Skip to content

Commit c5c5759

Browse files
desrosjdesrosj
committed
Grouped backports for the 5.0 branch.
- REST API: Increase the specificity of capability checks for collections when the `edit` context is in use. - Menus: Prevent HTML in menu item titles from being rendered unexpectedly. Merges [60814], [60815], [60816] to the 5.0 branch. Props andraganescu, desrosj, ehti, hurayraiit, iandunn, joehoyle, johnbillion, jorbin, mnelson4, noisysocks, peterwilsoncc, phillsav, rmccue, timothyblynjacobs, vortfu, westonruter , whyisjake, zieladam. git-svn-id: https://develop.svn.wordpress.org/branches/5.0@60836 602fd350-edb4-49c9-b593-d223f7449a82
1 parent a5fc293 commit c5c5759

File tree

10 files changed

+109
-61
lines changed

10 files changed

+109
-61
lines changed

‎src/wp-admin/js/customize-nav-menus.js‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -517,7 +517,13 @@
517517
return;
518518
}
519519

520-
this.currentMenuControl.addItemToMenu( menu_item.attributes );
520+
// Leave the title as empty to reuse the original title as a placeholder if set.
521+
var nav_menu_item = Object.assign( {}, menu_item.attributes );
522+
if ( nav_menu_item.title === nav_menu_item.original_title ) {
523+
nav_menu_item.title = '';
524+
}
525+
526+
this.currentMenuControl.addItemToMenu( nav_menu_item );
521527

522528
$( menuitemTpl ).find( '.menu-item-handle' ).addClass( 'item-added' );
523529
},
@@ -2971,7 +2977,6 @@
29712977
item,
29722978
{
29732979
nav_menu_term_id: menuControl.params.menu_id,
2974-
original_title: item.title,
29752980
position: position
29762981
}
29772982
);

‎src/wp-admin/js/nav-menu.js‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1168,20 +1168,27 @@ var wpNavMenu;
11681168
},
11691169

11701170
eventOnClickMenuSave : function() {
1171-
var locs = '',
1172-
menuName = $('#menu-name'),
1173-
menuNameVal = menuName.val();
1174-
// Cancel and warn if invalid menu name
1171+
var menuName = $('#menu-name'),
1172+
menuNameVal = menuName.val();
1173+
1174+
// Cancel and warn if invalid menu name.
11751175
if( !menuNameVal || menuNameVal == menuName.attr('title') || !menuNameVal.replace(/\s+/, '') ) {
11761176
menuName.parent().addClass('form-invalid');
11771177
return false;
11781178
}
1179-
// Copy menu theme locations
1179+
// Copy menu theme locations.
1180+
// Note: This appears to be dead code since #nav-menu-theme-locations no longer exists, perhaps removed in r32842.
1181+
var $updateNavMenu = $('#update-nav-menu');
11801182
$('#nav-menu-theme-locations select').each(function() {
1181-
locs += '<input type="hidden" name="' + this.name + '" value="' + $(this).val() + '" />';
1183+
$updateNavMenu.append(
1184+
$( '<input>', {
1185+
type: 'hidden',
1186+
name: this.name,
1187+
value: $( this ).val()
1188+
} )
1189+
);
11821190
});
1183-
$('#update-nav-menu').append( locs );
1184-
// Update menu item position data
1191+
// Update menu item position data.
11851192
api.menuList.find('.menu-item-data-position').val( function(index) { return index + 1; } );
11861193
window.onbeforeunload = null;
11871194

@@ -1221,7 +1228,10 @@ var wpNavMenu;
12211228
$item;
12221229

12231230
if( ! $items.length ) {
1224-
$('.categorychecklist', panel).html( '<li><p>' + navMenuL10n.noResultsFound + '</p></li>' );
1231+
var li = $( '<li>' );
1232+
var p = $( '<p>', { text: navMenuL10n.noResultsFound } );
1233+
li.append( p );
1234+
$('.categorychecklist', panel).empty().append( li );
12251235
$( '.spinner', panel ).removeClass( 'is-active' );
12261236
wrapper.addClass( 'has-no-menu-item' );
12271237
return;

‎src/wp-includes/class-wp-customize-nav-menus.php‎

Lines changed: 27 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -158,13 +158,15 @@ public function load_available_items_query( $type = 'post_type', $object = 'page
158158
);
159159
} elseif ( 'post' !== $object && 0 === $page && $post_type->has_archive ) {
160160
// Add a post type archive link.
161+
$title = $post_type->labels->archives;
161162
$items[] = array(
162-
'id' => $object . '-archive',
163-
'title' => $post_type->labels->archives,
164-
'type' => 'post_type_archive',
165-
'type_label' => __( 'Post Type Archive' ),
166-
'object' => $object,
167-
'url' => get_post_type_archive_link( $object ),
163+
'id' => $object_name . '-archive',
164+
'title' => $title,
165+
'original_title' => $title,
166+
'type' => 'post_type_archive',
167+
'type_label' => __( 'Post Type Archive' ),
168+
'object' => $object_name,
169+
'url' => get_post_type_archive_link( $object_name ),
168170
);
169171
}
170172

@@ -193,14 +195,17 @@ public function load_available_items_query( $type = 'post_type', $object = 'page
193195
/* translators: %d: ID of a post */
194196
$post_title = sprintf( __( '#%d (no title)' ), $post->ID );
195197
}
198+
199+
$title = html_entity_decode( $post_title, ENT_QUOTES, get_bloginfo( 'charset' ) );
196200
$items[] = array(
197-
'id' => "post-{$post->ID}",
198-
'title' => html_entity_decode( $post_title, ENT_QUOTES, get_bloginfo( 'charset' ) ),
199-
'type' => 'post_type',
200-
'type_label' => get_post_type_object( $post->post_type )->labels->singular_name,
201-
'object' => $post->post_type,
202-
'object_id' => intval( $post->ID ),
203-
'url' => get_permalink( intval( $post->ID ) ),
201+
'id' => "post-{$post->ID}",
202+
'title' => $title,
203+
'original_title' => $title,
204+
'type' => 'post_type',
205+
'type_label' => get_post_type_object( $post->post_type )->labels->singular_name,
206+
'object' => $post->post_type,
207+
'object_id' => (int) $post->ID,
208+
'url' => get_permalink( (int) $post->ID ),
204209
);
205210
}
206211
} elseif ( 'taxonomy' === $type ) {
@@ -221,14 +226,16 @@ public function load_available_items_query( $type = 'post_type', $object = 'page
221226
}
222227

223228
foreach ( $terms as $term ) {
229+
$title = html_entity_decode( $term->name, ENT_QUOTES, get_bloginfo( 'charset' ) );
224230
$items[] = array(
225-
'id' => "term-{$term->term_id}",
226-
'title' => html_entity_decode( $term->name, ENT_QUOTES, get_bloginfo( 'charset' ) ),
227-
'type' => 'taxonomy',
228-
'type_label' => get_taxonomy( $term->taxonomy )->labels->singular_name,
229-
'object' => $term->taxonomy,
230-
'object_id' => intval( $term->term_id ),
231-
'url' => get_term_link( intval( $term->term_id ), $term->taxonomy ),
231+
'id' => "term-{$term->term_id}",
232+
'title' => $title,
233+
'original_title' => $title,
234+
'type' => 'taxonomy',
235+
'type_label' => get_taxonomy( $term->taxonomy )->labels->singular_name,
236+
'object' => $term->taxonomy,
237+
'object_id' => (int) $term->term_id,
238+
'url' => get_term_link( (int) $term->term_id, $term->taxonomy ),
232239
);
233240
}
234241
}

‎src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php‎

Lines changed: 29 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,6 @@ class WP_Customize_Nav_Menu_Item_Setting extends WP_Customize_Setting {
5656
'classes' => '',
5757
'xfn' => '',
5858
'status' => 'publish',
59-
'original_title' => '',
6059
'nav_menu_term_id' => 0, // This will be supplied as the $menu_id arg for wp_update_nav_menu_item().
6160
'_invalid' => false,
6261
);
@@ -211,7 +210,8 @@ public function flush_cached_value( $menu_id, $menu_item_id ) {
211210
* @return array|false Instance data array, or false if the item is marked for deletion.
212211
*/
213212
public function value() {
214-
if ( $this->is_previewed && $this->_previewed_blog_id === get_current_blog_id() ) {
213+
$type_label = null;
214+
if ( $this->is_previewed && get_current_blog_id() === $this->_previewed_blog_id ) {
215215
$undefined = new stdClass(); // Symbol.
216216
$post_value = $this->post_value( $undefined );
217217

@@ -220,9 +220,6 @@ public function value() {
220220
} else {
221221
$value = $post_value;
222222
}
223-
if ( ! empty( $value ) && empty( $value['original_title'] ) ) {
224-
$value['original_title'] = $this->get_original_title( (object) $value );
225-
}
226223
} elseif ( isset( $this->value ) ) {
227224
$value = $this->value;
228225
} else {
@@ -234,6 +231,9 @@ public function value() {
234231
if ( $post && self::POST_TYPE === $post->post_type ) {
235232
$is_title_empty = empty( $post->post_title );
236233
$value = (array) wp_setup_nav_menu_item( $post );
234+
if ( isset( $value['type_label'] ) ) {
235+
$type_label = $value['type_label'];
236+
}
237237
if ( $is_title_empty ) {
238238
$value['title'] = '';
239239
}
@@ -250,20 +250,39 @@ public function value() {
250250
$value = $this->value;
251251
}
252252

253-
if ( ! empty( $value ) && empty( $value['type_label'] ) ) {
254-
$value['type_label'] = $this->get_type_label( (object) $value );
253+
// These properties are read-only and are part of the setting for use in the Customizer UI.
254+
if ( is_array( $value ) ) {
255+
$value_obj = (object) $value;
256+
$value['type_label'] = isset( $type_label ) ? $type_label : $this->get_type_label( $value_obj );
257+
$value['original_title'] = $this->get_original_title( $value_obj );
255258
}
256259

257260
return $value;
258261
}
259262

263+
/**
264+
* Prepares the value for editing on the client.
265+
*
266+
* @since 6.8.3
267+
*
268+
* @return array|false Value prepared for the client.
269+
*/
270+
public function js_value() {
271+
$value = parent::js_value();
272+
if ( is_array( $value ) && isset( $value['original_title'] ) ) {
273+
// Decode entities for the sake of displaying the original title as a placeholder.
274+
$value['original_title'] = html_entity_decode( $value['original_title'], ENT_QUOTES, get_bloginfo( 'charset' ) );
275+
}
276+
return $value;
277+
}
278+
260279
/**
261280
* Get original title.
262281
*
263282
* @since 4.7.0
264283
*
265284
* @param object $item Nav menu item.
266-
* @return string The original title.
285+
* @return string The original title, without entity decoding.
267286
*/
268287
protected function get_original_title( $item ) {
269288
$original_title = '';
@@ -289,7 +308,6 @@ protected function get_original_title( $item ) {
289308
$original_title = $original_object->labels->archives;
290309
}
291310
}
292-
$original_title = html_entity_decode( $original_title, ENT_QUOTES, get_bloginfo( 'charset' ) );
293311
return $original_title;
294312
}
295313

@@ -347,10 +365,6 @@ protected function populate_value() {
347365
unset( $this->value['post_status'] );
348366
}
349367

350-
if ( ! isset( $this->value['original_title'] ) ) {
351-
$this->value['original_title'] = $this->get_original_title( (object) $this->value );
352-
}
353-
354368
if ( ! isset( $this->value['nav_menu_term_id'] ) && $this->post_id > 0 ) {
355369
$menus = wp_get_post_terms( $this->post_id, WP_Customize_Nav_Menu_Setting::TAXONOMY, array(
356370
'fields' => 'ids',
@@ -586,11 +600,8 @@ public function value_as_wp_post_nav_menu_item() {
586600
$item->menu_order = $item->position;
587601
unset( $item->position );
588602

589-
if ( empty( $item->original_title ) ) {
590-
$item->original_title = $this->get_original_title( $item );
591-
}
592603
if ( empty( $item->title ) && ! empty( $item->original_title ) ) {
593-
$item->title = $item->original_title;
604+
$item->title = $item->original_title; // This is NOT entity-decoded. It comes from self::get_original_title().
594605
}
595606
if ( $item->title ) {
596607
$item->post_title = $item->title;
@@ -640,7 +651,7 @@ public function value_as_wp_post_nav_menu_item() {
640651
*
641652
* @since 4.3.0
642653
*
643-
* @param array $menu_item_value The value to sanitize.
654+
* @param array|false $value The menu item value to sanitize.
644655
* @return array|false|null|WP_Error Null or WP_Error if an input isn't valid. False if it is marked for deletion.
645656
* Otherwise the sanitized value.
646657
*/
@@ -694,8 +705,6 @@ public function sanitize( $menu_item_value ) {
694705
$menu_item_value[ $key ] = implode( ' ', array_map( 'sanitize_html_class', $value ) );
695706
}
696707

697-
$menu_item_value['original_title'] = sanitize_text_field( $menu_item_value['original_title'] );
698-
699708
// Apply the same filters as when calling wp_insert_post().
700709

701710
/** This filter is documented in wp-includes/post.php */

‎src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -338,7 +338,13 @@ public function get_items( $request ) {
338338
$posts = array();
339339

340340
foreach ( $query_result as $post ) {
341-
if ( ! $this->check_read_permission( $post ) ) {
341+
if ( 'edit' === $request['context'] ) {
342+
$permission = $this->check_update_permission( $post );
343+
} else {
344+
$permission = $this->check_read_permission( $post );
345+
}
346+
347+
if ( ! $permission ) {
342348
continue;
343349
}
344350

‎src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -318,6 +318,9 @@ public function get_items( $request ) {
318318
$response = array();
319319

320320
foreach ( $query_result as $term ) {
321+
if ( 'edit' === $request['context'] && ! current_user_can( 'edit_term', $term->term_id ) ) {
322+
continue;
323+
}
321324
$data = $this->prepare_item_for_response( $term, $request );
322325
$response[] = $this->prepare_response_for_collection( $data );
323326
}

‎src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,7 @@ public function get_items_permissions_check( $request ) {
179179
}
180180

181181
if ( 'edit' === $request['context'] && ! current_user_can( 'list_users' ) ) {
182-
return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to list users.' ), array( 'status' => rest_authorization_required_code() ) );
182+
return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit users.' ), array( 'status' => rest_authorization_required_code() ) );
183183
}
184184

185185
if ( in_array( $request['orderby'], array( 'email', 'registered_date' ), true ) && ! current_user_can( 'list_users' ) ) {
@@ -293,6 +293,10 @@ public function get_items( $request ) {
293293
$users = array();
294294

295295
foreach ( $query->results as $user ) {
296+
if ( 'edit' === $request['context'] && ! current_user_can( 'edit_user', $user->ID ) ) {
297+
continue;
298+
}
299+
296300
$data = $this->prepare_item_for_response( $user, $request );
297301
$users[] = $this->prepare_response_for_collection( $data );
298302
}
@@ -387,9 +391,11 @@ public function get_item_permissions_check( $request ) {
387391
return true;
388392
}
389393

390-
if ( 'edit' === $request['context'] && ! current_user_can( 'list_users' ) ) {
391-
return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you are not allowed to list users.' ), array( 'status' => rest_authorization_required_code() ) );
392-
} elseif ( ! count_user_posts( $user->ID, $types ) && ! current_user_can( 'edit_user', $user->ID ) && ! current_user_can( 'list_users' ) ) {
394+
if ( 'edit' === $request['context'] && ! current_user_can( 'edit_user', $user->ID ) ) {
395+
return new WP_Error( 'rest_forbidden_context', __( 'Sorry, you are not allowed to edit this user.' ), array( 'status' => rest_authorization_required_code() ) );
396+
}
397+
398+
if ( ! current_user_can( 'edit_user', $user->ID ) && ! current_user_can( 'list_users' ) && ! count_user_posts( $user->ID, $types ) ) {
393399
return new WP_Error( 'rest_user_cannot_view', __( 'Sorry, you are not allowed to list users.' ), array( 'status' => rest_authorization_required_code() ) );
394400
}
395401

@@ -904,7 +910,7 @@ public function prepare_item_for_response( $user, $request ) {
904910
$data['slug'] = $user->user_nicename;
905911
}
906912

907-
if ( in_array( 'roles', $fields, true ) ) {
913+
if ( in_array( 'roles', $fields, true ) && ( current_user_can( 'list_users' ) || current_user_can( 'edit_user', $user->ID ) ) ) {
908914
// Defensively call array_values() to ensure an array is returned.
909915
$data['roles'] = array_values( $user->roles );
910916
}

‎tests/phpunit/tests/customize/nav-menu-item-setting.php‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,6 @@ function test_construct() {
8989
'classes' => '',
9090
'xfn' => '',
9191
'status' => 'publish',
92-
'original_title' => '',
9392
'nav_menu_term_id' => 0,
9493
'_invalid' => false,
9594
);
@@ -543,7 +542,7 @@ function test_sanitize() {
543542
'classes' => 'hello inject',
544543
'xfn' => 'hello inject',
545544
'status' => 'draft',
546-
'original_title' => 'Hi',
545+
'original_title' => 'Hi<script>unfilteredHtml()</script>',
547546
'nav_menu_term_id' => 0,
548547
);
549548

@@ -841,7 +840,6 @@ function test_value_as_wp_post_nav_menu_item() {
841840
'classes' => '',
842841
'xfn' => '',
843842
'status' => 'publish',
844-
'original_title' => '',
845843
'nav_menu_term_id' => 0,
846844
'_invalid' => false,
847845
);

‎tests/phpunit/tests/customize/nav-menus.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,7 @@ function test_load_available_items_query_returns_post_item_with_page_number() {
170170
$expected = array(
171171
'id' => "post-{$post_id}",
172172
'title' => 'Post Title',
173+
'original_title' => 'Post Title',
173174
'type' => 'post_type',
174175
'type_label' => 'Post',
175176
'object' => 'post',
@@ -197,6 +198,7 @@ function test_load_available_items_query_returns_page_item() {
197198
$expected = array(
198199
'id' => "post-{$page_id}",
199200
'title' => 'Page Title',
201+
'original_title' => 'Page Title',
200202
'type' => 'post_type',
201203
'type_label' => 'Page',
202204
'object' => 'page',
@@ -223,6 +225,7 @@ function test_load_available_items_query_returns_post_item() {
223225
$expected = array(
224226
'id' => "post-{$post_id}",
225227
'title' => 'Post Title',
228+
'original_title' => 'Post Title',
226229
'type' => 'post_type',
227230
'type_label' => 'Post',
228231
'object' => 'post',
@@ -249,6 +252,7 @@ function test_load_available_items_query_returns_term_item() {
249252
$expected = array(
250253
'id' => "term-{$term_id}",
251254
'title' => 'Term Title',
255+
'original_title' => 'Term Title',
252256
'type' => 'taxonomy',
253257
'type_label' => 'Category',
254258
'object' => 'category',

0 commit comments

Comments
 (0)