Skip to content

Commit fc047ab

Browse files
gziologziolo
committed
Abilities API: Avoid _doing_it_wrong() on REST lookups of unknown abilities
The REST controllers resolve an ability or category from a client-controlled name. On a miss, `wp_get_ability()` / `wp_get_ability_category()` reach the registry getter, which fires `_doing_it_wrong()` to flag developer misuse. So a routine 404 emits a spurious notice in Query Monitor, `doing_it_wrong_run` listeners, and tests, including on the unauthenticated run endpoint. Guard each of the five lookups with the existence helper (`wp_has_ability()` / `wp_has_ability_category()`) first, so a missing name returns a clean 404. Direct misuse of the getters still warns, as intended. Props dhrupo. Fixes #65644. git-svn-id: https://develop.svn.wordpress.org/trunk@62831 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 082d382 commit fc047ab

6 files changed

Lines changed: 6 additions & 13 deletions

‎src/wp-includes/rest-api/endpoints/class-wp-rest-abilities-v1-categories-controller.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ public function get_items( $request ) {
142142
* @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
143143
*/
144144
public function get_item( $request ) {
145-
$category = wp_get_ability_category( $request['slug'] );
145+
$category = wp_has_ability_category( $request['slug'] ) ? wp_get_ability_category( $request['slug'] ) : null;
146146
if ( ! $category ) {
147147
return new WP_Error(
148148
'rest_ability_category_not_found',

‎src/wp-includes/rest-api/endpoints/class-wp-rest-abilities-v1-list-controller.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ public function get_items( $request ) {
156156
* @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
157157
*/
158158
public function get_item( $request ) {
159-
$ability = wp_get_ability( $request['name'] );
159+
$ability = wp_has_ability( $request['name'] ) ? wp_get_ability( $request['name'] ) : null;
160160
if ( ! $ability || ! $ability->get_meta_item( 'show_in_rest' ) ) {
161161
return new WP_Error(
162162
'rest_ability_not_found',

‎src/wp-includes/rest-api/endpoints/class-wp-rest-abilities-v1-run-controller.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ public function register_routes(): void {
8080
* @return WP_REST_Response|WP_Error Response object on success, or WP_Error object on failure.
8181
*/
8282
public function execute_ability( $request ) {
83-
$ability = wp_get_ability( $request['name'] );
83+
$ability = wp_has_ability( $request['name'] ) ? wp_get_ability( $request['name'] ) : null;
8484
if ( ! $ability ) {
8585
return new WP_Error(
8686
'rest_ability_not_found',
@@ -141,7 +141,7 @@ public function validate_request_method( string $request_method, array $annotati
141141
* @return true|WP_Error True if the request has execution permission, WP_Error object otherwise.
142142
*/
143143
public function check_ability_permissions( $request ) {
144-
$ability = wp_get_ability( $request['name'] );
144+
$ability = wp_has_ability( $request['name'] ) ? wp_get_ability( $request['name'] ) : null;
145145
if ( ! $ability || ! $ability->get_meta_item( 'show_in_rest' ) ) {
146146
return new WP_Error(
147147
'rest_ability_not_found',
@@ -239,7 +239,7 @@ private function get_input_from_request( $request ) {
239239
* @return mixed Coerced input, or the raw input when it cannot be safely coerced.
240240
*/
241241
public function sanitize_input_for_ability( $input, $request ) {
242-
$ability = wp_get_ability( $request['name'] );
242+
$ability = wp_has_ability( $request['name'] ) ? wp_get_ability( $request['name'] ) : null;
243243
if ( ! $ability instanceof WP_Ability ) {
244244
return $input;
245245
}

‎tests/phpunit/tests/rest-api/wpRestAbilitiesV1CategoriesController.php‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -219,8 +219,6 @@ public function test_get_item_with_selected_fields(): void {
219219
* Test getting a non-existent ability category returns 404.
220220
*
221221
* @ticket 64098
222-
*
223-
* @expectedIncorrectUsage WP_Ability_Categories_Registry::get_registered
224222
*/
225223
public function test_get_item_not_found(): void {
226224
$request = new WP_REST_Request( 'GET', '/wp-abilities/v1/categories/non-existent' );

‎tests/phpunit/tests/rest-api/wpRestAbilitiesV1ListController.php‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -386,8 +386,6 @@ public function test_get_item_with_embed_context(): void {
386386
* Test getting a non-existent ability returns 404.
387387
*
388388
* @ticket 64098
389-
*
390-
* @expectedIncorrectUsage WP_Abilities_Registry::get_registered
391389
*/
392390
public function test_get_item_not_found(): void {
393391
$request = new WP_REST_Request( 'GET', '/wp-abilities/v1/abilities/non/existent' );
@@ -768,8 +766,7 @@ public function test_ability_name_with_invalid_special_characters( string $name
768766
* Test extremely long ability names.
769767
*
770768
* @ticket 64098
771-
*
772-
* @expectedIncorrectUsage WP_Abilities_Registry::get_registered
769+
* @ticket 65644
773770
*/
774771
public function test_extremely_long_ability_names(): void {
775772
// Create a very long but valid ability name

‎tests/phpunit/tests/rest-api/wpRestAbilitiesV1RunController.php‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -716,8 +716,6 @@ public function test_wp_error_return_handling(): void {
716716
* Test non-existent ability returns 404.
717717
*
718718
* @ticket 64098
719-
*
720-
* @expectedIncorrectUsage WP_Abilities_Registry::get_registered
721719
*/
722720
public function test_execute_non_existent_ability(): void {
723721
$request = new WP_REST_Request( 'POST', '/wp-abilities/v1/abilities/non/existent/run' );

0 commit comments

Comments
 (0)