WP_REST_Server::serve_request( string $path = null ): null|false

Description

Parameters

$pathstringoptional

The request route. If not set, $_SERVER['PATH_INFO'] will be used. Default null.Default: null

Return

null|false

Null if not served and a HEAD request, false otherwise.

Hooks fired · 8

8 hooks fire while WP_REST_Server::serve_request() runs, in this order:

1. 1
   apply_filters( rest_jsonp_enabled )filterline 310 (+25 into the body)

   Filters whether JSONP is enabled for the REST API.

2. 2
   do_action( rest_enabled )filter_deprecatedline 342 (+57 into the body)

   Filters whether the REST API is enabled.

3. 3
   apply_filters( rest_exposed_cors_headers )filterline 406 (+121 into the body)

   Filters the list of response headers that are exposed to REST API CORS requests.

4. 4
   apply_filters( rest_allowed_cors_headers )filterline 432 (+147 into the body)

   Filters the list of request headers that are allowed for REST API CORS requests.

5. 5
   apply_filters( rest_post_dispatch )filterline 462 (+177 into the body)

   Filters the REST API response.

6. 6
   apply_filters( rest_send_nocache_headers )filterline 485 (+200 into the body)

   Filters whether to send no-cache headers on a REST API request.

7. 7
   apply_filters( rest_pre_serve_request )filterline 515 (+230 into the body)

   Filters whether the REST API request has already been served.

8. 8
   apply_filters( rest_pre_echo_response )filterline 538 (+253 into the body)

   Filters the REST API response.

Uses · 31

• apply_filters()Calls the callback functions that have been added to a filter hook.
• get_option()Retrieves an option value based on an option name.
• get_rest_url()Retrieves the URL to a REST endpoint on a site.
• sanitize_url()Sanitizes a URL for database or redirect usage.
• apply_filters_deprecated()Fires functions attached to a deprecated filter hook.
• __()Retrieves the translation of $text.
• wp_check_jsonp_callback()Checks that a JSONP callback is a valid JavaScript callback name.
• wp_unslash()Removes slashes from a string or recursively removes slashes from strings within an array.
• is_wp_error()Checks whether the given variable is a WordPress Error.
• rest_ensure_response()Ensures a REST response is a response object (for consistency).
• rest_parse_embed_param()Parses the "_embed" parameter into the list of resources to embed.
• is_user_logged_in()Determines whether the current visitor is a logged in user.

Source

View on Trac ↗View on GitHub ↗

285	public function serve_request( $path = null ) {286		/* @var WP_User|null $current_user */287		global $current_user;288 289		if ( $current_user instanceof WP_User && ! $current_user->exists() ) {290			/*291			 * If there is no current user authenticated via other means, clear292			 * the cached lack of user, so that an authenticate check can set it293			 * properly.294			 *295			 * This is done because for authentications such as Application296			 * Passwords, we don't want it to be accepted unless the current HTTP297			 * request is a REST API request, which can't always be identified early298			 * enough in evaluation.299			 */300			$current_user = null;301		}302 303		/**304		 * Filters whether JSONP is enabled for the REST API.305		 *306		 * @since 4.4.0307		 *308		 * @param bool $jsonp_enabled Whether JSONP is enabled. Default true.309		 */310		$jsonp_enabled = apply_filters( 'rest_jsonp_enabled', true );311 312		$jsonp_callback = false;313		if ( isset( $_GET['_jsonp'] ) ) {314			$jsonp_callback = $_GET['_jsonp'];315		}316 317		$content_type = ( $jsonp_callback && $jsonp_enabled ) ? 'application/javascript' : 'application/json';318		$this->send_header( 'Content-Type', $content_type . '; charset=' . get_option( 'blog_charset' ) );319		$this->send_header( 'X-Robots-Tag', 'noindex' );320 321		$api_root = get_rest_url();322		if ( ! empty( $api_root ) ) {323			$this->send_header( 'Link', '<' . sanitize_url( $api_root ) . '>; rel="https://api.w.org/"' );324		}325 326		/*327		 * Mitigate possible JSONP Flash attacks.328		 *329		 * https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/330		 */331		$this->send_header( 'X-Content-Type-Options', 'nosniff' );332 333		/**334		 * Filters whether the REST API is enabled.335		 *336		 * @since 4.4.0337		 * @deprecated 4.7.0 Use the {@see 'rest_authentication_errors'} filter to338		 *                   restrict access to the REST API.339		 *340		 * @param bool $rest_enabled Whether the REST API is enabled. Default true.341		 */342		apply_filters_deprecated(343			'rest_enabled',344			array( true ),345			'4.7.0',346			'rest_authentication_errors',347			sprintf(348				/* translators: %s: rest_authentication_errors */349				__( 'The REST API can no longer be completely disabled, the %s filter can be used to restrict access to the API, instead.' ),350				'rest_authentication_errors'351			)352		);353 354		if ( $jsonp_callback ) {355			if ( ! $jsonp_enabled ) {356				echo $this->json_error( 'rest_callback_disabled', __( 'JSONP support is disabled on this site.' ), 400 );357				return false;358			}359 360			if ( ! wp_check_jsonp_callback( $jsonp_callback ) ) {361				echo $this->json_error( 'rest_callback_invalid', __( 'Invalid JSONP callback function.' ), 400 );362				return false;363			}364		}

History

Introduced in 4.4.0. One change between 6.7.7 and 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 6.7.7 tag, from src/wp-includes/rest-api/class-wp-rest-server.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.