WP-API · rmccue · Feb 1, 2016 · Feb 1, 2016 · Feb 1, 2016 · Feb 1, 2016
diff --git a/lib/endpoints/class-wp-rest-controller.php b/lib/endpoints/class-wp-rest-controller.php
@@ -245,6 +245,8 @@ public function get_collection_params() {
 				'description'        => __( 'Maximum number of items to be returned in result set.' ),
 				'type'               => 'integer',
 				'default'            => 10,
+				'minimum'            => 1,
+				'maximum'            => 100,
 				'sanitize_callback'  => 'absint',
 				'validate_callback'  => 'rest_validate_request_arg',
 			),

diff --git a/plugin.php b/plugin.php
@@ -318,6 +318,12 @@ function rest_validate_request_arg( $value, $request, $param ) {
 			}
 		}

+		if ( in_array( $args['type'], array( 'numeric', 'integer' ) ) && isset( $args['minimum'] ) && isset( $args['maximum'] ) ) {
+			if ( $value > $args['maximum'] || $value < $args['minimum'] ) {
+				return new WP_Error( 'rest_invalid_param', sprintf( __( '%s must be between %d and %d' ), $param, $args['minimum'], $args['maximum'] ) );
+			}
+		}
+
 		return true;
 	}
 }

diff --git a/tests/test-rest-pages-controller.php b/tests/test-rest-pages-controller.php
@@ -151,6 +151,23 @@ public function test_get_items_menu_order_query() {
 		$this->assertEquals( $id3, $data[3]['id'] );
 	}

+	public function test_get_items_min_max_pages_query() {
+		$request = new WP_REST_Request( 'GET', '/wp/v2/pages' );
+		$request->set_param( 'per_page', 0 );
+		$response = $this->server->dispatch( $request );
+		$this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
+		$data = $response->get_data();
+		// Safe format for 4.4 and 4.5 https://core.trac.wordpress.org/ticket/35028
+		$first_error = array_shift( $data['data']['params'] );
+		$this->assertContains( 'per_page must be between 1 and 100', $first_error );
+		$request->set_param( 'per_page', 101 );
+		$response = $this->server->dispatch( $request );
+		$this->assertErrorResponse( 'rest_invalid_param', $response, 400 );
+		$data = $response->get_data();
+		$first_error = array_shift( $data['data']['params'] );
+		$this->assertContains( 'per_page must be between 1 and 100', $first_error );
+	}
+
 	public function test_get_items_private_filter_query_var() {
 		// Private query vars inaccessible to unauthorized users
 		wp_set_current_user( 0 );