← All changes | includes/Core/BaseAPI.php +21 -1 4.8.2 → 4.9.2 View file →

		@@ -45,10 +45,30 @@
45	45	public function post( $endpoint, $callback, $args = [] ) {
46	46	return $this->register_endpoint( $endpoint, $callback, $args );
47	47	}
48	48
	49	+ /**
	50	+ * Default permission callback for every route registered via
	51	+ * register_endpoint().
	52	+ *
	53	+ * This used to `return true`, which made the *default* for a new REST class
	54	+ * "world-readable and world-writable". Forgetting to override it was silent —
	55	+ * nothing failed, the endpoint simply shipped open — and that is exactly how
	56	+ * /knowledge_base and /plugin_info ended up anonymous.
	57	+ *
	58	+ * It now fails closed. A genuinely public endpoint must say so explicitly by
	59	+ * overriding this method (see REST\InstantAnswer and REST\PopularKeywords) or
	60	+ * by passing its own permission_callback to register_rest_route(). Making
	61	+ * "public" a deliberate, greppable act is the whole point.
	62	+ *
	63	+ * Note this governs routes only; register_field() does not use it, so classes
	64	+ * that only register REST fields are unaffected — their access is governed by
	65	+ * the parent controller.
	66	+ *
	67	+ * @return bool
	68	+ */
49	69	public function permission_check() {
50		- return true;
	70	+ return current_user_can( 'edit_posts' );
51	71	}
52	72
53	73	protected function register_endpoint( $endpoint, $callback, $args = [], $methods = WP_REST_Server::CREATABLE ) {
54	74	return register_rest_route(