Skip to content
This repository was archived by the owner on Sep 24, 2018. It is now read-only.

Conversation

@danielbachhuber
Copy link
Member

Clients should only be able to request categories from the category route, and tags from the tag route

Fixes #1763

Clients should only be able to request categories from the category
route, and tags from the tag route
@danielbachhuber danielbachhuber added this to the 2.0 Beta 8 milestone Nov 23, 2015
@danielbachhuber
Copy link
Member Author

@WP-API/amigos #reviewmerge

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How is this possible? My understanding is get_term_by will return null for a term_id that doesn't belong to that taxonomy, and no shared terms should now have stopped that being unexpected.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How is this possible?

The test case fails as expected on nightly https://travis-ci.org/WP-API/WP-API/jobs/92832027

My understanding is get_term_by will return null for a term_id that doesn't belong to that taxonomy, and no shared terms should now have stopped that being unexpected.

Nope:

} elseif ( 'term_taxonomy_id' == $field ) {
    $value = (int) $value;
    $_field = 'tt.term_taxonomy_id';

    // No `taxonomy` clause when searching by 'term_taxonomy_id'.
    $tax_clause = '';
} else {
    $term = get_term( (int) $value, $taxonomy, $output, $filter );
    if ( is_wp_error( $term ) || is_null( $term ) ) {
        $term = false;
    }
    return $term;
}

$term = $wpdb->get_row( $wpdb->prepare( "SELECT t.*, tt.* FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy AS tt ON t.term_id = tt.term_id WHERE $_field = %s $tax_clause LIMIT 1", $value ) );
if ( ! $term )
    return false;

// In the case of 'term_taxonomy_id', override the provided `$taxonomy` with whatever we find in the db.
if ( 'term_taxonomy_id' === $field ) {
    $taxonomy = $term->taxonomy;
}

If term_taxonomy_id is provided, then get_term_by() ignores the provided taxonomy

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How is this possible? My understanding is get_term_by will return null for a term_id that doesn't belong to that taxonomy, and no shared terms should now have stopped that being unexpected.

This changed in 4.4, see #1644 and WP30620.

danielbachhuber added a commit that referenced this pull request Nov 30, 2015
Don't permit requesting terms cross routes
@danielbachhuber danielbachhuber merged commit 49212a1 into develop Nov 30, 2015
@danielbachhuber danielbachhuber deleted the 1763-term-cross-route branch November 30, 2015 16:01
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants