WP-API · BE-Webdesign · Feb 13, 2016 · Feb 13, 2016 · Feb 13, 2016 · Feb 14, 2016
diff --git a/lib/endpoints/class-wp-rest-posts-controller.php b/lib/endpoints/class-wp-rest-posts-controller.php
@@ -627,6 +627,7 @@ protected function get_allowed_query_vars() {
 			'post_parent__not_in',
 			'posts_per_page',
 			'date_query',
+			'tax_query',
 		);
 		$valid_vars = array_merge( $valid_vars, $rest_valid );
 
@@ -1749,6 +1750,7 @@ public function get_collection_params() {
 		);
 		$params['filter'] = array(
 			'description'       => __( 'Use WP Query arguments to modify the response; private query vars require appropriate authorization.' ),
+			'validate_callback' => array( $this, 'rest_validate_query_filter' ),
 		);
 
 		$taxonomies = wp_list_filter( get_object_taxonomies( $this->post_type, 'objects' ), array( 'show_in_rest' => true ) );
@@ -1784,4 +1786,86 @@ public function validate_user_can_query_private_statuses( $value, $request, $par
 		return new WP_Error( 'rest_forbidden_status', __( 'Status is forbidden' ), array( 'status' => rest_authorization_required_code() ) );
 	}
 
+	/**
+	 * Validate filter param.
+	 *
+	 * This function can be used to validate query params passed by the filter request param.
+	 *
+	 * @param  mixed           $value     Value of the parameter.
+	 * @param  WP_REST_Request $request   Request body.
+	 * @param  string          $parameter Name of the parameter. Should be tax_query.
+	 * @return WP_Error|boolean
+	 */
+	public function rest_validate_query_filter( $values, $request, $parameter ) {
+		// Returns true for validation by default if $values is empty or if a filter param is not being validated.
+		$is_valid = true;
+		if ( ! empty( $values ) ) {
+			foreach ( $values as $filter_param => $value ) {
+				switch ( $filter_param ) {
+					case 'tax_query' :
+						$is_valid = $this->rest_validate_tax_query( $value, $request, $filter_param );
+						// If an error is found exit early and it will throw an error for request->has_valid_params();
+						if ( is_wp_error( $is_valid ) ) {
+							return $is_valid;
+						}
+						continue;
+					default :
+						continue;
+				}
+			}
+		}
+		return $is_valid;
+	}
+
+	/**
+	 * Validate tax query.
+	 *
+	 * @param  mixed           $value      Value of the parameter.
+	 * @param  WP_REST_Request $request    Request body.
+	 * @param  string          $parameter  Name of the parameter. Should be tax_query.
+	 * @param  array           $taxonomies Taxonomies that are to be shown in the REST API.
+	 * @return WP_Error|boolean
+	 */
+	public function rest_validate_tax_query( $values, $request, $parameter, $taxonomies = array() ) {
+		if ( 'tax_query' !== $parameter ) {
+			return new WP_Error( 'rest_invalid_param', __( 'This validation method is only used to validate a tax query.' ), array( 'status' => 400 ) );
+		}
+		$valid = true;
+		if ( ! empty( $values ) ) {
+			foreach ( $values as $key => $value ) {
+				if ( empty( $value ) ) {
+					//return new WP_Error( 'rest_invalid_param', __( 'A tax query parameter in the filter was empty.' ), array( 'status' => 400 ) );
+				}
+				// Switch statement to handle different cases.
+				// Recursive call to function to handle nested taxonomy queries.
+				if ( is_array( $value ) && 'terms' !== $key ) {
+					$valid = $this->rest_validate_tax_query( $value, $request, $parameter, $taxonomies );
+					// If an error is found keep returning it up the chain.
+					if ( is_wp_error( $valid ) ) {
+						return $valid;
+					}
+				}
+				if ( ! is_numeric( $key ) ) {
+					switch ( $key ) {
+						case 'taxonomy' :
+							// If $taxonomies is empty by default set it. On reoccurring calls the function overhead is avoided.
+							if ( empty( $taxonomies ) ) {
+								$taxonomies = wp_list_filter( get_object_taxonomies( $this->post_type, 'objects' ), array( 'show_in_rest' => true ) );
+							}
+							// Validate taxonomy.
+							if ( array_key_exists( $value, $taxonomies ) ) {
+								$valid = true;
+							} else {
+								/* translators: %s equals taxonomy name being checked. */
+								return new WP_Error( 'rest_invalid_param', sprintf( __( 'The taxonomy %s specified in the filter does not exist.' ), $value ), array( 'status' => 400 ) );
+							}
+							continue;
+						default :
+							continue;
+					}
+				}
+			}
+		}
+		return $valid;
+	}
 }
diff --git a/tests/test-rest-posts-controller.php b/tests/test-rest-posts-controller.php
@@ -474,6 +474,67 @@ public function test_get_items_valid_date() {
 		$this->assertEquals( $post2, $data[0]['id'] );
 	}
 
+	public function test_get_items_valid_tax_query_in_filter() {
+		$term1 = $this->factory->term->create( array( 'taxonomy' => 'category', 'name' => 'basie' ) );
+		$post1 = $this->factory->post->create();
+		$post2 = $this->factory->post->create( array( 'post_category' => array( $term1 ) ) );
+		$post3 = $this->factory->post->create();
+
+		$request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+		$request->set_param( 'filter', array(
+			// @codingStandardsIgnoreStart
+			'tax_query' => array( // WPCS: tax_query ok.
+				array(
+					'taxonomy' => 'category',
+					'field'    => 'slug',
+					'terms'    => 'basie',
+				),
+			),
+			// @codingStandardsIgnoreEnd
+		) );
+		$response = $this->server->dispatch( $request );
+		$data = $response->get_data();
+		$this->assertCount( 1, $data );
+		$this->assertEquals( $post2, $data[0]['id'] );
+		$this->assertEquals( $term1, $data[0]['categories'][0] );
+	}
+
+	public function test_get_items_invalid_tax_query_in_filter() {
+		$post1 = $this->factory->post->create();
+
+		$request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+		$request->set_param( 'filter', array(
+			// @codingStandardsIgnoreStart
+			'tax_query' => array( // WPCS: tax_query ok.
+				array(
+					'taxonomy' => 'category',
+					'field'    => 'slug',
+					'terms'    => 'duke',
+				),
+			),
+			// @codingStandardsIgnoreEnd
+		) );
+		$response = $this->server->dispatch( $request );
+		$data = $response->get_data();
+		$this->assertCount( 0, $data );
+		$this->assertEquals( array(), $data );
+
+		$request = new WP_REST_Request( 'GET', '/wp/v2/posts' );
+		$request->set_param( 'filter', array(
+			// @codingStandardsIgnoreStart
+			'tax_query' => array( // WPCS: tax_query ok.
+				array(
+					'taxonomy' => 'mingus',
+					'field'    => 'slug',
+					'terms'    => 'duke',
+				),
+			),
+			// @codingStandardsIgnoreEnd
+		) );
+		$response = $this->server->dispatch( $request );
+		$this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
+	}
+
 	public function test_get_item() {
 		$request = new WP_REST_Request( 'GET', sprintf( '/wp/v2/posts/%d', $this->post_id ) );
 		$response = $this->server->dispatch( $request );