Repository navigation
Conversation
… the posts endpoint. `WP_REST_Posts_Controller::check_template()` replaces the default schema validation for the `template` argument, so an array value reached `isset( $allowed_templates[ $template ] )` and caused a fatal error. Validate the value against the schema type first, so it returns the standard `rest_invalid_param` error. Props leedxw, dhrupo. Fixes #66652.
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. Props Bot commandsYou can trigger Props Bot actions by commenting on this PR:
|
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
Sending an array as the
templateargument to the posts endpoint causes a PHP fatal error, even for a logged-out request, because argument validation runs before the permission check:WP_REST_Posts_Controller::check_template()is thevalidate_callbackfortemplate, so it replaces the default schema validation, and the array reachesisset( $allowed_templates[ $template ] ). This PR runsrest_validate_request_arg()first, so a non-string value gets the standardrest_invalid_param400 error ("template is not of type string."). Valid requests behave as before. The pages endpoint uses the same method, so it is covered too.Trac ticket: https://core.trac.wordpress.org/ticket/66652
Testing
New tests
test_create_item_with_non_string_templateandtest_update_item_with_non_string_template(--group 66652):TypeError: Cannot access offset of type array in isset or emptyin both testsOK (2 tests, 9 assertions)--group restapi:Tests: 4026, Assertions: 18134, Warnings: 4, Skipped: 2(the 4 warnings are the existing PHPUnit 10 deprecation notices)WP_Test_REST_Posts_Controller:OK (290 tests, 2651 assertions)Live, WordPress 7.2-beta5-65392-src, PHP 8.4, logged out,
POST /wp-json/wp/v2/postswithtemplate[]=:HTTP 500(critical error page)HTTP 400{"code":"rest_invalid_param","message":"Invalid parameter(s): template","data":{"status":400,"params":{"template":"template is not of type string."}, …}}template=still gets401, andtemplate=x.phpstill gets400(not one of the allowed templates).Use of AI Tools
AI assistance: Claude Code (Claude Opus 5.5) drafted the patch, the tests and the live reproduction; I reviewed every change, reproduced the fatal on trunk, and ran and verified all results myself.