vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-10-06 23:58:03 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

REST API: Allow sidebars and their widgets to be public.

Browse Source 
By default, only users with the `edit_theme_options` capability can access the sidebars and widgets REST API endpoints. In this commit, A new `show_in_rest` parameter is added to the `register_sidebar` function. When enabled, all users will be able to access that sidebar and any widgets belonging to that sidebar.

This commit reduces the `context` for a widget's `instance` information to only `edit`. This is to ensure that internal widget data is not inadvertently exposed to the public. A future ticket may expose additional APIs to allow widget authors to indicate that their instance data can be safely exposed. REST API consumers intending to access this `instance` information should take care to explicitly set the `context` parameter to `edit`.

Props spacedmonkey, zieladam.
Fixes #53915.


git-svn-id: https://develop.svn.wordpress.org/trunk@52016 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Timothy Jacobs
2021-11-05 02:14:07 +00:00
parent 4a67a9774a
commit 827dd20997
6 changed files with 445 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/wp-includes/rest-api/endpoints/class-wp-rest-widgets-controller.php
+70 -11
View File
@@ -16,6 +16,14 @@
*/
class WP_REST_Widgets_Controller extends WP_REST_Controller {
/**
* Tracks whether {@see retrieve_widgets()} has been called in the current request.
*
* @since 5.9.0
* @var bool
*/
protected $widgets_retrieved = false;
/**
* Widgets controller constructor.
*
@@ -97,6 +105,17 @@ class WP_REST_Widgets_Controller extends WP_REST_Controller {
* @return true|WP_Error True if the request has read access, WP_Error object otherwise.
*/
public function get_items_permissions_check( $request ) {
$this->retrieve_widgets();
if ( isset( $request['sidebar'] ) && $this->check_read_sidebar_permission( $request['sidebar'] ) ) {
return true;
}
foreach ( wp_get_sidebars_widgets() as $sidebar_id => $widget_ids ) {
if ( $this->check_read_sidebar_permission( $sidebar_id ) ) {
return true;
}
}
return $this->permissions_check( $request );
}
@@ -109,15 +128,20 @@ class WP_REST_Widgets_Controller extends WP_REST_Controller {
* @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
*/
public function get_items( $request ) {
retrieve_widgets();
$this->retrieve_widgets();
$prepared = array();
$prepared = array();
$permissions_check = $this->permissions_check( $request );
foreach ( wp_get_sidebars_widgets() as $sidebar_id => $widget_ids ) {
if ( isset( $request['sidebar'] ) && $sidebar_id !== $request['sidebar'] ) {
continue;
}
if ( is_wp_error( $permissions_check ) && ! $this->check_read_sidebar_permission( $sidebar_id ) ) {
continue;
}
foreach ( $widget_ids as $widget_id ) {
$response = $this->prepare_item_for_response( compact( 'sidebar_id', 'widget_id' ), $request );
@@ -139,9 +163,32 @@ class WP_REST_Widgets_Controller extends WP_REST_Controller {
* @return true|WP_Error True if the request has read access, WP_Error object otherwise.
*/
public function get_item_permissions_check( $request ) {
$this->retrieve_widgets();
$widget_id = $request['id'];
$sidebar_id = wp_find_widgets_sidebar( $widget_id );
if ( $sidebar_id && $this->check_read_sidebar_permission( $sidebar_id ) ) {
return true;
}
return $this->permissions_check( $request );
}
/**
* Checks if a sidebar can be read publicly.
*
* @since 5.9.0
*
* @param string $sidebar_id The sidebar id.
* @return bool Whether the sidebar can be read.
*/
protected function check_read_sidebar_permission( $sidebar_id ) {
$sidebar = wp_get_sidebar( $sidebar_id );
return ! empty( $sidebar['show_in_rest'] );
}
/**
* Gets an individual widget.
*
@@ -151,7 +198,7 @@ class WP_REST_Widgets_Controller extends WP_REST_Controller {
* @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
*/
public function get_item( $request ) {
retrieve_widgets();
$this->retrieve_widgets();
$widget_id = $request['id'];
$sidebar_id = wp_find_widgets_sidebar( $widget_id );
@@ -247,8 +294,7 @@ class WP_REST_Widgets_Controller extends WP_REST_Controller {
* See https://core.trac.wordpress.org/ticket/53657.
*/
wp_get_sidebars_widgets();
retrieve_widgets();
$this->retrieve_widgets();
$widget_id = $request['id'];
$sidebar_id = wp_find_widgets_sidebar( $widget_id );
@@ -323,8 +369,7 @@ class WP_REST_Widgets_Controller extends WP_REST_Controller {
* See https://core.trac.wordpress.org/ticket/53657.
*/
wp_get_sidebars_widgets();
retrieve_widgets();
$this->retrieve_widgets();
$widget_id = $request['id'];
$sidebar_id = wp_find_widgets_sidebar( $widget_id );
@@ -439,6 +484,20 @@ class WP_REST_Widgets_Controller extends WP_REST_Controller {
return true;
}
/**
* Looks for "lost" widgets once per request.
*
* @since 5.9.0
*
* @see retrieve_widgets()
*/
protected function retrieve_widgets() {
if ( ! $this->widgets_retrieved ) {
retrieve_widgets();
$this->widgets_retrieved = true;
}
}
/**
* Saves the widget in the request object.
*
@@ -767,23 +826,23 @@ class WP_REST_Widgets_Controller extends WP_REST_Controller {
'instance' => array(
'description' => __( 'Instance settings of the widget, if supported.' ),
'type' => 'object',
'context' => array( 'view', 'edit', 'embed' ),
'context' => array( 'edit' ),
'default' => null,
'properties' => array(
'encoded' => array(
'description' => __( 'Base64 encoded representation of the instance settings.' ),
'type' => 'string',
'context' => array( 'view', 'edit', 'embed' ),
'context' => array( 'edit' ),
),
'hash' => array(
'description' => __( 'Cryptographic hash of the instance settings.' ),
'type' => 'string',
'context' => array( 'view', 'edit', 'embed' ),
'context' => array( 'edit' ),
),
'raw' => array(
'description' => __( 'Unencoded instance settings, if supported.' ),
'type' => 'object',
'context' => array( 'view', 'edit', 'embed' ),
'context' => array( 'edit' ),
),
),
),