Changeset 57754 for trunk/src/wp-includes/block-bindings/post-meta.php

Timestamp:

03/02/2024 02:11:53 PM (11 months ago)

Author:

swissspidy

Message:

Editor: do not expose protected post meta fields in block bindings.

Ignores meta keys which are considered protected or not registered to be shown in the REST API. Adds tests.

Props santosguillamot, swissspidy, gziolo, xknown, peterwilsoncc.
Fixes #60651.

File:

• trunk/src/wp-includes/block-bindings/post-meta.php (modified) (1 diff)

trunk/src/wp-includes/block-bindings/post-meta.php

@@ -35 +35 @@
     }
 
+    // Check if the meta field is protected.
+    if ( is_protected_meta( $source_args['key'], 'post' ) ) {
+        return null;
+    }
+
+    // Check if the meta field is registered to be shown in REST.
+    $meta_keys = get_registered_meta_keys( 'post', $block_instance->context['postType'] );
+    // Add fields registered for all subtypes.
+    $meta_keys = array_merge( $meta_keys, get_registered_meta_keys( 'post', '' ) );
+    if ( empty( $meta_keys[ $source_args['key'] ]['show_in_rest'] ) ) {
+        return null;
+    }
+
     return get_post_meta( $post_id, $source_args['key'], true );
 }