diff --git a/src/wp-admin/includes/class-wp-site-health.php b/src/wp-admin/includes/class-wp-site-health.php index 2ddfaadc4b39d..8c6cf8d5cd57d 100644 --- a/src/wp-admin/includes/class-wp-site-health.php +++ b/src/wp-admin/includes/class-wp-site-health.php @@ -2187,6 +2187,7 @@ public function get_test_http_requests() { * This is required for the new block editor to work, so we explicitly test for this. * * @since 5.2.0 + * @since 7.1.0 Only WordPress' own cookies are sent with the request. * * @return array The test results. */ @@ -2206,7 +2207,16 @@ public function get_test_rest_availability() { 'test' => 'rest_availability', ); - $cookies = wp_unslash( $_COOKIE ); + /* + * Only WordPress' own cookies have any bearing on this request. Forwarding the rest of + * the browser's cookie jar lets unrelated cookies fail a test that is meant to measure + * the REST API. + */ + $cookies = array_intersect_key( + wp_unslash( $_COOKIE ), + array_flip( array( AUTH_COOKIE, SECURE_AUTH_COOKIE, LOGGED_IN_COOKIE, TEST_COOKIE ) ) + ); + $timeout = 10; // 10 seconds. $headers = array( 'Cache-Control' => 'no-cache', diff --git a/tests/phpunit/tests/admin/wpSiteHealth.php b/tests/phpunit/tests/admin/wpSiteHealth.php index 6080b477f54c3..43bb453861376 100644 --- a/tests/phpunit/tests/admin/wpSiteHealth.php +++ b/tests/phpunit/tests/admin/wpSiteHealth.php @@ -707,4 +707,51 @@ public function test_get_test_opcode_cache_result_by_environment() { $this->assertStringContainsString( __( 'Enabling this cache can significantly improve the performance of your site.' ), $result['description'] ); } } + + /** + * Tests that only WordPress' own cookies are sent with the REST API test request. + * + * @ticket 65839 + * + * @covers ::get_test_rest_availability() + */ + public function test_get_test_rest_availability_sends_only_wordpress_cookies() { + $original_cookie = $_COOKIE; + + $_COOKIE = array( + LOGGED_IN_COOKIE => 'admin|1700000000|token|hmac', + TEST_COOKIE => 'WP Cookie check', + '_ga' => 'GA1.1.123456789.1700000000', + 'wp-settings-time-1' => '1700000000', + ); + + $sent = null; + + add_filter( + 'pre_http_request', + static function ( $response, $parsed_args ) use ( &$sent ) { + $sent = $parsed_args['cookies']; + + return array( + 'response' => array( 'code' => 200 ), + 'body' => '', + ); + }, + 10, + 2 + ); + + $this->instance->get_test_rest_availability(); + + $_COOKIE = $original_cookie; + + $this->assertSame( + array( + LOGGED_IN_COOKIE => 'admin|1700000000|token|hmac', + TEST_COOKIE => 'WP Cookie check', + ), + $sent, + 'Only WordPress\' own cookies should be sent with the REST API test request.' + ); + } }