Repository navigation
Conversation
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. Props Bot commandsYou can trigger Props Bot actions by commenting on this PR:
|
Test using WordPress PlaygroundThe changes in this pull request can previewed and tested using a WordPress Playground instance. WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser. Some things to be aware of
For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation. |
jorgefilipecosta
left a comment
jorgefilipecosta
left a comment
There was a problem hiding this comment.
Did some smoke testing and behavior looks good to me 👍
zaguiini
left a comment
zaguiini
left a comment
There was a problem hiding this comment.
Love that ✨
and returns the prepared input or the first WP_Error.
Would it be possible to return all the failed inputs? That's related to https://core.trac.wordpress.org/ticket/66436.
Adds `WP_Ability::prepare_input()`, which normalizes, validates, and sanitizes the input in one call. `execute()` and the REST run controller now use it, so they no longer repeat the three steps. Integrations that call `check_permissions()` directly can also use it. `coerce_input()` is renamed to the protected `sanitize_input()`. It must only run on validated input, so `prepare_input()` is now the public way to reach it. `coerce_input()` was added in 7.2 and has not been released yet. The documentation now refers to `prepare_input()` instead of listing each step. Tests about the sanitization step use "sanitization" in their names. See #66383.
0fc0606 to
eece764
Compare
|
@jorgefilipecosta Good catch, thanks! Both documentation points are addressed in f822e2752c. @zaguiini A |
gziolo
changed the title
coerce_input() with prepare_input()
Add a public `WP_Ability::prepare_input()` method that normalizes, validates, and sanitizes input in one call. Use it in `WP_Ability::execute()` and the REST run controller. Rename `coerce_input()` to the protected `sanitize_input()`, so sanitization cannot run on input that was not validated. `coerce_input()` was not released yet, so this is not a breaking change. Developed in #15685. Follow-up to [65044], [65306]. Props gziolo, jorgefilipecosta, justlevine, zaguiini. See #66383. Fixes #66482. git-svn-id: https://develop.svn.wordpress.org/trunk@65370 602fd350-edb4-49c9-b593-d223f7449a82
Add a public `WP_Ability::prepare_input()` method that normalizes, validates, and sanitizes input in one call. Use it in `WP_Ability::execute()` and the REST run controller. Rename `coerce_input()` to the protected `sanitize_input()`, so sanitization cannot run on input that was not validated. `coerce_input()` was not released yet, so this is not a breaking change. Developed in WordPress/wordpress-develop#15685. Follow-up to [65044], [65306]. Props gziolo, jorgefilipecosta, justlevine, zaguiini. See #66383. Fixes #66482. Built from https://develop.svn.wordpress.org/trunk@65370 git-svn-id: http://core.svn.wordpress.org/trunk@64509 1a063a9b-81f0-0310-95a4-ce76da25c4cd
What
Input preparation is repeated in
WP_Ability::execute()and the REST run controller. This PR adds a publicWP_Ability::prepare_input()method that normalizes, validates, and sanitizes input in one call, returning the prepared input or the firstWP_Error.execute()usesprepare_input()instead of calling the three steps itself.check_ability_permissions()callsprepare_input()on the raw request input, replacing the privateprepare_input_for_ability()helper.coerce_input()is renamed to the protectedsanitize_input(). Sanitizing input that was not validated can hide validation errors, soprepare_input()is now the public way to run it.coerce_input()was added in 7.2 and has not been released yet, so this is not a breaking change.This PR is rebased onto trunk after #15684 landed and contains only the
prepare_input()commit. It preserves trunk's raw-input handling and the deprecated, pass-throughsanitize_input_for_ability()method.Why
Callers currently have to run
normalize_input(),validate_input(), andcoerce_input()in the right order, stopping at the first error.prepare_input()centralizes that sequence for execution, REST permission checks, and integrations that callcheck_permissions()directly.Documentation
The docs now refer to
prepare_input()instead of listing each step. This covers the Abilities API overview,check_permissions(),execute(), and the hook docs. Tests about the sanitization step now use "sanitization" in their names, to match the method name. Tests about type conversion keep "coerce".Testing
Verified after rebasing onto trunk:
npm run test:php -- --filter=Abilitpasses: 1,863 tests and 6,612 assertions.npm run typecheck:phppasses with no errors.Trac ticket: https://core.trac.wordpress.org/ticket/66482, https://core.trac.wordpress.org/ticket/66383
Use of AI Tools
AI assistance: Yes
Tool(s): Claude Code, Codex
Model(s): Claude Opus 5.5; GPT-6 (Codex)
Used for: Implementation, documentation updates, and test renames, iterated on together with me. I reviewed the original code and tests. Codex assisted with the rebase, conflict resolution, verification, and PR description update.
This Pull Request is for code review only. Please keep all other discussion in the Trac ticket. Do not merge this Pull Request. See GitHub Pull Requests for Code Review in the Core Handbook for more details.