<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[39038] trunk: Customize: Prevent auto-draft post/page stubs from being saved with empty slugs or published with non-unique slugs.</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta" style="font-size: 105%">
<dt style="float: left; width: 6em; font-weight: bold">Revision</dt> <dd><a style="font-weight: bold" href="https://core.trac.wordpress.org/changeset/39038">39038</a><script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","description":"Review this Commit","action":{"@type":"ViewAction","url":"https://core.trac.wordpress.org/changeset/39038","name":"Review Commit"}}</script></dd>
<dt style="float: left; width: 6em; font-weight: bold">Author</dt> <dd>westonruter</dd>
<dt style="float: left; width: 6em; font-weight: bold">Date</dt> <dd>2016-10-30 20:20:54 +0000 (Sun, 30 Oct 2016)</dd>
</dl>
<pre style='padding-left: 1em; margin: 2em 0; border-left: 2px solid #ccc; line-height: 1.25; font-size: 105%; font-family: sans-serif'>Customize: Prevent auto-draft post/page stubs from being saved with empty slugs or published with non-unique slugs.
* Allow `WP_Customize_Nav_Menus::insert_auto_draft_post()` to take full post array to pass to `wp_insert_post()`, except for `post_status`. Require `post_title`.
* Ensure empty `post_name` gets explicitly set to slugified `post_title`.
* Explicitly allow only `post_type` and `post_title` params in `WP_Customize_Nav_Menus::ajax_insert_auto_draft_post()`.
* Use `wp_update_post()` instead of `wp_publish_post()` to ensure unique slugs are assigned to published auto-draft posts.
* Re-use `WP_Customize_Nav_Menus::insert_auto_draft_post()` when inserting stubs from starter content.
See <a href="https://core.trac.wordpress.org/ticket/38114">#38114</a>, <a href="https://core.trac.wordpress.org/ticket/38013">#38013</a>, <a href="https://core.trac.wordpress.org/ticket/34923">#34923</a>.
Fixes <a href="https://core.trac.wordpress.org/ticket/38539">#38539</a>.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunksrcwpincludesclasswpcustomizemanagerphp">trunk/src/wp-includes/class-wp-customize-manager.php</a></li>
<li><a href="#trunksrcwpincludesclasswpcustomizenavmenusphp">trunk/src/wp-includes/class-wp-customize-nav-menus.php</a></li>
<li><a href="#trunktestsphpunittestsajaxCustomizeMenusphp">trunk/tests/phpunit/tests/ajax/CustomizeMenus.php</a></li>
<li><a href="#trunktestsphpunittestscustomizenavmenusphp">trunk/tests/phpunit/tests/customize/nav-menus.php</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunksrcwpincludesclasswpcustomizemanagerphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/class-wp-customize-manager.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/class-wp-customize-manager.php 2016-10-30 18:52:58 UTC (rev 39037)
+++ trunk/src/wp-includes/class-wp-customize-manager.php 2016-10-30 20:20:54 UTC (rev 39038)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -959,10 +959,10 @@
</span><span class="cx" style="display: block; padding: 0 10px"> // Posts & pages.
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! empty( $posts ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> foreach ( array_keys( $posts ) as $post_symbol ) {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $posts[ $post_symbol ]['ID'] = wp_insert_post( wp_slash( array_merge(
- $posts[ $post_symbol ],
- array( 'post_status' => 'auto-draft' )
- ) ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $r = $this->nav_menus->insert_auto_draft_post( $posts[ $post_symbol ] );
+ if ( $r instanceof WP_Post ) {
+ $posts[ $post_symbol ]['ID'] = $r->ID;
+ }
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> $this->set_post_value( 'nav_menus_created_posts', wp_list_pluck( $posts, 'ID' ) ); // This is why nav_menus component is dependency for adding posts.
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcwpincludesclasswpcustomizenavmenusphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-includes/class-wp-customize-nav-menus.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-includes/class-wp-customize-nav-menus.php 2016-10-30 18:52:58 UTC (rev 39037)
+++ trunk/src/wp-includes/class-wp-customize-nav-menus.php 2016-10-30 20:20:54 UTC (rev 39038)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -734,10 +734,12 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @since 4.7.0
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><span class="cx" style="display: block; padding: 0 10px"> * @param array $postarr {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- * Abbreviated post array.
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ * Post array. Note that post_status is overridden to be `auto-draft`.
</ins><span class="cx" style="display: block; padding: 0 10px"> *
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- * @var string $post_title Post title.
- * @var string $post_type Post type.
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ * @var string $post_title Post title. Required.
+ * @var string $post_type Post type. Required.
+ * @var string $post_name Post name.
+ * @var string $post_content Post content.
</ins><span class="cx" style="display: block; padding: 0 10px"> * }
</span><span class="cx" style="display: block; padding: 0 10px"> * @return WP_Post|WP_Error Inserted auto-draft post object or error.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -745,18 +747,22 @@
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! isset( $postarr['post_type'] ) || ! post_type_exists( $postarr['post_type'] ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> return new WP_Error( 'unknown_post_type', __( 'Unknown post type' ) );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( ! isset( $postarr['post_title'] ) ) {
- $postarr['post_title'] = '';
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( empty( $postarr['post_title'] ) ) {
+ return new WP_Error( 'empty_title', __( 'Empty title' ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( ! empty( $postarr['post_status'] ) ) {
+ return new WP_Error( 'status_forbidden', __( 'Status is forbidden' ) );
+ }
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $postarr['post_status'] = 'auto-draft';
+
+ // Auto-drafts are allowed to have empty post_names, so it has to be explicitly set.
+ if ( empty( $postarr['post_name'] ) ) {
+ $postarr['post_name'] = sanitize_title( $postarr['post_title'] );
+ }
+
</ins><span class="cx" style="display: block; padding: 0 10px"> add_filter( 'wp_insert_post_empty_content', '__return_false', 1000 );
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $args = array(
- 'post_status' => 'auto-draft',
- 'post_type' => $postarr['post_type'],
- 'post_title' => $postarr['post_title'],
- 'post_name' => sanitize_title( $postarr['post_title'] ), // Auto-drafts are allowed to have empty post_names, so we need to explicitly set it.
- );
- $r = wp_insert_post( wp_slash( $args ), true );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $r = wp_insert_post( wp_slash( $postarr ), true );
</ins><span class="cx" style="display: block; padding: 0 10px"> remove_filter( 'wp_insert_post_empty_content', '__return_false', 1000 );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( is_wp_error( $r ) ) {
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -785,15 +791,18 @@
</span><span class="cx" style="display: block; padding: 0 10px"> wp_send_json_error( 'missing_params', 400 );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $params = wp_array_slice_assoc(
- array_merge(
- array(
- 'post_type' => '',
- 'post_title' => '',
- ),
- wp_unslash( $_POST['params'] )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $params = wp_unslash( $_POST['params'] );
+ $illegal_params = array_diff( array_keys( $params ), array( 'post_type', 'post_title' ) );
+ if ( ! empty( $illegal_params ) ) {
+ wp_send_json_error( 'illegal_params', 400 );
+ }
+
+ $params = array_merge(
+ array(
+ 'post_type' => '',
+ 'post_title' => '',
</ins><span class="cx" style="display: block; padding: 0 10px"> ),
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- array( 'post_type', 'post_title' )
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $params
</ins><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( empty( $params['post_type'] ) || ! post_type_exists( $params['post_type'] ) ) {
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -1139,7 +1148,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $post_ids = $setting->post_value();
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! empty( $post_ids ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> foreach ( $post_ids as $post_id ) {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_publish_post( $post_id );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ // Note that wp_publish_post() cannot be used because unique slugs need to be assigned.
+ wp_update_post( array( 'ID' => $post_id, 'post_status' => 'publish' ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunktestsphpunittestsajaxCustomizeMenusphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/tests/phpunit/tests/ajax/CustomizeMenus.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/tests/phpunit/tests/ajax/CustomizeMenus.php 2016-10-30 18:52:58 UTC (rev 39037)
+++ trunk/tests/phpunit/tests/ajax/CustomizeMenus.php 2016-10-30 20:20:54 UTC (rev 39038)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -547,6 +547,10 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $this->assertTrue( $response['success'] );
</span><span class="cx" style="display: block; padding: 0 10px"> $this->assertArrayHasKey( 'post_id', $response['data'] );
</span><span class="cx" style="display: block; padding: 0 10px"> $this->assertArrayHasKey( 'url', $response['data'] );
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $post = get_post( $response['data']['post_id'] );
+ $this->assertEquals( 'Hello World', $post->post_title );
+ $this->assertEquals( 'post', $post->post_type );
+ $this->assertEquals( 'hello-world', $post->post_name );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -635,5 +639,21 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $response = json_decode( $this->_last_response, true );
</span><span class="cx" style="display: block; padding: 0 10px"> $this->assertFalse( $response['success'] );
</span><span class="cx" style="display: block; padding: 0 10px"> $this->assertEquals( 'missing_post_title', $response['data'] );
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+
+ // illegal_params.
+ $_POST = wp_slash( array(
+ 'customize-menus-nonce' => wp_create_nonce( 'customize-menus' ),
+ 'params' => array(
+ 'post_type' => 'post',
+ 'post_title' => 'OK',
+ 'post_name' => 'bad',
+ 'post_content' => 'bad',
+ ),
+ ) );
+ $this->_last_response = '';
+ $this->make_ajax_call( 'customize-nav-menus-insert-auto-draft' );
+ $response = json_decode( $this->_last_response, true );
+ $this->assertFalse( $response['success'] );
+ $this->assertEquals( 'illegal_params', $response['data'] );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunktestsphpunittestscustomizenavmenusphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/tests/phpunit/tests/customize/nav-menus.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/tests/phpunit/tests/customize/nav-menus.php 2016-10-30 18:52:58 UTC (rev 39037)
+++ trunk/tests/phpunit/tests/customize/nav-menus.php 2016-10-30 20:20:54 UTC (rev 39038)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -542,11 +542,22 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $this->assertInstanceOf( 'WP_Error', $r );
</span><span class="cx" style="display: block; padding: 0 10px"> $this->assertEquals( 'unknown_post_type', $r->get_error_code() );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $r = $menus->insert_auto_draft_post( array( 'post_status' => 'publish', 'post_title' => 'Bad', 'post_type' => 'post' ) );
+ $this->assertInstanceOf( 'WP_Error', $r );
+ $this->assertEquals( 'status_forbidden', $r->get_error_code() );
+
</ins><span class="cx" style="display: block; padding: 0 10px"> $r = $menus->insert_auto_draft_post( array( 'post_title' => 'Hello World', 'post_type' => 'post' ) );
</span><span class="cx" style="display: block; padding: 0 10px"> $this->assertInstanceOf( 'WP_Post', $r );
</span><span class="cx" style="display: block; padding: 0 10px"> $this->assertEquals( 'Hello World', $r->post_title );
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $this->assertEquals( 'hello-world', $r->post_name );
</ins><span class="cx" style="display: block; padding: 0 10px"> $this->assertEquals( 'post', $r->post_type );
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $this->assertEquals( sanitize_title( $r->post_title ), $r->post_name );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+
+ $r = $menus->insert_auto_draft_post( array( 'post_title' => 'Hello World', 'post_type' => 'post', 'post_name' => 'greetings-world', 'post_content' => 'Hi World' ) );
+ $this->assertInstanceOf( 'WP_Post', $r );
+ $this->assertEquals( 'Hello World', $r->post_title );
+ $this->assertEquals( 'post', $r->post_type );
+ $this->assertEquals( 'greetings-world', $r->post_name );
+ $this->assertEquals( 'Hi World', $r->post_content );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -731,6 +742,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $post_ids = $this->factory()->post->create_many( 3, array(
</span><span class="cx" style="display: block; padding: 0 10px"> 'post_status' => 'auto-draft',
</span><span class="cx" style="display: block; padding: 0 10px"> 'post_type' => 'post',
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'post_name' => 'auto-draft',
</ins><span class="cx" style="display: block; padding: 0 10px"> ) );
</span><span class="cx" style="display: block; padding: 0 10px"> $pre_published_post_id = $this->factory()->post->create( array( 'post_status' => 'publish' ) );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -750,6 +762,11 @@
</span><span class="cx" style="display: block; padding: 0 10px"> foreach ( $post_ids as $post_id ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $this->assertEquals( 'publish', get_post_status( $post_id ) );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+
+ // Ensure that unique slugs were assigned.
+ $posts = array_map( 'get_post', $post_ids );
+ $post_names = wp_list_pluck( $posts, 'post_name' );
+ $this->assertEqualSets( $post_names, array_unique( $post_names ) );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span></span></pre>
</div>
</div>
</body>
</html>