Changeset 12848

Timestamp:

08/17/2023 07:43:02 AM (17 months ago)

Author:

dd32

Message:

Theme Directory: API: Cache a theme not existing, and perform some sanitization on the slug before querying for that theme.

This should have no backwards compatibility issues.

Location:

sites/trunk

Files:

• api.wordpress.org/public_html/themes/info/1.0/index.php (modified) (3 diffs)
• wordpress.org/public_html/wp-content/plugins/theme-directory/themes-api.php (modified) (1 diff)

sites/trunk/api.wordpress.org/public_html/themes/info/1.0/index.php

@@ -1 +1 @@
 <?php
+namespace WordPressdotorg\API\Themes\Info;
+use function WordPressdotorg\API\load_wordpress;
+
+// This exposes the `load_wordpress()` function mentioned below.
+require dirname( dirname( dirname( __DIR__ ) ) ) . '/wp-init-ondemand.php';
+
+//  wp_cache_switch_to_blog( WPORG_THEME_DIRECTORY_BLOGID ); // Uses is_multisite() which is unavailable.
+$wp_object_cache->blog_prefix = WPORG_THEME_DIRECTORY_BLOGID;
+
+// Helper methods
+function wp_unslash( $value ) {
+    if ( is_string( $value ) ) {
+        return stripslashes( $value );
+    }
+    if ( is_array( $value ) ) {
+        return array_map( __FUNCTION__, $value );
+    }
+
+    return $value;
+}
+
+/**
+ * Bails out with an error message.
+ *
+ * @param string $error Error message.
+ * @param int    $code  HTTP status code.
+ */
+function send_error( $error, $code = 404 ) {
+    global $format;
+
+    header( ( $_SERVER['SERVER_PROTOCOL'] ?? 'HTTP/1.0' ) . ' ' . $code, true, $code );
+
+    $response = (object) [
+        'error' => $error   
+    ];
+
+    // Browsers get a nicer action not implemented error.
+    if (
+        'GET' === $_SERVER['REQUEST_METHOD'] &&
+        false === strpos( $_SERVER['HTTP_USER_AGENT'] ?? '', 'WordPress/' ) &&
+        false !== strpos( $error, 'Action not implemented.' )
+    ) {
+        header( 'Content-Type: text/html; charset=utf-8' );
+        die( "<p>{$error}</p>" );
+    }
+
+    // Back-compat behaviour for the 1.0/1.1 API's
+    if (
+        defined( 'THEMES_API_VERSION' ) && THEMES_API_VERSION < 1.2 &&
+        'Theme not found' == $response->error
+    ) {
+        $response = false;
+    }
+
+    if ( 'php' === $format ) {
+        echo serialize( $response );
+    } else {
+        // JSON format
+        echo json_encode( $response );
+    }
+
+    die();
+}
 
 if ( ! defined( 'THEMES_API_VERSION' ) ) {
     define( 'THEMES_API_VERSION', '1.0' );
 }
-
-// Load WordPress as the Theme Directory in order to avoid having to switch sites after loading.
-$wp_init_host = 'https://wordpress.org/themes/';
-require dirname( dirname( dirname( __DIR__ ) ) ) . '/wp-init.php';
 
 // Set up action and request information.
@@ -24 +83 @@
 }
 
-$action = isset( $_REQUEST['action'] ) ? $_REQUEST['action'] : '';
+$action = $_REQUEST['action'] ?? '';
+
+// Validate the request.
+switch ( $action ) {
+    case 'theme_information':
+        // Validate the slug provided is valid.
+        $slug = $request->slug ?? '';
+        if ( ! $slug ) {
+            send_error( 'Slug not provided' );
+        }
+        if ( ! is_string( $slug ) || ! preg_match( '/^[a-z0-9-]+$/', $slug ) ) {
+            send_error( 'Invalid slug provided' );
+        }
+
+        // Check to see if this theme has been specified as not existing.
+        if ( 'not_found' === wp_cache_get( $slug, 'theme_information_error' ) ) {
+            send_error( 'Theme not found' );
+        }
+        break;
+    case 'query_themes':
+    case 'hot_tags':
+    case 'feature_list':
+    case 'get_commercial_shops':
+        // No validation for now, but valid endpoints.
+        break;
+    default:
+        send_error( 'Action not implemented. <a href="https://codex.wordpress.org/WordPress.org_API">API Docs</a>' );
+        die();
+}
+
+/**
+ * Load WordPress, to serve this request.
+ *
+ * TODO: This causes a significant CPU load for the server, this should be cached in Memcache in addition to the existing caching.
+ */
+load_wordpress( 'https://wordpress.org/themes/' );
 
 // Serve an API request.
@@ -32 +126 @@
 
 echo $api->get_result( $format );
+
+// Cache when a theme doesn't exist. See the validation handler above.
+if ( 'theme_information' == $action && 404 == http_response_code() ) {
+    wp_cache_set( $slug, 'not_found', 'theme_information_error', WEEK_IN_SECONDS );
+}

sites/trunk/wordpress.org/public_html/wp-content/plugins/theme-directory/themes-api.php

@@ -22 +22 @@
 
     wp_cache_set( $slug, $theme_meta, $cache_group );
+
+    // Delete the error cache if this theme is new.
+    wp_cache_delete( $slug, 'theme_information_error' );
 }
 add_action( 'wporg_themes_update_version_live', 'wporg_themes_update_check', 10, 2 );