Merge branch 'WordPress:trunk' into trunk

Author: dd32

src/wp-includes/class-wp-customize-manager.php

@@ -1936,7 +1936,6 @@ public function customize_preview_init() {
 					'<code>customize_messenger_channel</code>'
 				)
 			);
-			return;
 		}
 
 		$this->prepare_controls();
@@ -3166,7 +3165,6 @@ public function handle_changeset_trash_request() {
 					'code'    => 'non_existent_changeset',
 				)
 			);
-			return;
 		}
 
 		if ( ! current_user_can( get_post_type_object( 'customize_changeset' )->cap->delete_post, $changeset_post_id ) ) {
@@ -3197,7 +3195,6 @@ public function handle_changeset_trash_request() {
 					'code'    => 'changeset_already_trashed',
 				)
 			);
-			return;
 		}
 
 		$r = $this->trash_changeset_post( $changeset_post_id );

src/wp-includes/rest-api/endpoints/class-wp-rest-global-styles-controller.php

@@ -673,13 +673,22 @@ public function get_theme_items( $request ) {
 	 * @since 7.0.0 Only restricts contents which risk prematurely closing the STYLE element,
 	 *              either through a STYLE end tag or a prefix of one which might become a
 	 *              full end tag when combined with the contents of other styles.
+	 * @since 7.1.0 Rejects non-string values with a WP_Error instead of a fatal error.
 	 *
 	 * @see WP_Customize_Custom_CSS_Setting::validate()
 	 *
-	 * @param string $css CSS to validate.
+	 * @param mixed $css CSS to validate.
 	 * @return true|WP_Error True if the input was validated, otherwise WP_Error.
 	 */
 	protected function validate_custom_css( $css ) {
+		if ( ! is_string( $css ) ) {
+			return new WP_Error(
+				'rest_custom_css_invalid_type',
+				__( 'CSS must be a string.' ),
+				array( 'status' => 400 )
+			);
+		}
+
 		$length = strlen( $css );
 		for (
 			$at = strcspn( $css, '<' );

tests/phpunit/tests/rest-api/rest-global-styles-controller.php

@@ -667,6 +667,25 @@ public function test_update_item_invalid_styles_css() {
 		$this->assertErrorResponse( 'rest_custom_css_illegal_markup', $response, 400 );
 	}
 
+	/**
+	 * @covers WP_REST_Global_Styles_Controller::update_item
+	 * @ticket 65640
+	 */
+	public function test_update_item_non_string_styles_css() {
+		wp_set_current_user( self::$admin_id );
+		if ( is_multisite() ) {
+			grant_super_admin( self::$admin_id );
+		}
+		$request = new WP_REST_Request( 'PUT', '/wp/v2/global-styles/' . self::$global_styles_id );
+		$request->set_body_params(
+			array(
+				'styles' => array( 'css' => array( 'body { color: red; }' ) ),
+			)
+		);
+		$response = rest_get_server()->dispatch( $request );
+		$this->assertErrorResponse( 'rest_custom_css_invalid_type', $response, 400 );
+	}
+
 	/**
 	 * Tests the submission of a custom block style variation that was defined
 	 * within a theme style variation and wouldn't be registered at the time
@@ -946,4 +965,42 @@ public static function data_custom_css_disallowed(): array {
 			'truncated "</stYle"'        => array( '</stYle', 'The CSS must not end in "&lt;/stYle".' ),
 		);
 	}
+
+	/**
+	 * @covers WP_REST_Global_Styles_Controller::validate_custom_css
+	 * @ticket 65640
+	 *
+	 * @dataProvider data_custom_css_non_string
+	 *
+	 * @param mixed $custom_css Non-string value to validate.
+	 */
+	public function test_validate_custom_css_non_string( $custom_css ) {
+		$controller = new WP_REST_Global_Styles_Controller();
+		$validate   = Closure::bind(
+			function ( $css ) {
+				return $this->validate_custom_css( $css );
+			},
+			$controller,
+			$controller
+		);
+
+		$result = $validate( $custom_css );
+		$this->assertWPError( $result );
+		$this->assertSame( 'rest_custom_css_invalid_type', $result->get_error_code() );
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array<string, mixed[]>
+	 */
+	public static function data_custom_css_non_string(): array {
+		return array(
+			'array'   => array( array( 'body { color: red; }' ) ),
+			'integer' => array( 123 ),
+			'boolean' => array( true ),
+			'null'    => array( null ),
+			'object'  => array( new stdClass() ),
+		);
+	}
 }