[wp-trac] [WordPress Trac] #43392: Support 'object' and 'array' types in register_meta()

[WordPress Trac]

#43392: Support 'object' and 'array' types in register_meta()
-------------------------------------------------+-------------------------
 Reporter:  diegoliv                             |       Owner:
                                                 |  TimothyBlynJacobs
     Type:  enhancement                          |      Status:  reopened
 Priority:  normal                               |   Milestone:  5.3
Component:  Options, Meta APIs                   |     Version:  4.9.4
 Severity:  normal                               |  Resolution:
 Keywords:  has-patch has-unit-tests dev-        |     Focuses:  rest-api
  feedback commit needs-dev-note                 |
-------------------------------------------------+-------------------------

Comment (by TimothyBlynJacobs):

 Going to bring this up at today's REST API office hours.

 So I think the intention is that `items` is always required. Without it,
 you'd be saying that anything is allowed, which we really don't want to be
 the default behavior.

 In #38531, it was decided to follow the spec for the low-level
 `rest_(sanitize|validate)_value_from_schema` and allow a schema definition
 without `items`. However, this wasn't applied to
 `rest_validate_value_from_schema`. It has no [https://github.com/WordPress
 /wordpress-develop/blob/1b7bba613d310ed87a8ee25276b990c12f14a554/src/wp-
 includes/rest-api.php#L1299 check for empty items]. Looking at #38583, I
 think the goal was to apply the stricter validation requirements in the
 controllers that need them.

 Right now, this isn't the case, any value will be accepted, and PHP
 warnings are emitted from the processing in `WP_REST_Meta_Fields` and
 `rest_validate_value_from_schema` which assumes an `array` type has an
 `items` definition.

 We could enforce this in `register_meta()` if someone has an `array` type
 without providing an `items` in `show_in_rest.schema`. The function allows
 for a `false` return value, and we could issue a `_doing_it_wrong`.
 Alternatively just change the signature to `bool|WP_Error`.

 Of note you'll also get a similar warning if you don't provide `items`
 when registering an `array` type setting. We should probably make any
 changes here consistent if possible.

 // Test case
 {{{#!php
 <?php
 function
 test_not_providing_items_for_array_meta_type_does_not_allow_any_value_through()
 {
         register_post_meta(
                 'post',
                 'list',
                 array(
                         'type'         => 'array',
                         'single'       => true,
                         'show_in_rest' => true,
                 )
         );

         $this->grant_write_permission();

         $request = new WP_REST_Request( 'PUT', sprintf( '/wp/v2/posts/%d',
 self::$post_id ) );
         $request->set_body_params(
                 array(
                         'meta' => array(
                                 'list' => array( 'WordPress', 'bbPress' ),
                         ),
                 )
         );

         // Suppress the "items" warning temporarily
         $response = @rest_get_server()->dispatch( $request );
         $this->assertEquals( 400, $response->get_status() );

         $meta = get_post_meta( self::$post_id, 'list', true );
         $this->assertEmpty( $meta );
 }
 }}}

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/43392#comment:47>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform