Skip to content

Commit 5a081ee

Browse files
desrosjdesrosj
committed
Grouped backports for the 6.6 branch.
- REST API: Increase the specificity of capability checks for collections when the `edit` context is in use. - Menus: Prevent HTML in menu item titles from being rendered unexpectedly. Merges [60814], [60815], [60816] to the 6.6 branch. Props andraganescu, desrosj, ehti, hurayraiit, iandunn, joehoyle, johnbillion, jorbin, mnelson4, noisysocks, peterwilsoncc, phillsav, rmccue, timothyblynjacobs, vortfu, westonruter , whyisjake, zieladam. git-svn-id: https://develop.svn.wordpress.org/branches/6.6@60820 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 75d7ea7 commit 5a081ee

File tree

10 files changed

+145
-92
lines changed

10 files changed

+145
-92
lines changed

‎src/js/_enqueues/lib/nav-menu.js‎

Lines changed: 27 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1015,13 +1015,18 @@
10151015
}
10161016

10171017
if ( this.checked === true ) {
1018-
$( '#pending-menu-items-to-delete ul' ).append(
1019-
'<li data-menu-item-id="' + menuItemID + '">' +
1020-
'<span class="pending-menu-item-name">' + menuItemName + '</span> ' +
1021-
'<span class="pending-menu-item-type">(' + menuItemType + ')</span>' +
1022-
'<span class="separator"></span>' +
1023-
'</li>'
1024-
);
1018+
const $li = $( '<li>', { 'data-menu-item-id': menuItemID } );
1019+
$li.append( $( '<span>', {
1020+
'class': 'pending-menu-item-name',
1021+
text: menuItemName
1022+
} ) );
1023+
$li.append( ' ' );
1024+
$li.append( $( '<span>', {
1025+
'class': 'pending-menu-item-type',
1026+
text: '(' + menuItemType + ')',
1027+
} ) );
1028+
$li.append( $( '<span>', { 'class': 'separator' } ) );
1029+
$( '#pending-menu-items-to-delete ul' ).append( $li );
10251030
}
10261031

10271032
$( '#pending-menu-items-to-delete li .separator' ).html( ', ' );
@@ -1410,20 +1415,26 @@
14101415
},
14111416

14121417
eventOnClickMenuSave : function() {
1413-
var locs = '',
1414-
menuName = $('#menu-name'),
1415-
menuNameVal = menuName.val();
1418+
var menuName = $('#menu-name'),
1419+
menuNameVal = menuName.val();
14161420

14171421
// Cancel and warn if invalid menu name.
14181422
if ( ! menuNameVal || ! menuNameVal.replace( /\s+/, '' ) ) {
14191423
menuName.parent().addClass( 'form-invalid' );
14201424
return false;
14211425
}
14221426
// Copy menu theme locations.
1427+
// Note: This appears to be dead code since #nav-menu-theme-locations no longer exists, perhaps removed in r32842.
1428+
var $updateNavMenu = $('#update-nav-menu');
14231429
$('#nav-menu-theme-locations select').each(function() {
1424-
locs += '<input type="hidden" name="' + this.name + '" value="' + $(this).val() + '" />';
1430+
$updateNavMenu.append(
1431+
$( '<input>', {
1432+
type: 'hidden',
1433+
name: this.name,
1434+
value: $( this ).val(),
1435+
} )
1436+
);
14251437
});
1426-
$('#update-nav-menu').append( locs );
14271438
// Update menu item position data.
14281439
api.menuList.find('.menu-item-data-position').val( function(index) { return index + 1; } );
14291440
window.onbeforeunload = null;
@@ -1466,7 +1477,10 @@
14661477
$item;
14671478

14681479
if( ! $items.length ) {
1469-
$('.categorychecklist', panel).html( '<li><p>' + wp.i18n.__( 'No results found.' ) + '</p></li>' );
1480+
const li = $( '<li>' );
1481+
const p = $( '<p>', { text: wp.i18n.__( 'No results found.' ) } );
1482+
li.append( p );
1483+
$('.categorychecklist', panel).empty().append( li );
14701484
$( '.spinner', panel ).removeClass( 'is-active' );
14711485
wrapper.addClass( 'has-no-menu-item' );
14721486
return;

‎src/js/_enqueues/wp/customize/nav-menus.js‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -526,7 +526,13 @@
526526
return;
527527
}
528528

529-
this.currentMenuControl.addItemToMenu( menu_item.attributes );
529+
// Leave the title as empty to reuse the original title as a placeholder if set.
530+
var nav_menu_item = Object.assign( {}, menu_item.attributes );
531+
if ( nav_menu_item.title === nav_menu_item.original_title ) {
532+
nav_menu_item.title = '';
533+
}
534+
535+
this.currentMenuControl.addItemToMenu( nav_menu_item );
530536

531537
$( menuitemTpl ).find( '.menu-item-handle' ).addClass( 'item-added' );
532538
},
@@ -3108,7 +3114,6 @@
31083114
item,
31093115
{
31103116
nav_menu_term_id: menuControl.params.menu_id,
3111-
original_title: item.title,
31123117
position: position
31133118
}
31143119
);

‎src/wp-includes/class-wp-customize-nav-menus.php‎

Lines changed: 26 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -191,13 +191,15 @@ public function load_available_items_query( $object_type = 'post_type', $object_
191191
}
192192
} elseif ( 'post' !== $object_name && 0 === $page && $post_type->has_archive ) {
193193
// Add a post type archive link.
194+
$title = $post_type->labels->archives;
194195
$items[] = array(
195-
'id' => $object_name . '-archive',
196-
'title' => $post_type->labels->archives,
197-
'type' => 'post_type_archive',
198-
'type_label' => __( 'Post Type Archive' ),
199-
'object' => $object_name,
200-
'url' => get_post_type_archive_link( $object_name ),
196+
'id' => $object_name . '-archive',
197+
'title' => $title,
198+
'original_title' => $title,
199+
'type' => 'post_type_archive',
200+
'type_label' => __( 'Post Type Archive' ),
201+
'object' => $object_name,
202+
'url' => get_post_type_archive_link( $object_name ),
201203
);
202204
}
203205

@@ -244,14 +246,16 @@ public function load_available_items_query( $object_type = 'post_type', $object_
244246
$post_type_label = implode( ',', $post_states );
245247
}
246248

249+
$title = html_entity_decode( $post_title, ENT_QUOTES, get_bloginfo( 'charset' ) );
247250
$items[] = array(
248-
'id' => "post-{$post->ID}",
249-
'title' => html_entity_decode( $post_title, ENT_QUOTES, get_bloginfo( 'charset' ) ),
250-
'type' => 'post_type',
251-
'type_label' => $post_type_label,
252-
'object' => $post->post_type,
253-
'object_id' => (int) $post->ID,
254-
'url' => get_permalink( (int) $post->ID ),
251+
'id' => "post-{$post->ID}",
252+
'title' => $title,
253+
'original_title' => $title,
254+
'type' => 'post_type',
255+
'type_label' => $post_type_label,
256+
'object' => $post->post_type,
257+
'object_id' => (int) $post->ID,
258+
'url' => get_permalink( (int) $post->ID ),
255259
);
256260
}
257261
} elseif ( 'taxonomy' === $object_type ) {
@@ -276,14 +280,16 @@ public function load_available_items_query( $object_type = 'post_type', $object_
276280
}
277281

278282
foreach ( $terms as $term ) {
283+
$title = html_entity_decode( $term->name, ENT_QUOTES, get_bloginfo( 'charset' ) );
279284
$items[] = array(
280-
'id' => "term-{$term->term_id}",
281-
'title' => html_entity_decode( $term->name, ENT_QUOTES, get_bloginfo( 'charset' ) ),
282-
'type' => 'taxonomy',
283-
'type_label' => get_taxonomy( $term->taxonomy )->labels->singular_name,
284-
'object' => $term->taxonomy,
285-
'object_id' => (int) $term->term_id,
286-
'url' => get_term_link( (int) $term->term_id, $term->taxonomy ),
285+
'id' => "term-{$term->term_id}",
286+
'title' => $title,
287+
'original_title' => $title,
288+
'type' => 'taxonomy',
289+
'type_label' => get_taxonomy( $term->taxonomy )->labels->singular_name,
290+
'object' => $term->taxonomy,
291+
'object_id' => (int) $term->term_id,
292+
'url' => get_term_link( (int) $term->term_id, $term->taxonomy ),
287293
);
288294
}
289295
}

‎src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php‎

Lines changed: 28 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,6 @@ class WP_Customize_Nav_Menu_Item_Setting extends WP_Customize_Setting {
5656
'classes' => '',
5757
'xfn' => '',
5858
'status' => 'publish',
59-
'original_title' => '',
6059
'nav_menu_term_id' => 0, // This will be supplied as the $menu_id arg for wp_update_nav_menu_item().
6160
'_invalid' => false,
6261
);
@@ -210,6 +209,7 @@ public function flush_cached_value( $menu_id, $menu_item_id ) {
210209
* @return array|false Instance data array, or false if the item is marked for deletion.
211210
*/
212211
public function value() {
212+
$type_label = null;
213213
if ( $this->is_previewed && get_current_blog_id() === $this->_previewed_blog_id ) {
214214
$undefined = new stdClass(); // Symbol.
215215
$post_value = $this->post_value( $undefined );
@@ -219,9 +219,6 @@ public function value() {
219219
} else {
220220
$value = $post_value;
221221
}
222-
if ( ! empty( $value ) && empty( $value['original_title'] ) ) {
223-
$value['original_title'] = $this->get_original_title( (object) $value );
224-
}
225222
} elseif ( isset( $this->value ) ) {
226223
$value = $this->value;
227224
} else {
@@ -233,6 +230,9 @@ public function value() {
233230
if ( $post && self::POST_TYPE === $post->post_type ) {
234231
$is_title_empty = empty( $post->post_title );
235232
$value = (array) wp_setup_nav_menu_item( $post );
233+
if ( isset( $value['type_label'] ) ) {
234+
$type_label = $value['type_label'];
235+
}
236236
if ( $is_title_empty ) {
237237
$value['title'] = '';
238238
}
@@ -249,20 +249,39 @@ public function value() {
249249
$value = $this->value;
250250
}
251251

252-
if ( ! empty( $value ) && empty( $value['type_label'] ) ) {
253-
$value['type_label'] = $this->get_type_label( (object) $value );
252+
// These properties are read-only and are part of the setting for use in the Customizer UI.
253+
if ( is_array( $value ) ) {
254+
$value_obj = (object) $value;
255+
$value['type_label'] = isset( $type_label ) ? $type_label : $this->get_type_label( $value_obj );
256+
$value['original_title'] = $this->get_original_title( $value_obj );
254257
}
255258

256259
return $value;
257260
}
258261

262+
/**
263+
* Prepares the value for editing on the client.
264+
*
265+
* @since 6.8.3
266+
*
267+
* @return array|false Value prepared for the client.
268+
*/
269+
public function js_value() {
270+
$value = parent::js_value();
271+
if ( is_array( $value ) && isset( $value['original_title'] ) ) {
272+
// Decode entities for the sake of displaying the original title as a placeholder.
273+
$value['original_title'] = html_entity_decode( $value['original_title'], ENT_QUOTES, get_bloginfo( 'charset' ) );
274+
}
275+
return $value;
276+
}
277+
259278
/**
260279
* Get original title.
261280
*
262281
* @since 4.7.0
263282
*
264283
* @param object $item Nav menu item.
265-
* @return string The original title.
284+
* @return string The original title, without entity decoding.
266285
*/
267286
protected function get_original_title( $item ) {
268287
$original_title = '';
@@ -288,7 +307,6 @@ protected function get_original_title( $item ) {
288307
$original_title = $original_object->labels->archives;
289308
}
290309
}
291-
$original_title = html_entity_decode( $original_title, ENT_QUOTES, get_bloginfo( 'charset' ) );
292310
return $original_title;
293311
}
294312

@@ -346,10 +364,6 @@ protected function populate_value() {
346364
unset( $this->value['post_status'] );
347365
}
348366

349-
if ( ! isset( $this->value['original_title'] ) ) {
350-
$this->value['original_title'] = $this->get_original_title( (object) $this->value );
351-
}
352-
353367
if ( ! isset( $this->value['nav_menu_term_id'] ) && $this->post_id > 0 ) {
354368
$menus = wp_get_post_terms(
355369
$this->post_id,
@@ -594,11 +608,8 @@ public function value_as_wp_post_nav_menu_item() {
594608
$item->menu_order = $item->position;
595609
unset( $item->position );
596610

597-
if ( empty( $item->original_title ) ) {
598-
$item->original_title = $this->get_original_title( $item );
599-
}
600611
if ( empty( $item->title ) && ! empty( $item->original_title ) ) {
601-
$item->title = $item->original_title;
612+
$item->title = $item->original_title; // This is NOT entity-decoded. It comes from self::get_original_title().
602613
}
603614
if ( $item->title ) {
604615
$item->post_title = $item->title;
@@ -654,7 +665,7 @@ public function value_as_wp_post_nav_menu_item() {
654665
* @since 4.3.0
655666
* @since 5.9.0 Renamed `$menu_item_value` to `$value` for PHP 8 named parameter support.
656667
*
657-
* @param array $value The menu item value to sanitize.
668+
* @param array|false $value The menu item value to sanitize.
658669
* @return array|false|null|WP_Error Null or WP_Error if an input isn't valid. False if it is marked for deletion.
659670
* Otherwise the sanitized value.
660671
*/
@@ -711,8 +722,6 @@ public function sanitize( $value ) {
711722
$menu_item_value[ $key ] = implode( ' ', array_map( 'sanitize_html_class', $value ) );
712723
}
713724

714-
$menu_item_value['original_title'] = sanitize_text_field( $menu_item_value['original_title'] );
715-
716725
// Apply the same filters as when calling wp_insert_post().
717726

718727
/** This filter is documented in wp-includes/post.php */

‎src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -384,7 +384,13 @@ public function get_items( $request ) {
384384
}
385385

386386
foreach ( $query_result as $post ) {
387-
if ( ! $this->check_read_permission( $post ) ) {
387+
if ( 'edit' === $request['context'] ) {
388+
$permission = $this->check_update_permission( $post );
389+
} else {
390+
$permission = $this->check_read_permission( $post );
391+
}
392+
393+
if ( ! $permission ) {
388394
continue;
389395
}
390396

‎src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -340,6 +340,10 @@ public function get_items( $request ) {
340340
$response = array();
341341

342342
foreach ( $query_result as $term ) {
343+
if ( 'edit' === $request['context'] && ! current_user_can( 'edit_term', $term->term_id ) ) {
344+
continue;
345+
}
346+
343347
$data = $this->prepare_item_for_response( $term, $request );
344348
$response[] = $this->prepare_response_for_collection( $data );
345349
}

‎src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,7 @@ public function get_items_permissions_check( $request ) {
220220
if ( 'edit' === $request['context'] && ! current_user_can( 'list_users' ) ) {
221221
return new WP_Error(
222222
'rest_forbidden_context',
223-
__( 'Sorry, you are not allowed to list users.' ),
223+
__( 'Sorry, you are not allowed to edit users.' ),
224224
array( 'status' => rest_authorization_required_code() )
225225
);
226226
}
@@ -350,6 +350,10 @@ public function get_items( $request ) {
350350
$users = array();
351351

352352
foreach ( $query->results as $user ) {
353+
if ( 'edit' === $request['context'] && ! current_user_can( 'edit_user', $user->ID ) ) {
354+
continue;
355+
}
356+
353357
$data = $this->prepare_item_for_response( $user, $request );
354358
$users[] = $this->prepare_response_for_collection( $data );
355359
}
@@ -449,13 +453,15 @@ public function get_item_permissions_check( $request ) {
449453
return true;
450454
}
451455

452-
if ( 'edit' === $request['context'] && ! current_user_can( 'list_users' ) ) {
456+
if ( 'edit' === $request['context'] && ! current_user_can( 'edit_user', $user->ID ) ) {
453457
return new WP_Error(
454-
'rest_user_cannot_view',
455-
__( 'Sorry, you are not allowed to list users.' ),
458+
'rest_forbidden_context',
459+
__( 'Sorry, you are not allowed to edit this user.' ),
456460
array( 'status' => rest_authorization_required_code() )
457461
);
458-
} elseif ( ! count_user_posts( $user->ID, $types ) && ! current_user_can( 'edit_user', $user->ID ) && ! current_user_can( 'list_users' ) ) {
462+
}
463+
464+
if ( ! current_user_can( 'edit_user', $user->ID ) && ! current_user_can( 'list_users' ) && ! count_user_posts( $user->ID, $types ) ) {
459465
return new WP_Error(
460466
'rest_user_cannot_view',
461467
__( 'Sorry, you are not allowed to list users.' ),
@@ -1050,7 +1056,7 @@ public function prepare_item_for_response( $item, $request ) {
10501056
$data['slug'] = $user->user_nicename;
10511057
}
10521058

1053-
if ( in_array( 'roles', $fields, true ) ) {
1059+
if ( in_array( 'roles', $fields, true ) && ( current_user_can( 'list_users' ) || current_user_can( 'edit_user', $user->ID ) ) ) {
10541060
// Defensively call array_values() to ensure an array is returned.
10551061
$data['roles'] = array_values( $user->roles );
10561062
}

‎tests/phpunit/tests/customize/nav-menu-item-setting.php‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,6 @@ public function test_construct() {
8989
'classes' => '',
9090
'xfn' => '',
9191
'status' => 'publish',
92-
'original_title' => '',
9392
'nav_menu_term_id' => 0,
9493
'_invalid' => false,
9594
);
@@ -581,7 +580,7 @@ public function test_sanitize() {
581580
'classes' => 'hello inject',
582581
'xfn' => 'hello inject',
583582
'status' => 'draft',
584-
'original_title' => 'Hi',
583+
'original_title' => 'Hi<script>unfilteredHtml()</script>',
585584
'nav_menu_term_id' => 0,
586585
);
587586

0 commit comments

Comments
 (0)