← All changes | includes/Core/BaseAPI.php +26 -2 4.5.4 → 4.9.2 View file →

		@@ -1,8 +1,12 @@
1	1	<?php
	2	+namespace WPDeveloper\BetterDocs\Core;
2	3
3		-namespace WPDeveloper\BetterDocs\Core;
	4	+if ( ! defined( 'ABSPATH' ) ) {
	5	+ exit;
	6	+}
4	7
	8	+
5	9	use WP_Error;
6	10	use WP_REST_Server;
7	11	use WP_REST_Response;
8	12	use WPDeveloper\BetterDocs\Utils\Base;
		@@ -41,10 +45,30 @@
41	45	public function post( $endpoint, $callback, $args = [] ) {
42	46	return $this->register_endpoint( $endpoint, $callback, $args );
43	47	}
44	48
	49	+ /**
	50	+ * Default permission callback for every route registered via
	51	+ * register_endpoint().
	52	+ *
	53	+ * This used to `return true`, which made the *default* for a new REST class
	54	+ * "world-readable and world-writable". Forgetting to override it was silent —
	55	+ * nothing failed, the endpoint simply shipped open — and that is exactly how
	56	+ * /knowledge_base and /plugin_info ended up anonymous.
	57	+ *
	58	+ * It now fails closed. A genuinely public endpoint must say so explicitly by
	59	+ * overriding this method (see REST\InstantAnswer and REST\PopularKeywords) or
	60	+ * by passing its own permission_callback to register_rest_route(). Making
	61	+ * "public" a deliberate, greppable act is the whole point.
	62	+ *
	63	+ * Note this governs routes only; register_field() does not use it, so classes
	64	+ * that only register REST fields are unaffected — their access is governed by
	65	+ * the parent controller.
	66	+ *
	67	+ * @return bool
	68	+ */
45	69	public function permission_check() {
46		- return true;
	70	+ return current_user_can( 'edit_posts' );
47	71	}
48	72
49	73	protected function register_endpoint( $endpoint, $callback, $args = [], $methods = WP_REST_Server::CREATABLE ) {
50	74	return register_rest_route(