get_theme_mod filter ignores sanitize_callback

Question

So I've created some options for the theme customizer with sanitize callbacks. I want to be able to change those options with $_GET requests, but letting only valid values to pass, as they are specified in the sanitize_callback function.

Here is my code:

function _wp007432_customize_register( $wp_customize ) {

    $wp_customize->add_section( 'section_header' , array(
        'title'       => esc_html__('Header', 'wp007432'),
        'panel'       => '_wp007432_options_panel',
    ));

    $wp_customize->add_setting( 'header_layout', array(
        'default' => '1',
        'sanitize_callback' => '_wp007432_sanitize_header_layout',
    ));

    $wp_customize->add_control( 'header_layout', array(
        'label'       => esc_html__( 'Header Layout', 'wp007432' ),
        'section'     => 'section_header',
        'type'        => 'radio',
        'choices'     => array(
            '1' => esc_html__( 'Header style 1.', 'wp007432' ),
            '2' => esc_html__( 'Header style 2.', 'wp007432' ),
            '3' => esc_html__( 'Header style 3.', 'wp007432' ),
        ),
    ));
}
add_action( 'customize_register', '_wp007432_customize_register' );

Sanitize the option so that only valid values will pass:

function _wp007432_sanitize_header_layout( $input ) {

   $valid = array(
       '1' => esc_html__( 'Header style 1.', 'wp007432' ),
       '2' => esc_html__( 'Header style 2.', 'wp007432' ),
       '3' => esc_html__( 'Header style 3.', 'wp007432' ),
   );

   if ( array_key_exists( $input, $valid ) ) {
       return $input;
   }

   return '';

}

In my theme I use this option like:

get_theme_mod('header_layout', '1');

Now let's say I want to change the option using $_GET:

if ( isset($_GET['header_layout']) ) {
    add_filter( 'theme_mod_header_layout', function(){
        return $_GET['header_layout'];
    });
}

Now if I understood correctly, if I pass a non-valid value, like 10, the theme mod must fall back to default. But it's not happening. Am I doing it wrong?

Sure, I can check the $_GET value in the filter, but it's extra code, and what's the point if sanitization then?

Answer 1

Sanitization via the sanitize_callback function takes place when you save the the theme mod.

Retrieving a theme mod via get_theme_mod() (which runs the theme_mod_{$name} filter) does not use the sanitize_callback function. So, whatever you've set $_GET['header_layout'] to will be used regardless of whether it is valid or not.

From wp-includes\theme.php:

/**
 * Retrieve theme modification value for the current theme.
 *
 * If the modification name does not exist, then the $default will be passed
 * through {@link https://secure.php.net/sprintf sprintf()} PHP function with the first
 * string the template directory URI and the second string the stylesheet
 * directory URI.
 *
 * @since 2.1.0
 *
 * @param string      $name    Theme modification name.
 * @param bool|string $default
 * @return string
 */
function get_theme_mod( $name, $default = false ) {
    $mods = get_theme_mods();

    if ( isset( $mods[$name] ) ) {
        /**
         * Filters the theme modification, or 'theme_mod', value.
         *
         * The dynamic portion of the hook name, `$name`, refers to
         * the key name of the modification array. For example,
         * 'header_textcolor', 'header_image', and so on depending
         * on the theme options.
         *
         * @since 2.2.0
         *
         * @param string $current_mod The value of the current theme modification.
         */
        return apply_filters( "theme_mod_{$name}", $mods[$name] );
    }

    if ( is_string( $default ) )
        $default = sprintf( $default, get_template_directory_uri(), get_stylesheet_directory_uri() );

    /** This filter is documented in wp-includes/theme.php */
    return apply_filters( "theme_mod_{$name}", $default );
}