WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

REST API: Avoid sending blank `Last-Modified` headers with authenticated requests. 

This commit adds a new `WP_REST_Server#remove_header` method and uses it to clear the `Last-Modified` header when the "no caching" headers are sent (by default for all authenticated REST API requests).  This matches the behavior of the `nocache_headers` function used in other parts of WordPress.

Previously, the REST API would send an empty `Last-Modified` header in this situation.  Under some server and browser configurations, this causes browsers to cache authenticated REST API requests, which is undesirable.

Props iv3rson76, zinigor, rmccue, jnylen0.
Fixes #40444.

Built from https://develop.svn.wordpress.org/trunk@40805


git-svn-id: http://core.svn.wordpress.org/trunk@40663 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
James Nylen 2017-05-19 20:27:44 +00:00
parent e8e5a71a85
commit df5b8dcc82
2 changed files with 30 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
wp-includes/rest-api/class-wp-rest-server.php
View File

@ -252,9 +252,13 @@ class WP_REST_Server {
$send_no_cache_headers = apply_filters( 'rest_send_nocache_headers', is_user_logged_in() );
if ( $send_no_cache_headers ) {
foreach ( wp_get_nocache_headers() as $header => $header_value ) {
if ( empty( $header_value ) ) {
$this->remove_header( $header );
} else {
$this->send_header( $header, $header_value );
}
}
}
/**
* Filters whether the REST API is enabled.
@ -1262,6 +1266,30 @@ class WP_REST_Server {
}
}
/**
* Removes an HTTP header from the current response.
*
* @since 4.8.0
* @access public
*
* @param string $key Header key.
*/
public function remove_header( $key ) {
if ( function_exists( 'header_remove' ) ) {
// In PHP 5.3+ there is a way to remove an already set header.
header_remove( $key );
} else {
// In PHP 5.2, send an empty header, but only as a last resort to
// override a header already sent.
foreach ( headers_list() as $header ) {
if ( 0 === stripos( $header, "$key:" ) ) {
$this->send_header( $key, '' );
break;
}
}
}
}
/**
* Retrieves the raw request entity (body).
*

2
wp-includes/version.php
View File

@ -4,7 +4,7 @@
*
* @global string $wp_version
*/
$wp_version = '4.8-beta1-40804';
$wp_version = '4.8-beta1-40805';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.