wordpress-develop/tests/phpunit/tests/rest-api
Timothy Jacobs 74cc64d74e REST API: Issue a _doing_it_wrong when registering a route without a permission callback.
The REST API treats routes without a permission_callback as public. Because this happens without any warning to the user, if the permission callback is unintentionally omitted or misspelled, the endpoint can end up being available to the public. Such a scenario has happened multiple times in the wild, and the results can be catostrophic when it occurs.

For REST API routes that are intended to be public, it is recommended to set the permission callback to the `__return_true` built in function.

Fixes #50075.
Props rmccue, sorenbronsted, whyisjake, SergeyBiryukov, TimothyBlynJacobs.


git-svn-id: https://develop.svn.wordpress.org/trunk@48526 602fd350-edb4-49c9-b593-d223f7449a82
2020-07-21 12:01:10 +00:00
..
json_schema_test_suite REST API: Add support for the uniqueItems keyword. 2020-07-07 03:20:34 +00:00
rest-attachments-controller.php Code Formatting: Fix some formatting around WP_REST_Attachments_Controller tests. 2020-07-16 22:09:35 +00:00
rest-autosaves-controller.php Tests: Replace use of $this->server with rest_get_server() in test_registered_query_params(). 2018-12-17 01:24:36 +00:00
rest-block-directory-controller.php Tests: Correct hardcoded "3 months ago" assertion in tests/rest-api/rest-block-directory-controller.php. 2020-07-06 09:49:07 +00:00
rest-block-renderer-controller.php REST API: Sanitize block renderer attributes. 2020-07-11 20:32:19 +00:00
rest-block-type-controller.php REST API: Introduce Block Types endpoint. 2020-06-26 00:44:44 +00:00
rest-blocks-controller.php REST API: Always include title.raw/content.raw for Blocks in context=view. 2018-12-17 17:21:05 +00:00
rest-categories-controller.php Docs: Improve inline comments per the documentation standards. 2020-01-29 00:43:23 +00:00
rest-comments-controller.php Tests: Place remove_filter() calls for _wp_update_comment_data_filter() before the assertions, for consistency with other tests. 2020-06-30 12:27:05 +00:00
rest-controller.php REST API: Support the (min|max)Items JSON Schema keywords. 2020-06-07 22:40:16 +00:00
rest-pages-controller.php Docs: Improve inline comments per the documentation standards. 2020-01-29 00:43:23 +00:00
rest-plugins-controller.php REST API: Make plugin installation tests more robust on alternate test environments. 2020-07-21 01:36:16 +00:00
rest-post-meta-fields.php REST API, Meta: Introduce support for default metadata values. 2020-07-07 20:45:55 +00:00
rest-post-statuses-controller.php Docs: Improve inline comments per the documentation standards. 2020-01-29 00:43:23 +00:00
rest-post-types-controller.php Docs: Improve inline comments per the documentation standards. 2020-01-29 00:43:23 +00:00
rest-posts-controller.php Docs: Spell "falsey" in a consistent way. 2020-07-02 11:28:13 +00:00
rest-request-validation.php Coding Standards: Upgrade WPCS to 1.0.0 2018-08-17 01:50:26 +00:00
rest-request.php REST API: Handle parameter types consistently within set_param(). 2020-04-09 19:28:58 +00:00
rest-revisions-controller.php REST API: Fix revisions controller get_item permission check. 2020-04-03 19:38:15 +00:00
rest-schema-sanitization.php REST API: Add support for the uniqueItems keyword. 2020-07-07 03:20:34 +00:00
rest-schema-setup.php Tests: Replace hardcoded /tmp/ references with get_temp_dir(). 2020-07-14 01:28:17 +00:00
rest-schema-validation.php Docs: Miscellaneous DocBlock corrections. 2020-07-07 09:28:19 +00:00
rest-search-controller.php REST API: Permit embedding of the 'self' link relation in the /search endpoint. 2019-10-08 04:43:10 +00:00
rest-server.php REST API: Issue a _doing_it_wrong when registering a route without a permission callback. 2020-07-21 12:01:10 +00:00
rest-settings-controller.php REST API: Warn if registering array settings without an items schema. 2020-02-19 22:54:03 +00:00
rest-tags-controller.php Docs: Improve inline comments per the documentation standards. 2020-01-29 00:43:23 +00:00
rest-taxonomies-controller.php REST API: Link to the REST route for the currently queried resource. 2020-07-02 05:55:04 +00:00
rest-term-meta-fields.php REST API, Meta: Introduce support for default metadata values. 2020-07-07 20:45:55 +00:00
rest-test-controller.php REST API: Support the (min|max)Items JSON Schema keywords. 2020-06-07 22:40:16 +00:00
rest-themes-controller.php Themes: Introduce register_theme_feature API. 2020-06-25 22:11:09 +00:00
rest-users-controller.php REST API, Meta: Introduce support for default metadata values. 2020-07-07 20:45:55 +00:00