REST API: Ensure args is an array of arrays in register_rest_route().

When calling `register_rest_route()`, the `args` parameter for a route should be an array of arrays.  However, some plugins/themes have passed an array of strings or key-value pairs which produces a PHP warning when `array_intersect_key` is used to filter the array keys based on an allowed list of schema keywords.

This change adds a check of the `args` parameter to ensure it's an array of arrays, presenting a `_doing_it_wrong` if any element of `args` is not an array and restructuring to an array of arrays.  This change also adds a unit test for the incorrect usage described above, expecting that a `_doing_it_wrong` is produced.

Props slaFFik, desrosj, apermo, AndrewNZ, aristath, poena, dovyp, timothyblynjacobs, Hinjiriyo, johnmark8080, nateallen.
Fixes #51986.

git-svn-id: https://develop.svn.wordpress.org/trunk@54339 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
David Baumwald
2022-09-27 20:12:00 +00:00
parent af33442c3a
commit 6c17b0335f
3 changed files with 36 additions and 0 deletions
@@ -1513,6 +1513,11 @@ class WP_REST_Server {
$endpoint_data['args'] = array();
foreach ( $callback['args'] as $key => $opts ) {
if ( is_string( $opts ) ) {
$opts = array( $opts => 0 );
} elseif ( ! is_array( $opts ) ) {
$opts = array();
}
$arg_data = array_intersect_key( $opts, $allowed_schema_keywords );
$arg_data['required'] = ! empty( $opts['required'] );