This changeset fixes a warning where `strip_tags()` expected its first parameter to be a string rather than an array. It contains the following changes:
- Removal of sanitize_callback to allow the REST API to handle the validation natively, this also causes the proper error to be output for `?slug[0][1]=2` that it's an invalid value.
- Ensure that `wp_parse_list()` only returns a single-dimensioned array, even if passed a multi-dimension array, which fits the functions expected use case and resolves warnings in code that expects the function to return a single-dimensioned array.
Props dd32, TimothyBlynJacobs.
Fixes#55838.
Built from https://develop.svn.wordpress.org/trunk@54476
git-svn-id: http://core.svn.wordpress.org/trunk@54035 1a063a9b-81f0-0310-95a4-ce76da25c4cd
When calling `register_rest_route()`, the `args` parameter for a route should be an array of arrays. However, some plugins/themes have passed an array of strings or key-value pairs which produces a PHP warning when `array_intersect_key` is used to filter the array keys based on an allowed list of schema keywords.
This change adds a check of the `args` parameter to ensure it's an array of arrays, presenting a `_doing_it_wrong` if any element of `args` is not an array and restructuring to an array of arrays. This change also adds a unit test for the incorrect usage described above, expecting that a `_doing_it_wrong` is produced.
Props slaFFik, desrosj, apermo, AndrewNZ, aristath, poena, dovyp, timothyblynjacobs, Hinjiriyo, johnmark8080, nateallen.
Fixes#51986.
Built from https://develop.svn.wordpress.org/trunk@54339
git-svn-id: http://core.svn.wordpress.org/trunk@53898 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Not all requests are accompanied by a `$request['email']`. This leads to a PHP 8.1 "passing null to non-nullable" deprecation notice when the `WP_REST_Users_Controller::update_item()` method passes a `null` email address onto `email_exists()`, which eventually reached the `WP_User::get_data_by()` method where things go wrong.
In the next condition in the code of the `WP_REST_Users_Controller::update_item()` method - `if ( $owner_id && $owner_id !== $id )` - you can see that the code already takes this into account as it will not throw a `WP_Error` if `$owner_id` is falsey.
`WP_User::get_data_by()` returns `false` for a failed field request. The other functions through which the return value is passed through, do the same.
So, by setting a default value for `$owner_id` of `false` and only checking `email_exists()` when there is an email to check, the "passing null to non-nullable" deprecation notice is bypassed without breaking BC.
Fixes a whole slew of test errors along the lines of:
{{{
6) WP_Test_REST_Users_Controller::test_update_item_en_US_locale
trim(): Passing null to parameter https://github.com/WordPress/wordpress-develop/pull/1 ($string) of type string is deprecated
/var/www/src/wp-includes/class-wp-user.php:211
/var/www/src/wp-includes/pluggable.php:105
/var/www/src/wp-includes/user.php:1953
/var/www/src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php:728
/var/www/src/wp-includes/rest-api/class-wp-rest-server.php:1143
/var/www/src/wp-includes/rest-api/class-wp-rest-server.php:990
/var/www/tests/phpunit/includes/spy-rest-server.php:67
/var/www/tests/phpunit/tests/rest-api/rest-users-controller.php:1719
/var/www/vendor/bin/phpunit:123
}}}
Follow-up to [44641], [38832].
Props jrf.
See #55656.
Built from https://develop.svn.wordpress.org/trunk@54317
git-svn-id: http://core.svn.wordpress.org/trunk@53876 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit improves site editor templates by:
* Adds a post meta `is_wp_suggestion` to templates created from the site editor.
Why? To differentiate the templates created from the post editor in the Template panel in inspector controls and the templates suggested in site editor.
See [https://github.com/WordPress/gutenberg/pull/41387 Gutenberg PR 41387] for more details.
* Expands the template types that can be added to the site editor to include single custom post type and specific posts templates.
See [https://github.com/WordPress/gutenberg/pull/41189 Gutenberg PR 41189] for more details.
* Adds fallback template content on creation in site editor:
* Introduces `get_template_hierarchy()` to get the template hierarchy for a given template slug to be created.
* Adds a `lookup` route to `WP_REST_Templates_Controller` to get the fallback template content.
See [https://github.com/WordPress/gutenberg/pull/42520 Gutenberg PR 42520] for more details.
* Fixes a typo in default category template's description within `get_default_block_template_types()`.
See [https://github.com/WordPress/gutenberg/pull/42586 Gutenberg PR 42586] for more details.
* Changes field checks from `in_array()` to `rest_is_field_included()` in `WP_REST_Post_Types_Controller`.
* Adds an `icon` field to `WP_REST_Post_Types_Controller`
Follow-up to [53129], [52331], [52275], [52062], [51962], [43087].
Props ntsekouras, spacedmonkey, mamaduka, mburridge, jameskoster, bernhard-reiter, mcsf, hellofromTonya.
See #56467.
Built from https://develop.svn.wordpress.org/trunk@54269
git-svn-id: http://core.svn.wordpress.org/trunk@53828 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Follow-up #54337, [52069]. Part of https://github.com/WordPress/gutenberg/issues/41236. More details in https://github.com/WordPress/gutenberg/issues/33542.
Allow passing more than one script per block for `editorScript`, `script`, and `viewScript` fields in the `block.json` metadata file. This aligns with the previously added changes for `style` and `editorStyle` fields.
This change impacts the `WP_Block_Type` class and the REST API endpoint for block types. To ensure backward compatibiliy old names were soft deprecated in favor of new fields that work with array values and have `_handles` suffix.
Props zieladam, dlh, timothyblynjacobs, aristath, bernhard-reiter.
Fixes#56408.
Built from https://develop.svn.wordpress.org/trunk@54155
git-svn-id: http://core.svn.wordpress.org/trunk@53714 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Dynamic (non-explicitly declared) properties are deprecated as of PHP 8.2 and are expected to become a fatal error in PHP 9.0.
There are a number of ways to mitigate this:
* If it is an accidental typo for a declared property: fix the typo.
* For known properties: declare them on the class.
* For unknown properties: add the magic `__get()`, `__set()`, et al. methods to the class or let the class extend `stdClass` which has highly optimized versions of these magic methods built in.
* For unknown ''use'' of dynamic properties, the `#[AllowDynamicProperties]` attribute can be added to the class. The attribute will automatically be inherited by child classes.
Trac ticket #56034 is open to investigate and handle the third and fourth type of situations, however it has become clear this will need more time and will not be ready in time for WP 6.1.
To reduce “noise” in the meantime, both in the error logs of WP users moving onto PHP 8.2, in the test run logs of WP itself, in test runs of plugins and themes, as well as to prevent duplicate tickets from being opened for the same issue, this commit adds the `#[AllowDynamicProperties]` attribute to all “parent” classes in WP.
The logic used for this commit is as follows:
* If a class already has the attribute: no action needed.
* If a class does not `extend`: add the attribute.
* If a class does `extend`:
- If it extends `stdClass`: no action needed (as `stdClass` supports dynamic properties).
- If it extends a PHP native class: add the attribute.
- If it extends a class from one of WP's external dependencies: add the attribute.
* In all other cases: no action — the attribute should not be needed as child classes inherit from the parent.
Whether or not a class contains magic methods has not been taken into account, as a review of the currently existing magic methods has shown that those are generally not sturdy enough and often even set dynamic properties (which they should not). See the [https://www.youtube.com/watch?v=vDZWepDQQVE live stream from August 16, 2022] for more details.
This commit only affects classes in the `src` directory of WordPress core.
* Tests should not get this attribute, but should be fixed to not use dynamic properties instead. Patches for this are already being committed under ticket #56033.
* While a number bundled themes (2014, 2019, 2020, 2021) contain classes, they are not a part of this commit and may be updated separately.
Reference: [https://wiki.php.net/rfc/deprecate_dynamic_properties PHP RFC: Deprecate dynamic properties].
Follow-up to [53922].
Props jrf, hellofromTonya, markjaquith, peterwilsoncc, costdev, knutsp, aristath.
See #56513, #56034.
Built from https://develop.svn.wordpress.org/trunk@54133
git-svn-id: http://core.svn.wordpress.org/trunk@53692 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Previously when a user was locked from editing a post in the block editor, autosave functionality was allowed to overwrite changes made by the editor that has taken control. This patch honors the lock status keeping autosave from conflicitng with other content editors.
Props jhart35, adamsilverstein, sathyapulse, chanthaboune, primetimejas, joemcgill, kadamwhite.
Fixes#55659.
Built from https://develop.svn.wordpress.org/trunk@54130
git-svn-id: http://core.svn.wordpress.org/trunk@53689 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Add support for a "_pretty" meta-parameter on all REST controllers which instructs WordPress to return pretty-printed JSON, for better readability when inspecting endpoint responses in curl output or certain developer tools.
Introduce the "rest_json_encode_options" filter to permit site owners to control this behavior globally.
Props Viper007Bond, TimothyBlynJacobs, chrisguitarguy, johnbillion, swissspidy, adamsilverstein, danielbachhuber, rmccue.
Fixes#41998.
Built from https://develop.svn.wordpress.org/trunk@54127
git-svn-id: http://core.svn.wordpress.org/trunk@53686 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset adds a new `page_cache` check which determines whether the site uses a full page cache, and in addition assesses the server response time. If no page cache is present and the server response time is slow, the check will suggest use of a page cache.
A few filters are included for customization of the check:
* `site_status_good_response_time_threshold` filters the number of milliseconds below which the server response time is considered good. The default value is based on the `server-response-time` Lighthouse audit and can be altered using this filter.
* `site_status_page_cache_supported_cache_headers` filters the map of supported cache headers and their callback to determine whether it was a cache hit. The default list includes commonly used cache headers, and it is filterable to support e.g. additional cache headers used by specific vendors.
Note that due to the nature of this check it is only run in production environments.
Props furi3r, westonruter, spacedmonkey, swissspidy, Clorith.
Fixes#56041.
Built from https://develop.svn.wordpress.org/trunk@54043
git-svn-id: http://core.svn.wordpress.org/trunk@53602 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This removes the requirement that a Super Admin must be a member of the current site when they attempt to set an application password within the admin area of an individual site on the network.
Props TimothyBlynJacobs, ilovecats7, johnbillion, georgestephanis, johnjamesjacoby
Fixes#53224
Built from https://develop.svn.wordpress.org/trunk@53882
git-svn-id: http://core.svn.wordpress.org/trunk@53441 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This updates `wp_get_latest_revision_id_and_total_count()` and its usage to be a bit more descriptive and a bit less repetitive, e.g. `$revisions['latest_id']` instead of `$revision['revision']`.
Includes updating the `@return` tag to explain when the function returns a `WP_Error`.
Follow-up to [53759], [53769], [53778], [53779].
See #55857.
Built from https://develop.svn.wordpress.org/trunk@53841
git-svn-id: http://core.svn.wordpress.org/trunk@53400 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This fixes a behavior where a draft created with the same slug as an existing post would set the existing post to a 404.
`wp_unique_post_slug()` returns the same slug for 'draft' or 'pending' posts, so to ensure that a unique slug is generated, this changeset adds the post data with the 'publish' status to `wp_unique_post_slug()`.
Props Toro_Unit, h2ham, peterwilsoncc, costdev, antonvlasenko, azaozz, ironprogrammer, audrasjb, hellofromTonya.
Fixes#52422.
Built from https://develop.svn.wordpress.org/trunk@53813
git-svn-id: http://core.svn.wordpress.org/trunk@53372 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This changeset is a follow-up to [53751] which ensures the additional `sources` information stored in attachment metadata are available under `media_details` for each image size in the REST API responses for attachments.
Props mukesh27, eugenemanuilov, mitogh, flixos90, aaemnnosttv.
See #55443.
Built from https://develop.svn.wordpress.org/trunk@53786
git-svn-id: http://core.svn.wordpress.org/trunk@53345 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The new name is `wp_get_latest_revision_id_and_total_count()`.
This aims to reduce ambiguity about what exactly is the "first" or "last" revision, and bring more consistency with similar wording elsewhere in core, e.g. latest posts, latest comments, etc.
Follow-up to [53759], [53769].
Props peterwilsoncc.
See #55857.
Built from https://develop.svn.wordpress.org/trunk@53778
git-svn-id: http://core.svn.wordpress.org/trunk@53337 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Includes:
* Renaming the function to `wp_get_last_revision_id_and_total_count()`.
* Making the default value for `$post` consistent with `wp_get_post_revisions()`.
* Making `WP_Error` codes more specific and using them in test assertions.
* Adjusting the function description per the documentation standards.
Follow-up to [53759].
Props JustinSainton, SergeyBiryukov.
See #55857.
Built from https://develop.svn.wordpress.org/trunk@53769
git-svn-id: http://core.svn.wordpress.org/trunk@53328 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Do not call the `prepare_links` methods in core REST API controllers, unless the `_links` or `_embedded` fields are requested. There is no need to prepare links if they are never returned in the response. This saves resources, as many calls to `prepare_links` methods perform database queries.
Props Spacedmonkey, timothyblynjacobs, rachelbaker, desrosj, dlh, hellofromTonya.
Fixes#52992.
Built from https://develop.svn.wordpress.org/trunk@53760
git-svn-id: http://core.svn.wordpress.org/trunk@53319 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Add new function called `wp_get_lastest_revision_id_and_total_count`, that performs an optimized query to get the last revision and total and use it in `WP_REST_Posts_Controller` class.
Props Spacedmonkey, timothyblynjacobs, furi3r, peterwilsoncc.
Fixes#55857.
Built from https://develop.svn.wordpress.org/trunk@53759
git-svn-id: http://core.svn.wordpress.org/trunk@53318 1a063a9b-81f0-0310-95a4-ce76da25c4cd
The `wp_new_comment()`, `wp_update_comment()`, and `wp_filter_comment()` functions already normalize the `user_ID` parameter internally to `user_id`, which matches the database field name.
This commit aims to bring some consistency when passing the parameter in core.
The corresponding `$user_ID` variable is also renamed to `$user_id` to match the other variables when not referring to the `$user_ID` global, which has an exception in the WordPress coding standards.
Follow-up to [8543], [8720], [12267], [12300], [26491], [28915], [28922], [34799], [49303].
See #55647, #56244.
Built from https://develop.svn.wordpress.org/trunk@53729
git-svn-id: http://core.svn.wordpress.org/trunk@53288 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This moves the `::prepare_links()` methods in REST API classes next to `::prepare_item_for_response()` where they are used, to bring some consistency across the classes and make code navigation easier.
Includes wrapping some long lines for better readability.
Follow-up to [52079], [52051], [52342], [53721], [53722].
See #55647.
Built from https://develop.svn.wordpress.org/trunk@53724
git-svn-id: http://core.svn.wordpress.org/trunk@53283 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Patterns on the [https://wordpress.org/patterns/ Pattern Directory] can have keywords for better discoverability while searching. The way these are stored [69548ff1f0 was changed from a taxonomy to meta value], but the `/wp/v2/pattern-directory/patterns` endpoint was still pulling from that old value.
The correct property to use for this field is `meta.wpop_keywords`, which returns a single string with comma-separated keywords.
Props ryelle, TimothyBlynJacobs.
See #56126.
Built from https://develop.svn.wordpress.org/trunk@53665
git-svn-id: http://core.svn.wordpress.org/trunk@53224 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Move logic to generate link to global styles to the `prepare_links` method in theme REST API controller. This way all logic to generate links is within the `prepare_links` method, bringing this controller inline with other REST API controllers.
Props SergeyBiryukov, Spacedmonkey.
Fixes#56018.
Built from https://develop.svn.wordpress.org/trunk@53544
git-svn-id: http://core.svn.wordpress.org/trunk@53133 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Prime caches for all post parents in the post REST API controller using the `_prime_post_caches` function. Post parent objects are required as part of the `check_read_permission` method’s permission check in post REST API controller.
Props spacedmonkey, furi3r, peterwilsoncc, mitogh, madpixels.
Fixes#55593.
Built from https://develop.svn.wordpress.org/trunk@53506
git-svn-id: http://core.svn.wordpress.org/trunk@53095 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Add a new parameter to `WP_Query` called `update_menu_item_cache` that when set to true, primes the caches for linked terms and posts for menu item post objects. This change moves logic
found in `wp_get_nav_menu_items` into a new function called `update_menu_item_cache`. Update the menu item REST API controller, to pass the `update_menu_item_cache` parameter to the
arguments used for the `WP_Query` run to get menu items.
Props furi3r, TimothyBlynJacobs, spacedmonkey, peterwilsoncc, mitogh.
Fixes#55620.
--This line, and those below, will be ignored--
M src/wp-includes/class-wp-query.php
M src/wp-includes/nav-menu.php
M src/wp-includes/rest-api/endpoints/class-wp-rest-menu-items-controller.php
M tests/phpunit/tests/post/nav-menu.php
Built from https://develop.svn.wordpress.org/trunk@53504
git-svn-id: http://core.svn.wordpress.org/trunk@53093 1a063a9b-81f0-0310-95a4-ce76da25c4cd
For a call to `WP_Query` or a post REST API request that contains posts from multiple authors, call the `cache_users` function, to ensure that all user data for post authors is primed in
a single database query. This results in far fewer database queries on multiple author sites.
Props spacedmonkey, timothyblynjacobs, peterwilsoncc.
Fixes#55716.
Built from https://develop.svn.wordpress.org/trunk@53482
git-svn-id: http://core.svn.wordpress.org/trunk@53071 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This aims to improve performance by calling `sanitize_url()` directly, instead of the `esc_url_raw()` wrapper. As of WordPress 6.1, `sanitize_url()` is the recommended function for sanitizing a URL for database or redirect usage.
Follow-up to [11383], [13096], [51597], [53452].
Props benjgrolleau, peterwilsoncc, SergeyBiryukov.
Fixes#55852.
Built from https://develop.svn.wordpress.org/trunk@53455
git-svn-id: http://core.svn.wordpress.org/trunk@53044 1a063a9b-81f0-0310-95a4-ce76da25c4cd
[53218] introduced a bug of a wrong response from the `wp/v2/pattern-directory/patterns` endpoint with a `slug` parameter. As the response is cached, it can result in an incorrect list of available patterns supported by the current theme.
This commit resolves by:
* Limiting the `slug` to an `array` in the query parameters.
* When set, parsing and sorting the slug(s) and then serializing the sorted query args as part of the hashed transient keys.
Props antonvlasenko, timothyblynjacobs, spacedmonkey, costdev, hellofromTonya.
Follow-up to [53218], [53152], [51208].
Fixes#55617.
Built from https://develop.svn.wordpress.org/trunk@53333
git-svn-id: http://core.svn.wordpress.org/trunk@52922 1a063a9b-81f0-0310-95a4-ce76da25c4cd
