From 0b6f00fde269c38acc42de281ac223dfb71d3553 Mon Sep 17 00:00:00 2001 From: "K. Adam White" Date: Thu, 25 Apr 2019 00:08:52 +0000 Subject: [PATCH] REST API: Always urlencode_deep() query args in get_items methods. Passing all received query arguments through urlencode_deep ensures that the full set of query arguments are encoded in the same way. Props dmsnell. Fixes #46199 Built from https://develop.svn.wordpress.org/trunk@45267 git-svn-id: http://core.svn.wordpress.org/trunk@45076 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- .../rest-api/endpoints/class-wp-rest-comments-controller.php | 2 +- .../rest-api/endpoints/class-wp-rest-posts-controller.php | 2 +- .../rest-api/endpoints/class-wp-rest-revisions-controller.php | 2 +- .../rest-api/endpoints/class-wp-rest-search-controller.php | 2 +- .../rest-api/endpoints/class-wp-rest-terms-controller.php | 2 +- .../rest-api/endpoints/class-wp-rest-users-controller.php | 2 +- wp-includes/version.php | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php b/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php index f673450d41..8fafc20e80 100644 --- a/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php +++ b/wp-includes/rest-api/endpoints/class-wp-rest-comments-controller.php @@ -285,7 +285,7 @@ class WP_REST_Comments_Controller extends WP_REST_Controller { $response->header( 'X-WP-Total', $total_comments ); $response->header( 'X-WP-TotalPages', $max_pages ); - $base = add_query_arg( $request->get_query_params(), rest_url( sprintf( '%s/%s', $this->namespace, $this->rest_base ) ) ); + $base = add_query_arg( urlencode_deep( $request->get_query_params() ), rest_url( sprintf( '%s/%s', $this->namespace, $this->rest_base ) ) ); if ( $request['page'] > 1 ) { $prev_page = $request['page'] - 1; diff --git a/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php b/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php index 0e3489c183..f24bc068c8 100644 --- a/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php +++ b/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php @@ -343,7 +343,7 @@ class WP_REST_Posts_Controller extends WP_REST_Controller { $response->header( 'X-WP-TotalPages', (int) $max_pages ); $request_params = $request->get_query_params(); - $base = add_query_arg( $request_params, rest_url( sprintf( '%s/%s', $this->namespace, $this->rest_base ) ) ); + $base = add_query_arg( urlencode_deep( $request_params ), rest_url( sprintf( '%s/%s', $this->namespace, $this->rest_base ) ) ); if ( $page > 1 ) { $prev_page = $page - 1; diff --git a/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php b/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php index 5bdbb73df0..52df0f2206 100644 --- a/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php +++ b/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php @@ -301,7 +301,7 @@ class WP_REST_Revisions_Controller extends WP_REST_Controller { $response->header( 'X-WP-TotalPages', (int) $max_pages ); $request_params = $request->get_query_params(); - $base = add_query_arg( $request_params, rest_url( sprintf( '%s/%s/%d/%s', $this->namespace, $this->parent_base, $request['parent'], $this->rest_base ) ) ); + $base = add_query_arg( urlencode_deep( $request_params ), rest_url( sprintf( '%s/%s/%d/%s', $this->namespace, $this->parent_base, $request['parent'], $this->rest_base ) ) ); if ( $page > 1 ) { $prev_page = $page - 1; diff --git a/wp-includes/rest-api/endpoints/class-wp-rest-search-controller.php b/wp-includes/rest-api/endpoints/class-wp-rest-search-controller.php index 8aaf9c6476..299029b1c3 100644 --- a/wp-includes/rest-api/endpoints/class-wp-rest-search-controller.php +++ b/wp-includes/rest-api/endpoints/class-wp-rest-search-controller.php @@ -155,7 +155,7 @@ class WP_REST_Search_Controller extends WP_REST_Controller { $response->header( 'X-WP-TotalPages', $max_pages ); $request_params = $request->get_query_params(); - $base = add_query_arg( $request_params, rest_url( sprintf( '%s/%s', $this->namespace, $this->rest_base ) ) ); + $base = add_query_arg( urlencode_deep( $request_params ), rest_url( sprintf( '%s/%s', $this->namespace, $this->rest_base ) ) ); if ( $page > 1 ) { $prev_link = add_query_arg( 'page', $page - 1, $base ); diff --git a/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php b/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php index 527a8bc199..f4751eb205 100644 --- a/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php +++ b/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php @@ -282,7 +282,7 @@ class WP_REST_Terms_Controller extends WP_REST_Controller { $response->header( 'X-WP-TotalPages', (int) $max_pages ); - $base = add_query_arg( $request->get_query_params(), rest_url( $this->namespace . '/' . $this->rest_base ) ); + $base = add_query_arg( urlencode_deep( $request->get_query_params() ), rest_url( $this->namespace . '/' . $this->rest_base ) ); if ( $page > 1 ) { $prev_page = $page - 1; diff --git a/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php b/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php index 207198e54c..8aab4ca5ad 100644 --- a/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php +++ b/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php @@ -329,7 +329,7 @@ class WP_REST_Users_Controller extends WP_REST_Controller { $response->header( 'X-WP-TotalPages', (int) $max_pages ); - $base = add_query_arg( $request->get_query_params(), rest_url( sprintf( '%s/%s', $this->namespace, $this->rest_base ) ) ); + $base = add_query_arg( urlencode_deep( $request->get_query_params() ), rest_url( sprintf( '%s/%s', $this->namespace, $this->rest_base ) ) ); if ( $page > 1 ) { $prev_page = $page - 1; diff --git a/wp-includes/version.php b/wp-includes/version.php index b9ec14093f..db1c43e05f 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -13,7 +13,7 @@ * * @global string $wp_version */ -$wp_version = '5.2-beta3-45266'; +$wp_version = '5.2-beta3-45267'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.