[wp-trac] [WordPress Trac] #37247: Sanitization needs to come after validation in WP_Customize_Manager

[WordPress Trac]

#37247: Sanitization needs to come after validation in WP_Customize_Manager
--------------------------+-----------------------------
 Reporter:  schlessera    |      Owner:
     Type:  defect (bug)  |     Status:  new
 Priority:  normal        |  Milestone:  Awaiting Review
Component:  Customize     |    Version:
 Severity:  normal        |   Keywords:
  Focuses:                |
--------------------------+-----------------------------
 In `WP_Customize_Manager`, the following methods validate after
 sanitizing:

 - `post_value()`
 - `validate_setting_values()`

 Validation is checking whether the input is valid according to business
 rules. Sanitization is transforming the input to make it ready to be
 persisted.

 The order in which they are used within the above methods, apart from just
 conceptually being the wrong way around, might cause a valid input to fail
 validation because the sanitization had already changed it.

 Related to #37192

--
Ticket URL: <https://core.trac.wordpress.org/ticket/37247>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform