From 5e383d8209840262bc57cb52e6b94a2b80855bef Mon Sep 17 00:00:00 2001 From: Jb Audras Date: Tue, 11 Oct 2022 13:23:49 +0000 Subject: [PATCH] Posts, Post Types: Ensure all entries in the list returned by `wp_parse_list()` are scalar. This changeset fixes a warning where `strip_tags()` expected its first parameter to be a string rather than an array. It contains the following changes: - Removal of sanitize_callback to allow the REST API to handle the validation natively, this also causes the proper error to be output for `?slug[0][1]=2` that it's an invalid value. - Ensure that `wp_parse_list()` only returns a single-dimensioned array, even if passed a multi-dimension array, which fits the functions expected use case and resolves warnings in code that expects the function to return a single-dimensioned array. Props dd32, TimothyBlynJacobs. Fixes #55838. git-svn-id: https://develop.svn.wordpress.org/trunk@54476 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/functions.php | 3 +++ .../rest-api/endpoints/class-wp-rest-posts-controller.php | 1 - 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/src/wp-includes/functions.php b/src/wp-includes/functions.php index 77aaf718b1..56c36067bc 100644 --- a/src/wp-includes/functions.php +++ b/src/wp-includes/functions.php @@ -4821,6 +4821,9 @@ function wp_parse_list( $list ) { return preg_split( '/[\s,]+/', $list, -1, PREG_SPLIT_NO_EMPTY ); } + // Validate all entries of the list are scalar. + $list = array_filter( $list, 'is_scalar' ); + return $list; } diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php index 2b543be296..deb83c2f03 100644 --- a/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php +++ b/src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php @@ -2895,7 +2895,6 @@ class WP_REST_Posts_Controller extends WP_REST_Controller { 'items' => array( 'type' => 'string', ), - 'sanitize_callback' => 'wp_parse_slug_list', ); $query_params['status'] = array(