Ticket #5534 (closed defect (bug): fixed)
Limit XML-RPC method wp.getAuthors to only return user_id, user_login and display_name & add capability check (edit_posts)
| Reported by: |
|
Owned by: |
|
|---|---|---|---|
| Priority: | normal | Milestone: | 2.5 |
| Component: | XML-RPC | Version: | 2.3.2 |
| Severity: | normal | Keywords: | has-patch |
| Cc: | josephscott |
Description
The wp.getAuthors method just returns all of the data provided by get_users_of_blog(), we should limit it to just specific useful information. In this case information that is needed and helpful for setting the post author: user_id, user_login and display_name.
Also add a capability check, at a minimum should be able to edit posts. If you can't even do that then there really isn't any reason to expose the list of authors on a blog.
Attachments
Change History
comment:1
josephscott — 4 years ago
- Version changed from 2.4 to 2.3.2
- Milestone changed from 2.5 to 2.4
- Status changed from new to closed
- Resolution set to fixed
Note: See
TracTickets for help on using
tickets.

