Merge pull request #131 from alleyinteractive/bug/IRV-307/fix-query-v…

…ar-logic

@joemcgill and I will keep discussing this in IRV-310.

inc/endpoints/class-components-endpoint.php

@@ -131,14 +131,23 @@ public function register_rest_routes() {
 	 * @return array
 	 */
 	public function get_route_response( $request ) {
+
+		// phpcs:ignore WordPress.WP.GlobalVariablesOverride.OverrideProhibited
+		global $wp;
+
 		/**
 		 * Action fired on the request.
 		 *
 		 * @param \WP_REST_Request $request  WP_REST_Request object.
 		 */
 		do_action( 'wp_irving_components_request', $request );
 
-		$this->params = $request->get_params();
+		// Remove any request parameters that haven't been allow-listed by the
+		// global $wp object's $public_query_vars array.
+		$this->params = array_intersect_key(
+			$request->get_params(),
+			array_flip( $wp->public_query_vars )
+		);
 
 		// Parse path and context.
 		$this->parse_path( $this->params['path'] ?? '' );
@@ -366,7 +375,7 @@ public function build_query() {
 		$wp_query = apply_filters( 'wp_irving_components_wp_query', $wp_query, $this->path, $this->custom_params, $this->params );
 
 		// Map to main query and set up globals.
-		// phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited
+		// phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited, WordPress.WP.GlobalVariablesOverride.OverrideProhibited
 		$wp_the_query = $wp_query;
 		$this->register_globals();
 
@@ -396,7 +405,7 @@ public function permissions_check( $request ) {
 	 * @see https://github.com/WordPress/WordPress/blob/master/wp-includes/class-wp.php#L580
 	 */
 	public function register_globals() {
-		// phpcs:disable WordPress.WP.GlobalVariablesOverride.Prohibited
+		// phpcs:disable WordPress.WP.GlobalVariablesOverride.Prohibited, WordPress.WP.GlobalVariablesOverride.OverrideProhibited
 		global $wp_the_query, $wp_query;
 		$wp_query = $wp_the_query;
 
@@ -442,6 +451,8 @@ public function fix_rest_url( $url ) : string {
 	 * @return array $vars Array of query vars.
 	 */
 	public function modify_query_vars( $vars ) {
+		$vars[] = 'context';
+		$vars[] = 'path';
 		$vars[] = 'irving-path';
 		$vars[] = 'irving-path-params';
 		return $vars;