From 6b08485cfa7c83c887a4c2d38639fcd651dc239f Mon Sep 17 00:00:00 2001
From: Joe Hoyle <joehoyle@gmail.com>
Date: Thu, 3 Nov 2016 04:05:36 +0000
Subject: [PATCH] REST API: Return error when JSON decoding fails.

If you send a request to the REST API with invalid JSON in body than it will now return a error. This assists developers if they accidentally send invalid JSON and wonder why their data appears to be ignored.

Props rmccue.
Fixes #38547.

Built from https://develop.svn.wordpress.org/trunk@39109


git-svn-id: http://core.svn.wordpress.org/trunk@39051 1a063a9b-81f0-0310-95a4-ce76da25c4cd
---
 .../rest-api/class-wp-rest-request.php        | 23 ++++++++++++++++---
 wp-includes/version.php                       |  2 +-
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/wp-includes/rest-api/class-wp-rest-request.php b/wp-includes/rest-api/class-wp-rest-request.php
index d3e8c755af..734ee982fc 100644
--- a/wp-includes/rest-api/class-wp-rest-request.php
+++ b/wp-includes/rest-api/class-wp-rest-request.php
@@ -651,11 +651,13 @@ class WP_REST_Request implements ArrayAccess {
 	 * Avoids parsing the JSON data until we need to access it.
 	 *
 	 * @since 4.4.0
+	 * @since 4.7.0 Returns error instance if value cannot be decoded.
 	 * @access protected
+	 * @return true|WP_Error True if the JSON data was passed or no JSON data was provided, WP_Error if invalid JSON was passed.
 	 */
 	protected function parse_json_params() {
 		if ( $this->parsed_json ) {
-			return;
+			return true;
 		}
 
 		$this->parsed_json = true;
@@ -664,7 +666,7 @@ class WP_REST_Request implements ArrayAccess {
 		$content_type = $this->get_content_type();
 
 		if ( empty( $content_type ) || 'application/json' !== $content_type['value'] ) {
-			return;
+			return true;
 		}
 
 		$params = json_decode( $this->get_body(), true );
@@ -676,10 +678,19 @@ class WP_REST_Request implements ArrayAccess {
 		 * might not be defined: https://core.trac.wordpress.org/ticket/27799
 		 */
 		if ( null === $params && ( ! function_exists( 'json_last_error' ) || JSON_ERROR_NONE !== json_last_error() ) ) {
-			return;
+			// Ensure subsequent calls receive error instance.
+			$this->parsed_json = false;
+
+			$error_data = array(
+				'status' => WP_Http::BAD_REQUEST,
+				'json_error_code' => json_last_error(),
+				'json_error_message' => json_last_error_msg(),
+			);
+			return new WP_Error( 'rest_invalid_json', __( 'Invalid JSON body passed.' ), $error_data );
 		}
 
 		$this->params['JSON'] = $params;
+		return true;
 	}
 
 	/**
@@ -841,6 +852,12 @@ class WP_REST_Request implements ArrayAccess {
 	 *                       WP_Error if required parameters are missing.
 	 */
 	public function has_valid_params() {
+		// If JSON data was passed, check for errors.
+		$json_error = $this->parse_json_params();
+		if ( is_wp_error( $json_error ) ) {
+			return $json_error;
+		}
+
 		$attributes = $this->get_attributes();
 		$required = array();
 
diff --git a/wp-includes/version.php b/wp-includes/version.php
index e4192092aa..9e4ec449e2 100644
--- a/wp-includes/version.php
+++ b/wp-includes/version.php
@@ -4,7 +4,7 @@
  *
  * @global string $wp_version
  */
-$wp_version = '4.7-beta1-39108';
+$wp_version = '4.7-beta1-39109';
 
 /**
  * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.