WP_REST_Widgets_Controller::save_widget( WP_REST_Request $request, string $sidebar_id ): string|WP_Error

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$requestWP_REST_Request

Full details about the request.

$sidebar_idstring

ID of the sidebar the widget belongs to.

Return value

string|WP_Error

The saved widget ID.

Performance profile

How much work a call to WP_REST_Widgets_Controller::save_widget() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Light

Touches nothing outside its own arguments.

Scaling

Scales with input

The body loops, so the work grows with what you pass in.

Instructions

20–118

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 217.

Plugin surface

1 hook

Third-party callbacks on 'rest_after_save_widget' run inside this call, and their cost is not bounded by anything here.

Called by

2

2 places in core call this, so the cost is paid more often than your own code shows.

What it touches

• hookthird-party callbacksdo_action()called directly
• serializeserialisationunserialize()called directly

Further down the call graph this can also reach option, cache, transient and query. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 31 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost WP_REST_Widgets_Controller::save_widget() can have, taken from its control-flow graph on PHP 8.5.

Hooks and filters fired · 1

One hook fires while WP_REST_Widgets_Controller::save_widget() runs, in this order:

1. 1
   do_action( rest_after_save_widget )actionline 654 (+128 into the body)

   Fires after a widget is created or updated via the REST API.

Uses · 7

• wp_parse_widget_id()Converts a widget ID into its id_base and number components.
• next_widget_id_number()
• __()Retrieves the translation of $text.
• wp_hash()Gets the hash of the given string.
• wp_slash()Adds slashes to a string or recursively adds slashes to strings within an array.
• do_action()Calls the callback functions that have been added to an action hook.
• WP_Error::__construct()Initializes the error.

Used by · 2

• WP_REST_Widgets_Controller::create_item()Creates a widget.
• WP_REST_Widgets_Controller::update_item()Updates an existing widget.

Source code

View on Trac ↗View on GitHub ↗

526	protected function save_widget( $request, $sidebar_id ) {527		global $wp_widget_factory, $wp_registered_widget_updates;528 529		require_once ABSPATH . 'wp-admin/includes/widgets.php'; // For next_widget_id_number().530 531		if ( isset( $request['id'] ) ) {532			// Saving an existing widget.533			$id            = $request['id'];534			$parsed_id     = wp_parse_widget_id( $id );535			$id_base       = $parsed_id['id_base'];536			$number        = $parsed_id['number'] ?? null;537			$widget_object = $wp_widget_factory->get_widget_object( $id_base );538			$creating      = false;539		} elseif ( $request['id_base'] ) {540			// Saving a new widget.541			$id_base       = $request['id_base'];542			$widget_object = $wp_widget_factory->get_widget_object( $id_base );543			$number        = $widget_object ? next_widget_id_number( $id_base ) : null;544			$id            = $widget_object ? $id_base . '-' . $number : $id_base;545			$creating      = true;546		} else {547			return new WP_Error(548				'rest_invalid_widget',549				__( 'Widget type (id_base) is required.' ),550				array( 'status' => 400 )551			);552		}553 554		if ( ! isset( $wp_registered_widget_updates[ $id_base ] ) ) {555			return new WP_Error(556				'rest_invalid_widget',557				__( 'The provided widget type (id_base) cannot be updated.' ),558				array( 'status' => 400 )559			);560		}561 562		if ( isset( $request['instance'] ) ) {563			if ( ! $widget_object ) {564				return new WP_Error(565					'rest_invalid_widget',566					__( 'Cannot set instance on a widget that does not extend WP_Widget.' ),567					array( 'status' => 400 )568				);569			}570 571			if ( isset( $request['instance']['raw'] ) ) {572				if ( empty( $widget_object->widget_options['show_instance_in_rest'] ) ) {573					return new WP_Error(574						'rest_invalid_widget',575						__( 'Widget type does not support raw instances.' ),576						array( 'status' => 400 )577					);578				}579				$instance = $request['instance']['raw'];580			} elseif ( isset( $request['instance']['encoded'], $request['instance']['hash'] ) ) {581				$serialized_instance = base64_decode( $request['instance']['encoded'] );582				if ( ! hash_equals( wp_hash( $serialized_instance ), $request['instance']['hash'] ) ) {583					return new WP_Error(584						'rest_invalid_widget',585						__( 'The provided instance is malformed.' ),586						array( 'status' => 400 )587					);588				}589				$instance = unserialize( $serialized_instance );590			} else {591				return new WP_Error(592					'rest_invalid_widget',593					__( 'The provided instance is invalid. Must contain raw OR encoded and hash.' ),594					array( 'status' => 400 )595				);596			}597 598			$form_data = array(599				"widget-$id_base" => array(600					$number => $instance,601				),602				'sidebar'         => $sidebar_id,603			);604		} elseif ( isset( $request['form_data'] ) ) {605			$form_data = $request['form_data'];

Changelog

Introduced in 5.8.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.1.0 tag, from src/wp-includes/rest-api/endpoints/class-wp-rest-widgets-controller.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.