Changeset 54538

Timestamp:

10/17/2022 12:33:23 PM (2 years ago)

Author:

audrasjb

Message:

REST API: Lockdown post parameter of the terms endpoint.

Props johnbillion, tykoted, timothyblynjacobs, peterwilsoncc, martinkrcho, ehtis.
Merges [54528] to the 6.0 branch.

Location:

branches/6.0

Files:

• . (modified) (1 prop)
• src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php (modified) (2 diffs)

branches/6.0/src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php

@@ -146 +146 @@
 
     /**
+     * Checks if the terms for a post can be read.
+     *
+     * @since 6.0.3
+     *
+     * @param WP_Post         $post    Post object.
+     * @param WP_REST_Request $request Full details about the request.
+     * @return bool Whether the terms for the post can be read.
+     */
+    public function check_read_terms_permission_for_post( $post, $request ) {
+        // If the requested post isn't associated with this taxonomy, deny access.
+        if ( ! is_object_in_taxonomy( $post->post_type, $this->taxonomy ) ) {
+            return false;
+        }
+
+        // Grant access if the post is publicly viewable.
+        if ( is_post_publicly_viewable( $post ) ) {
+            return true;
+        }
+
+        // Otherwise grant access if the post is readable by the logged in user.
+        if ( current_user_can( 'read_post', $post->ID ) ) {
+            return true;
+        }
+
+        // Otherwise, deny access.
+        return false;
+    }
+
+    /**
      * Checks if a request has access to read terms in the specified taxonomy.
      *
@@ -166 +195 @@
                 array( 'status' => rest_authorization_required_code() )
             );
+        }
+
+        if ( ! empty( $request['post'] ) ) {
+            $post = get_post( $request['post'] );
+
+            if ( ! $post ) {
+                return new WP_Error(
+                    'rest_post_invalid_id',
+                    __( 'Invalid post ID.' ),
+                    array(
+                        'status' => 400,
+                    )
+                );
+            }
+
+            if ( ! $this->check_read_terms_permission_for_post( $post, $request ) ) {
+                return new WP_Error(
+                    'rest_forbidden_context',
+                    __( 'Sorry, you are not allowed to view terms for this post.' ),
+                    array(
+                        'status' => rest_authorization_required_code(),
+                    )
+                );
+            }
         }