sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

REST API: Exclude numeric parameters from regex parsing

Browse Source 
The list of endpoint parameters should only include explicitly named and requested parameters.

Props flixos90, rmccue, jnylen0.
Fixes #40704.


git-svn-id: https://develop.svn.wordpress.org/trunk@41223 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
James Nylen 2017-08-03 19:54:56 +00:00
parent 4f4b7fd8d1
commit da5ece4d6d
2 changed files with 25 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/wp-includes/rest-api/class-wp-rest-server.php
View File

@ -824,12 +824,19 @@ class WP_REST_Server {
$path = $request->get_route(); $path = $request->get_route();
foreach ( $this->get_routes() as $route => $handlers ) { foreach ( $this->get_routes() as $route => $handlers ) {
$match = preg_match( '@^' . $route . '$@i', $path, $args ); $match = preg_match( '@^' . $route . '$@i', $path, $matches );
if ( ! $match ) { if ( ! $match ) {
continue; continue;
} }
$args = array();
foreach ( $matches as $param => $value ) {
if ( ! is_int( $param ) ) {
$args[ $param ] = $value;
}
}
foreach ( $handlers as $handler ) { foreach ( $handlers as $handler ) {
$callback = $handler['callback']; $callback = $handler['callback'];
$response = null; $response = null;

17
tests/phpunit/tests/rest-api/rest-server.php
View File

@ -162,6 +162,23 @@ class Tests_REST_Server extends WP_Test_REST_TestCase {
$this->assertEquals( 200, $response->get_status() ); $this->assertEquals( 200, $response->get_status() );
} }
public function test_url_params_no_numeric_keys() {
$this->server->register_route( 'test', '/test/(?P<data>.*)', array(
array(
'methods' => WP_REST_Server::READABLE,
'callback' => '__return_false',
'args' => array(
'data' => array(),
),
),
) );
$request = new WP_REST_Request( 'GET', '/test/some-value' );
$this->server->dispatch( $request );
$this->assertEquals( array( 'data' => 'some-value' ), $request->get_params() );
}
/** /**
* Pass a capability which the user does not have, this should * Pass a capability which the user does not have, this should
* result in a 403 error. * result in a 403 error.