{"action":"created","issue":{"url":"https://api.github.com/repos/WP-API/WP-API/issues/2616","repository_url":"https://api.github.com/repos/WP-API/WP-API","labels_url":"https://api.github.com/repos/WP-API/WP-API/issues/2616/labels{/name}","comments_url":"https://api.github.com/repos/WP-API/WP-API/issues/2616/comments","events_url":"https://api.github.com/repos/WP-API/WP-API/issues/2616/events","html_url":"https://github.com/WP-API/WP-API/issues/2616","id":167509057,"number":2616,"title":"Boolean request args fail validation","user":{"login":"rachelbaker","id":979807,"avatar_url":"https://avatars.githubusercontent.com/u/979807?v=3","gravatar_id":"","url":"https://api.github.com/users/rachelbaker","html_url":"https://github.com/rachelbaker","followers_url":"https://api.github.com/users/rachelbaker/followers","following_url":"https://api.github.com/users/rachelbaker/following{/other_user}","gists_url":"https://api.github.com/users/rachelbaker/gists{/gist_id}","starred_url":"https://api.github.com/users/rachelbaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rachelbaker/subscriptions","organizations_url":"https://api.github.com/users/rachelbaker/orgs","repos_url":"https://api.github.com/users/rachelbaker/repos","events_url":"https://api.github.com/users/rachelbaker/events{/privacy}","received_events_url":"https://api.github.com/users/rachelbaker/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-07-26T02:40:02Z","updated_at":"2016-07-28T06:31:00Z","closed_at":null,"body":"In rest_validate_request_arg() we cannot use the `! is_bool()` conditional to validate if a request argument is either `true` or `false`. The query string in the url (example: https://demo.wp-api.org/wp-json/wp/v2/categories?hide_empty=true) will be parsed as a string. Which means you will always get the error: \r\n{ code: \"rest_invalid_param\", message: \"Invalid parameter(s): hide_empty\", data: { status: 400, params: { hide_empty: \"hide_empty is not of type boolean\" } } }"},"comment":{"url":"https://api.github.com/repos/WP-API/WP-API/issues/comments/235810679","html_url":"https://github.com/WP-API/WP-API/issues/2616#issuecomment-235810679","issue_url":"https://api.github.com/repos/WP-API/WP-API/issues/2616","id":235810679,"user":{"login":"websupporter","id":6458412,"avatar_url":"https://avatars.githubusercontent.com/u/6458412?v=3","gravatar_id":"","url":"https://api.github.com/users/websupporter","html_url":"https://github.com/websupporter","followers_url":"https://api.github.com/users/websupporter/followers","following_url":"https://api.github.com/users/websupporter/following{/other_user}","gists_url":"https://api.github.com/users/websupporter/gists{/gist_id}","starred_url":"https://api.github.com/users/websupporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/websupporter/subscriptions","organizations_url":"https://api.github.com/users/websupporter/orgs","repos_url":"https://api.github.com/users/websupporter/repos","events_url":"https://api.github.com/users/websupporter/events{/privacy}","received_events_url":"https://api.github.com/users/websupporter/received_events","type":"User","site_admin":false},"created_at":"2016-07-28T06:31:00Z","updated_at":"2016-07-28T06:31:00Z","body":"Hmmm... not sure if I am on the right track, but if its okay for all to sanitize in the `get_items()` let me introduce you toa neat little helper which can sanitize and validate:\r\n\r\n```\r\n<?php\r\n/**\r\n * Takes 'true', true, 1, 'yes, 'false', false, 0, 'no' as parameter and returns an boolean\r\n * @param $to_bool (mixed)\r\n * @return boolean|WP_Error\r\n **/\r\n function wp_bool( $to_bool ) {\r\n \t$true = array(\r\n \t\ttrue,\r\n \t\t1,\r\n \t\t'true',\r\n \t\t'yes',\r\n \t);\r\n\r\n \t$false = array(\r\n \t\tfalse,\r\n \t\t0,\r\n \t\t'false',\r\n \t\t'no',\r\n \t);\r\n\tif ( in_array( $to_bool, $true ) ) {\r\n\t\treturn true;\r\n\t} \r\n\r\n\tif ( in_array( $to_bool, $false ) ) {\r\n\t\treturn false;\r\n\t}\r\n\r\n\treturn new WP_Error( 'no-bool', __( 'The parameter was no boolean' ) );\r\n}\r\n\r\n?>\r\n```\r\n\r\nInstead of `is_bool()` we would check in `rest_validate_request_arg()` if the outcome of `wp_bool()` is an WP_Error. In `get_items()` we can use it to sanitize. \r\n\r\nWould this be a better way?"}}
{"actor":{"display_login":"websupporter"}}