From 94578964293c5631e329f19b141e13e222e5e901 Mon Sep 17 00:00:00 2001
From: "K. Adam White" <kadamwhite@gmail.com>
Date: Thu, 19 Sep 2019 14:36:55 +0000
Subject: [PATCH] REST API: Issue warning if array meta is registered without
 item schema.

The purpose of meta registration is to assert that the meta key will contain a predictable value conforming to a schema, so the schema is therefore considered to be required.

Props TimothyBlynJacobs, grapplerulrich.
Fixes #43392.

Built from https://develop.svn.wordpress.org/trunk@46186


git-svn-id: http://core.svn.wordpress.org/trunk@45998 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 wp-includes/meta.php    | 35 ++++++++++++++++++++++++-----------
 wp-includes/version.php |  2 +-
 2 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/wp-includes/meta.php b/wp-includes/meta.php
index 3966a23469..bc6b05d953 100644
--- a/wp-includes/meta.php
+++ b/wp-includes/meta.php
@@ -1115,23 +1115,27 @@ function sanitize_meta( $meta_key, $meta_value, $object_type, $object_subtype =
  *              to support an array of data to attach to registered meta keys}. Previous arguments for
  *              `$sanitize_callback` and `$auth_callback` have been folded into this array.
  * @since 4.9.8 The `$object_subtype` argument was added to the arguments array.
+ * @since 5.3.0 Valid meta types expanded to include "array" and "object".
  *
  * @param string $object_type    Type of object this meta is registered to.
  * @param string $meta_key       Meta key to register.
  * @param array  $args {
  *     Data used to describe the meta key when registered.
  *
- *     @type string $object_subtype    A subtype; e.g. if the object type is "post", the post type. If left empty,
- *                                     the meta key will be registered on the entire object type. Default empty.
- *     @type string $type              The type of data associated with this meta key.
- *                                     Valid values are 'string', 'boolean', 'integer', and 'number'.
- *     @type string $description       A description of the data attached to this meta key.
- *     @type bool   $single            Whether the meta key has one value per object, or an array of values per object.
- *     @type string $sanitize_callback A function or method to call when sanitizing `$meta_key` data.
- *     @type string $auth_callback     Optional. A function or method to call when performing edit_post_meta, add_post_meta, and delete_post_meta capability checks.
- *     @type bool   $show_in_rest      Whether data associated with this meta key can be considered public and
- *                                     should be accessible via the REST API. A custom post type must also declare
- *                                     support for custom fields for registered meta to be accessible via REST.
+ *     @type string     $object_subtype    A subtype; e.g. if the object type is "post", the post type. If left empty,
+ *                                         the meta key will be registered on the entire object type. Default empty.
+ *     @type string     $type              The type of data associated with this meta key.
+ *                                         Valid values are 'string', 'boolean', 'integer', 'number', 'array', and 'object'.
+ *     @type string     $description       A description of the data attached to this meta key.
+ *     @type bool       $single            Whether the meta key has one value per object, or an array of values per object.
+ *     @type string     $sanitize_callback A function or method to call when sanitizing `$meta_key` data.
+ *     @type string     $auth_callback     Optional. A function or method to call when performing edit_post_meta,
+ *                                         add_post_meta, and delete_post_meta capability checks.
+ *     @type bool|array $show_in_rest      Whether data associated with this meta key can be considered public and
+ *                                         should be accessible via the REST API. A custom post type must also declare
+ *                                         support for custom fields for registered meta to be accessible via REST.
+ *                                         When registering complex meta values this argument may optionally be an
+ *                                         array with 'schema' or 'prepare_callback' keys instead of a boolean.
  * }
  * @param string|array $deprecated Deprecated. Use `$args` instead.
  *
@@ -1188,6 +1192,15 @@ function register_meta( $object_type, $meta_key, $args, $deprecated = null ) {
 	$args = apply_filters( 'register_meta_args', $args, $defaults, $object_type, $meta_key );
 	$args = wp_parse_args( $args, $defaults );
 
+	// Require an item schema when registering array meta.
+	if ( false !== $args['show_in_rest'] && 'array' === $args['type'] ) {
+		if ( ! is_array( $args['show_in_rest'] ) || ! isset( $args['show_in_rest']['schema']['items'] ) ) {
+			_doing_it_wrong( __FUNCTION__, __( 'When registering an "array" meta type to show in the REST API, you must specify the schema for each array item in "show_in_rest.schema.items".' ), '5.3.0' );
+
+			return false;
+		}
+	}
+
 	$object_subtype = ! empty( $args['object_subtype'] ) ? $args['object_subtype'] : '';
 
 	// If `auth_callback` is not provided, fall back to `is_protected_meta()`.
diff --git a/wp-includes/version.php b/wp-includes/version.php
index 275382f1b0..79229420fe 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -13,7 +13,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '5.3-alpha-46185';
+$wp_version = '5.3-alpha-46186';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.