vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-11 20:30:23 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

REST API: Allow sidebars and their widgets to be public.

Browse Source 
By default, only users with the `edit_theme_options` capability can access the sidebars and widgets REST API endpoints. In this commit, A new `show_in_rest` parameter is added to the `register_sidebar` function. When enabled, all users will be able to access that sidebar and any widgets belonging to that sidebar.

This commit reduces the `context` for a widget's `instance` information to only `edit`. This is to ensure that internal widget data is not inadvertently exposed to the public. A future ticket may expose additional APIs to allow widget authors to indicate that their instance data can be safely exposed. REST API consumers intending to access this `instance` information should take care to explicitly set the `context` parameter to `edit`.

Props spacedmonkey, zieladam.
Fixes #53915.


git-svn-id: https://develop.svn.wordpress.org/trunk@52016 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Timothy Jacobs
2021-11-05 02:14:07 +00:00
parent 4a67a9774a
commit 827dd20997
6 changed files with 445 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/phpunit/tests/rest-api/rest-sidebars-controller.php
+143
View File
@@ -164,6 +164,102 @@ class WP_Test_REST_Sidebars_Controller extends WP_Test_REST_Controller_Testcase
$this->assertErrorResponse( 'rest_cannot_manage_widgets', $response, 401 );
}
/**
* @ticket 53915
*/
public function test_get_items_no_permission_show_in_rest() {
$this->setup_sidebar(
'sidebar-1',
array(
'name' => 'Test sidebar',
'show_in_rest' => true,
)
);
wp_set_current_user( 0 );
$request = new WP_REST_Request( 'GET', '/wp/v2/sidebars' );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$data = $this->remove_links( $data );
$this->assertSame(
array(
array(
'id' => 'sidebar-1',
'name' => 'Test sidebar',
'description' => '',
'class' => '',
'before_widget' => '',
'after_widget' => '',
'before_title' => '',
'after_title' => '',
'status' => 'active',
'widgets' => array(),
),
),
$data
);
}
/**
* @ticket 53915
*/
public function test_get_items_without_show_in_rest_are_removed_from_the_list() {
$this->setup_sidebar(
'sidebar-1',
array(
'name' => 'Test sidebar 1',
'show_in_rest' => true,
)
);
$this->setup_sidebar(
'sidebar-2',
array(
'name' => 'Test sidebar 2',
'show_in_rest' => false,
)
);
$this->setup_sidebar(
'sidebar-3',
array(
'name' => 'Test sidebar 3',
'show_in_rest' => true,
)
);
wp_set_current_user( self::$author_id );
$request = new WP_REST_Request( 'GET', '/wp/v2/sidebars' );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$data = $this->remove_links( $data );
$this->assertSame(
array(
array(
'id' => 'sidebar-1',
'name' => 'Test sidebar 1',
'description' => '',
'class' => '',
'before_widget' => '',
'after_widget' => '',
'before_title' => '',
'after_title' => '',
'status' => 'active',
'widgets' => array(),
),
array(
'id' => 'sidebar-3',
'name' => 'Test sidebar 3',
'description' => '',
'class' => '',
'before_widget' => '',
'after_widget' => '',
'before_title' => '',
'after_title' => '',
'status' => 'active',
'widgets' => array(),
),
),
$data
);
}
/**
* @ticket 41683
*/
@@ -191,6 +287,18 @@ class WP_Test_REST_Sidebars_Controller extends WP_Test_REST_Controller_Testcase
$data = $this->remove_links( $data );
$this->assertSame(
array(
array(
'id' => 'wp_inactive_widgets',
'name' => 'Inactive widgets',
'description' => '',
'class' => '',
'before_widget' => '',
'after_widget' => '',
'before_title' => '',
'after_title' => '',
'status' => 'inactive',
'widgets' => array(),
),
array(
'id' => 'sidebar-1',
'name' => 'Test sidebar',
@@ -206,6 +314,7 @@ class WP_Test_REST_Sidebars_Controller extends WP_Test_REST_Controller_Testcase
),
$data
);
}
/**
@@ -412,6 +521,40 @@ class WP_Test_REST_Sidebars_Controller extends WP_Test_REST_Controller_Testcase
$this->assertErrorResponse( 'rest_cannot_manage_widgets', $response, 401 );
}
/**
* @ticket 41683
*/
public function test_get_item_no_permission_public() {
wp_set_current_user( 0 );
$this->setup_sidebar(
'sidebar-1',
array(
'name' => 'Test sidebar',
'show_in_rest' => true,
)
);
$request = new WP_REST_Request( 'GET', '/wp/v2/sidebars/sidebar-1' );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$data = $this->remove_links( $data );
$this->assertSame(
array(
'id' => 'sidebar-1',
'name' => 'Test sidebar',
'description' => '',
'class' => '',
'before_widget' => '',
'after_widget' => '',
'before_title' => '',
'after_title' => '',
'status' => 'active',
'widgets' => array(),
),
$data
);
}
/**
* @ticket 41683
*/
tests/phpunit/tests/rest-api/rest-widgets-controller.php
+130 -57
View File
@@ -240,6 +240,100 @@ class WP_Test_REST_Widgets_Controller extends WP_Test_REST_Controller_Testcase {
$this->assertErrorResponse( 'rest_cannot_manage_widgets', $response, 401 );
}
/**
* @ticket 53915
*/
public function test_get_items_no_permission_show_in_rest() {
$this->setup_widget(
'text',
1,
array(
'text' => 'Custom text test',
)
);
$this->setup_sidebar(
'sidebar-1',
array(
'name' => 'Test sidebar',
'show_in_rest' => true,
),
array( 'text-1', 'testwidget' )
);
$request = new WP_REST_Request( 'GET', '/wp/v2/widgets' );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$data = $this->remove_links( $data );
$this->assertSameIgnoreEOL(
array(
array(
'id' => 'text-1',
'id_base' => 'text',
'sidebar' => 'sidebar-1',
'rendered' => '<div class="textwidget">Custom text test</div>',
),
array(
'id' => 'testwidget',
'id_base' => 'testwidget',
'sidebar' => 'sidebar-1',
'rendered' => '<h1>Default id</h1><span>Default text</span>',
),
),
$data
);
}
/**
* @ticket 53915
*/
public function test_get_items_without_show_in_rest_are_removed_from_the_list() {
wp_set_current_user( self::$author_id );
$this->setup_widget(
'text',
1,
array(
'text' => 'Custom text test',
)
);
$this->setup_sidebar(
'sidebar-1',
array(
'name' => 'Test sidebar 1',
'show_in_rest' => true,
),
array( 'text-1', 'testwidget' )
);
$this->setup_sidebar(
'sidebar-2',
array(
'name' => 'Test sidebar 2',
'show_in_rest' => false,
),
array( 'text-1', 'testwidget' )
);
$request = new WP_REST_Request( 'GET', '/wp/v2/widgets' );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$data = $this->remove_links( $data );
$this->assertSameIgnoreEOL(
array(
array(
'id' => 'text-1',
'id_base' => 'text',
'sidebar' => 'sidebar-1',
'rendered' => '<div class="textwidget">Custom text test</div>',
),
array(
'id' => 'testwidget',
'id_base' => 'testwidget',
'sidebar' => 'sidebar-1',
'rendered' => '<h1>Default id</h1><span>Default text</span>',
),
),
$data
);
}
/**
* @ticket 41683
*/
@@ -295,56 +389,18 @@ class WP_Test_REST_Widgets_Controller extends WP_Test_REST_Controller_Testcase {
'id_base' => 'block',
'sidebar' => 'sidebar-1',
'rendered' => '<p>Block test</p>',
'instance' => array(
'encoded' => base64_encode(
serialize(
array(
'content' => $block_content,
)
)
),
'hash' => wp_hash(
serialize(
array(
'content' => $block_content,
)
)
),
'raw' => array(
'content' => $block_content,
),
),
),
array(
'id' => 'rss-1',
'id_base' => 'rss',
'sidebar' => 'sidebar-1',
'rendered' => '<a class="rsswidget" href="https://wordpress.org/news/feed"><img class="rss-widget-icon" style="border:0" width="14" height="14" src="http://example.org/wp-includes/images/rss.png" alt="RSS" /></a> <a class="rsswidget" href="https://wordpress.org/news">RSS test</a><ul><li><a class=\'rsswidget\' href=\'https://wordpress.org/news/2020/12/introducing-learn-wordpress/\'>Introducing Learn WordPress</a></li><li><a class=\'rsswidget\' href=\'https://wordpress.org/news/2020/12/simone/\'>WordPress 5.6 “Simone”</a></li><li><a class=\'rsswidget\' href=\'https://wordpress.org/news/2020/12/state-of-the-word-2020/\'>State of the Word 2020</a></li><li><a class=\'rsswidget\' href=\'https://wordpress.org/news/2020/12/the-month-in-wordpress-november-2020/\'>The Month in WordPress: November 2020</a></li><li><a class=\'rsswidget\' href=\'https://wordpress.org/news/2020/12/wordpress-5-6-release-candidate-2/\'>WordPress 5.6 Release Candidate 2</a></li><li><a class=\'rsswidget\' href=\'https://wordpress.org/news/2020/11/wordpress-5-6-release-candidate/\'>WordPress 5.6 Release Candidate</a></li><li><a class=\'rsswidget\' href=\'https://wordpress.org/news/2020/11/wordpress-5-6-beta-4/\'>WordPress 5.6 Beta 4</a></li><li><a class=\'rsswidget\' href=\'https://wordpress.org/news/2020/11/wordpress-5-6-beta-3/\'>WordPress 5.6 Beta 3</a></li><li><a class=\'rsswidget\' href=\'https://wordpress.org/news/2020/11/the-month-in-wordpress-october-2020/\'>The Month in WordPress: October 2020</a></li><li><a class=\'rsswidget\' href=\'https://wordpress.org/news/2020/10/wordpress-5-5-3-maintenance-release/\'>WordPress 5.5.3 Maintenance Release</a></li></ul>',
'instance' => array(
'encoded' => base64_encode(
serialize(
array(
'title' => 'RSS test',
'url' => 'https://wordpress.org/news/feed',
)
)
),
'hash' => wp_hash(
serialize(
array(
'title' => 'RSS test',
'url' => 'https://wordpress.org/news/feed',
)
)
),
),
),
array(
'id' => 'testwidget',
'id_base' => 'testwidget',
'sidebar' => 'sidebar-1',
'rendered' => '<h1>Default id</h1><span>Default text</span>',
'instance' => null,
),
),
$data
@@ -469,25 +525,6 @@ class WP_Test_REST_Widgets_Controller extends WP_Test_REST_Controller_Testcase {
'id_base' => 'text',
'sidebar' => 'sidebar-1',
'rendered' => '<div class="textwidget">Custom text test</div>',
'instance' => array(
'encoded' => base64_encode(
serialize(
array(
'text' => 'Custom text test',
)
)
),
'hash' => wp_hash(
serialize(
array(
'text' => 'Custom text test',
)
)
),
'raw' => array(
'text' => 'Custom text test',
),
),
),
$data
);
@@ -543,6 +580,42 @@ class WP_Test_REST_Widgets_Controller extends WP_Test_REST_Controller_Testcase {
$this->assertErrorResponse( 'rest_cannot_manage_widgets', $response, 403 );
}
/**
* @ticket 53915
*/
public function test_get_item_no_permission_show_in_rest() {
wp_set_current_user( 0 );
$this->setup_widget(
'text',
1,
array(
'text' => 'Custom text test',
)
);
$this->setup_sidebar(
'sidebar-1',
array(
'name' => 'Test sidebar',
'show_in_rest' => true,
),
array( 'text-1' )
);
$request = new WP_REST_Request( 'GET', '/wp/v2/widgets/text-1' );
$response = rest_get_server()->dispatch( $request );
$data = $response->get_data();
$this->assertSameSets(
array(
'id' => 'text-1',
'id_base' => 'text',
'sidebar' => 'sidebar-1',
'rendered' => '<div class="textwidget">Custom text test</div>',
),
$data
);
}
/**
* @ticket 41683
*/