| @@ -45,10 +45,30 @@ | ||
| 45 | 45 | public function post( $endpoint, $callback, $args = [] ) { |
| 46 | 46 | return $this->register_endpoint( $endpoint, $callback, $args ); |
| 47 | 47 | } |
| 48 | 48 | |
| 49 | + /** | |
| 50 | + * Default permission callback for every route registered via | |
| 51 | + * register_endpoint(). | |
| 52 | + * | |
| 53 | + * This used to `return true`, which made the *default* for a new REST class | |
| 54 | + * "world-readable and world-writable". Forgetting to override it was silent — | |
| 55 | + * nothing failed, the endpoint simply shipped open — and that is exactly how | |
| 56 | + * /knowledge_base and /plugin_info ended up anonymous. | |
| 57 | + * | |
| 58 | + * It now fails closed. A genuinely public endpoint must say so explicitly by | |
| 59 | + * overriding this method (see REST\InstantAnswer and REST\PopularKeywords) or | |
| 60 | + * by passing its own permission_callback to register_rest_route(). Making | |
| 61 | + * "public" a deliberate, greppable act is the whole point. | |
| 62 | + * | |
| 63 | + * Note this governs routes only; register_field() does not use it, so classes | |
| 64 | + * that only register REST fields are unaffected — their access is governed by | |
| 65 | + * the parent controller. | |
| 66 | + * | |
| 67 | + * @return bool | |
| 68 | + */ | |
| 49 | 69 | public function permission_check() { |
| 50 | - return true; | |
| 70 | + return current_user_can( 'edit_posts' ); | |
| 51 | 71 | } |
| 52 | 72 | |
| 53 | 73 | protected function register_endpoint( $endpoint, $callback, $args = [], $methods = WP_REST_Server::CREATABLE ) { |
| 54 | 74 | return register_rest_route( |
