| @@ -1,12 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | + | |
| 2 | 3 | namespace WPDeveloper\BetterDocs\Core; |
| 3 | 4 | |
| 4 | -if ( ! defined( 'ABSPATH' ) ) { | |
| 5 | - exit; | |
| 6 | -} | |
| 7 | - | |
| 8 | - | |
| 9 | 5 | use WP_Error; |
| 10 | 6 | use WP_REST_Server; |
| 11 | 7 | use WP_REST_Response; |
| 12 | 8 | use WPDeveloper\BetterDocs\Utils\Base; |
| @@ -45,30 +41,10 @@ | ||
| 45 | 41 | public function post( $endpoint, $callback, $args = [] ) { |
| 46 | 42 | return $this->register_endpoint( $endpoint, $callback, $args ); |
| 47 | 43 | } |
| 48 | 44 | |
| 49 | - /** | |
| 50 | - * Default permission callback for every route registered via | |
| 51 | - * register_endpoint(). | |
| 52 | - * | |
| 53 | - * This used to `return true`, which made the *default* for a new REST class | |
| 54 | - * "world-readable and world-writable". Forgetting to override it was silent — | |
| 55 | - * nothing failed, the endpoint simply shipped open — and that is exactly how | |
| 56 | - * /knowledge_base and /plugin_info ended up anonymous. | |
| 57 | - * | |
| 58 | - * It now fails closed. A genuinely public endpoint must say so explicitly by | |
| 59 | - * overriding this method (see REST\InstantAnswer and REST\PopularKeywords) or | |
| 60 | - * by passing its own permission_callback to register_rest_route(). Making | |
| 61 | - * "public" a deliberate, greppable act is the whole point. | |
| 62 | - * | |
| 63 | - * Note this governs routes only; register_field() does not use it, so classes | |
| 64 | - * that only register REST fields are unaffected — their access is governed by | |
| 65 | - * the parent controller. | |
| 66 | - * | |
| 67 | - * @return bool | |
| 68 | - */ | |
| 69 | 45 | public function permission_check() { |
| 70 | - return current_user_can( 'edit_posts' ); | |
| 46 | + return true; | |
| 71 | 47 | } |
| 72 | 48 | |
| 73 | 49 | protected function register_endpoint( $endpoint, $callback, $args = [], $methods = WP_REST_Server::CREATABLE ) { |
| 74 | 50 | return register_rest_route( |
