WordPress.org
Get WordPress

Make WordPress Core

Opened 15 years ago

Closed 15 years ago

#18028 closed defect (bug) (wontfix)

wp.getAuthors user_email not returned for admin role

Reported by: jabowery Owned by:
Priority: normal Milestone:
Component: XML-RPC Version:
Severity: normal Keywords:
Cc: Focuses:

Description

The fix to the security hole with wp.getAuthors returning fields like user_email to unauthorized users was incorrect. The restriction on values returned from wp.getAuthors (and indeed any XMLRPC call) should be based on role rather than merely lopping them off for all roles.

Change History (2)

#1 @SergeyBiryukov
15 years ago

  • Component General → XML-RPC

Related: [6498], #5534

#2 in reply to: ↑ description @westi
15 years ago

  • Milestone Awaiting Review
  • Resolution → wontfix
  • Status new → closed

Replying to jabowery:

The fix to the security hole with wp.getAuthors returning fields like user_email to unauthorized users was incorrect. The restriction on values returned from wp.getAuthors (and indeed any XMLRPC call) should be based on role rather than merely lopping them off for all roles.

I disagree.

I think it is much better to return a constant list of attributes regardless of role than vary the response based on role.

Note: See TracTickets for help on using tickets.