result = $this->server->serve_request( '/test/data\\with\\slashes' );
$this->assertEquals( 'data\\with\\slashes', $this->server->last_request->get_header( 'x_my_header') );
}
public function filter_wp_rest_server_class() {
return 'Spy_REST_Server';
}