Commit 5d1be2b90b for wordpress.org

commit 5d1be2b90b514df56bb4c84a0a7b670bbedc8cf2
Author: gziolo <gziolo@git.wordpress.org>
Date:   Mon Oct 26 08:35:52 2026 +0000

    Abilities API: Normalize inputs in core information abilities

    Support object inputs and comma- or whitespace-separated field lists
    during direct execution. Preserve empty-selection defaults and validation
    of field names. Add regression tests.

    Props gziolo, jorgefilipecosta.
    Fixes #66370.


    Built from https://develop.svn.wordpress.org/trunk@64729


    git-svn-id: http://core.svn.wordpress.org/trunk@63879 1a063a9b-81f0-0310-95a4-ce76da25c4cd

diff --git a/wp-includes/abilities.php b/wp-includes/abilities.php
index 3bb533a440..c4489f7e36 100644
--- a/wp-includes/abilities.php
+++ b/wp-includes/abilities.php
@@ -136,8 +136,11 @@ function wp_register_core_abilities(): void {
 				'additionalProperties' => false,
 			),
 			'execute_callback'      => static function ( $input = array() ) use ( $site_info_fields ): array {
-				$input = is_array( $input ) ? $input : array();
-				$requested_fields = ! empty( $input['fields'] ) ? $input['fields'] : $site_info_fields;
+				$input            = rest_sanitize_object( $input );
+				$requested_fields = rest_sanitize_array( $input['fields'] ?? array() );
+				if ( empty( $requested_fields ) ) {
+					$requested_fields = $site_info_fields;
+				}

 				$result = array();
 				foreach ( $requested_fields as $field ) {
@@ -251,9 +254,12 @@ function wp_register_core_abilities(): void {
 				'additionalProperties' => false,
 			),
 			'execute_callback'    => static function ( $input = array() ) use ( $user_info_fields ): array {
-				$input            = is_array( $input ) ? $input : array();
-				$requested_fields = ! empty( $input['fields'] ) ? $input['fields'] : $user_info_fields;
-				$current_user     = wp_get_current_user();
+				$input            = rest_sanitize_object( $input );
+				$requested_fields = rest_sanitize_array( $input['fields'] ?? array() );
+				if ( empty( $requested_fields ) ) {
+					$requested_fields = $user_info_fields;
+				}
+				$current_user = wp_get_current_user();

 				$all = array(
 					'id'            => $current_user->ID,
@@ -340,9 +346,12 @@ function wp_register_core_abilities(): void {
 			'execute_callback'      => static function ( $input = array() ) use ( $environment_info_fields ): array {
 				global $wpdb;

-				/** @var array{ fields?: string[] } $input */
-				$input            = is_array( $input ) ? $input : array();
-				$requested_fields = ! empty( $input['fields'] ) ? $input['fields'] : $environment_info_fields;
+				$input = rest_sanitize_object( $input );
+				/** @var array{ fields?: string[]|string } $input */
+				$requested_fields = rest_sanitize_array( $input['fields'] ?? array() );
+				if ( empty( $requested_fields ) ) {
+					$requested_fields = $environment_info_fields;
+				}

 				$db_server_info = '';
 				if ( method_exists( $wpdb, 'db_server_info' ) ) {
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 29244aa268..eab9c38e6a 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -16,7 +16,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '7.2-beta1-64728';
+$wp_version = '7.2-beta1-64729';

 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.