Changeset 48437

Timestamp:

07/11/2020 08:32:19 PM (4 years ago)

Author:

TimothyBlynJacobs

Message:

REST API: Sanitize block renderer attributes.

In [48069] the Block Renderer was changed to register a single route for all dynamic blocks. Validation was dynamically applied based on the requested block, but sanitization was not. This commit adds the same sanitization back to the block attributes.

Props manooweb.
Fixes #50620. See #48079.

Location:

trunk

Files:

• package-lock.json (modified) (3 diffs)
• src/wp-includes/rest-api/endpoints/class-wp-rest-block-renderer-controller.php (modified) (1 diff)
• tests/phpunit/tests/rest-api/rest-block-renderer-controller.php (modified) (5 diffs)

trunk/package-lock.json

@@ -5940 +5940 @@
                 "kind-of": {
                     "version": "6.0.2",
-                    "resolved": "",
+                    "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz",
+                    "integrity": "sha512-s5kLOcnH0XqDO+FvuaLX8DDjZ18CGFk7VygH40QoKPUQhW4e2rvM0rwUq0t8IQDOwYSeLK01U90OjzBTme2QqA==",
                     "dev": true
                 }
@@ -10567 +10568 @@
                 "kind-of": {
                     "version": "6.0.2",
-                    "resolved": "",
+                    "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz",
+                    "integrity": "sha512-s5kLOcnH0XqDO+FvuaLX8DDjZ18CGFk7VygH40QoKPUQhW4e2rvM0rwUq0t8IQDOwYSeLK01U90OjzBTme2QqA==",
                     "dev": true
                 }
@@ -23585 +23587 @@
                 "kind-of": {
                     "version": "6.0.2",
-                    "resolved": "",
+                    "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz",
+                    "integrity": "sha512-s5kLOcnH0XqDO+FvuaLX8DDjZ18CGFk7VygH40QoKPUQhW4e2rvM0rwUq0t8IQDOwYSeLK01U90OjzBTme2QqA==",
                     "dev": true
                 }

trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-block-renderer-controller.php

@@ -71 +71 @@
                                 return rest_validate_value_from_schema( $value, $schema );
                             },
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
                         ),
                         'post_id'    => array(

trunk/tests/phpunit/tests/rest-api/rest-block-renderer-controller.php

@@ -57 +57 @@
 
     /**
+
+
+
+
+
+
+
+
+
      * Test API user's ID.
      *
@@ -128 +137 @@
         $this->register_post_context_test_block();
         $this->register_non_dynamic_block();
+
         parent::setUp();
     }
@@ -140 +150 @@
         WP_Block_Type_Registry::get_instance()->unregister( self::$context_block_name );
         WP_Block_Type_Registry::get_instance()->unregister( self::$non_dynamic_block_name );
+
         parent::tearDown();
     }
@@ -197 +208 @@
 
     /**
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
      * Test render callback.
      *
@@ -524 +559 @@
 
     /**
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
      * Get item schema.
      *