← All changes | inc/class-ps-rest-handler.php +111 -9 4.2.12 → 4.3.16 View file →

		@@ -28,22 +28,37 @@
28	28	/**
29	29	* Constructor for PS_Rest_Handler
30	30	*/
31	31	public function __construct() {
32		- add_filter( 'rest_authentication_errors', array( $this, 'restrict_rest_access' ) );
	32	+ add_filter( 'rest_pre_dispatch', array( $this, 'restrict_rest_access' ), 10, 3 );
	33	+ add_filter( 'rest_prepare_post', array( $this, 'filter_rest_response' ), 10, 3 );
	34	+
	35	+ add_action( 'rest_api_init', array( $this, 'register_nonce_routes' ) );
33	36	}
34	37
35		- public function restrict_rest_access( $result ) {
	38	+ public function restrict_rest_access( $result, $server, $request ) {
36	39
37		- // If a previous authentication check was applied,
	40	+ // If a previous plugin already short-circuited dispatch,
38	41	// pass that result along without modification.
39		- if ( true === $result || is_wp_error( $result ) ) {
	42	+ if ( null !== $result ) {
40	43	return $result;
41	44	}
42	45
	46	+ // Allow Passster public endpoints (unlock flow must work for guests).
	47	+ $public_passster_paths = array(
	48	+ '/passster/v1/nonces',
	49	+ '/passster/v1/unlock',
	50	+ '/passster/v1/hash',
	51	+ '/passster/v1/captcha',
	52	+ '/passster/v1/logout',
	53	+ );
	54	+ if ( in_array( $request->get_route(), $public_passster_paths, true ) ) {
	55	+ return null;
	56	+ }
	57	+
43	58	// Check if request is coming from a frontend page builder.
44		- if ( current_user_can( 'administrator' ) && ( is_plugin_active( 'elementor/elementor.php' ) || is_plugin_active( 'livecanvas/livecanvas-plugin-index.php' ) || is_plugin_active( 'divi-builder/divi-builder.php' ) || is_plugin_active( 'oxygen/functions.php' ) || is_plugin_active( 'pagelayer/pagelayer.php' ) ) ) {
45		- return $result;
	59	+ if ( current_user_can( 'manage_options' ) && ( is_plugin_active( 'elementor/elementor.php' ) || is_plugin_active( 'livecanvas/livecanvas-plugin-index.php' ) || is_plugin_active( 'divi-builder/divi-builder.php' ) || is_plugin_active( 'oxygen/functions.php' ) || is_plugin_active( 'pagelayer/pagelayer.php' ) ) ) {
	60	+ return null;
46	61	}
47	62
48	63	// Global protection activated?
49	64	$settings = get_option( 'passster' );
		@@ -57,15 +72,102 @@
57	72	$atts = array( 'password' => get_post_meta( $page_id, 'passster_password', true ) );
58	73	$valid = PS_Conditional::is_valid( $atts );
59	74	}
60	75
61		- if ( $protection_enabled && ! $valid && ! is_user_logged_in() ) {
	76	+ if ( $protection_enabled && ! $valid && ! current_user_can( 'manage_options' ) ) {
62	77	return new \WP_Error(
63	78	'rest_not_logged_in',
64		- __( 'You are not allowed to access this content. Please authenticate with a password first.' ),
	79	+ __( 'You are not allowed to access this content. Please authenticate with a password first.', 'content-protector' ),
65	80	array( 'status' => 401 )
66	81	);
67	82	}
68	83
69		- return $result;
	84	+ return null;
	85	+ }
	86	+
	87	+ /**
	88	+ * Filter REST API response to hide sensitive password data from unauthenticated users
	89	+ *
	90	+ * @param \WP_REST_Response $response The response object.
	91	+ * @param \WP_Post $post The post object.
	92	+ * @param \WP_REST_Request $request The request object.
	93	+ * @return \WP_REST_Response
	94	+ */
	95	+ public function filter_rest_response( $response, $post, $request ) {
	96	+ // Only filter for unauthenticated users or users without proper permissions
	97	+ if ( is_user_logged_in() && current_user_can( 'manage_options' ) ) {
	98	+ return $response;
	99	+ }
	100	+
	101	+ // Get the response data
	102	+ $data = $response->get_data();
	103	+
	104	+ // List of sensitive meta fields that should be hidden
	105	+ $sensitive_fields = array(
	106	+ 'passster_password',
	107	+ 'passster_passwords',
	108	+ 'passster_password_list',
	109	+ 'passster_password_lists',
	110	+ );
	111	+
	112	+ // Remove sensitive fields from meta if they exist
	113	+ if ( isset( $data['meta'] ) && is_array( $data['meta'] ) ) {
	114	+ foreach ( $sensitive_fields as $field ) {
	115	+ if ( isset( $data['meta'][ $field ] ) ) {
	116	+ unset( $data['meta'][ $field ] );
	117	+ }
	118	+ }
	119	+ }
	120	+
	121	+ if ( $post && class_exists( 'passster\PS_Category_Lock' ) && PS_Category_Lock::get_instance()->get_active_category_lock( $post->ID ) ) {
	122	+ if ( isset( $data['content']['rendered'] ) ) {
	123	+ $data['content']['rendered'] = '';
	124	+ }
	125	+ if ( isset( $data['excerpt']['rendered'] ) ) {
	126	+ $data['excerpt']['rendered'] = '';
	127	+ }
	128	+ }
	129	+
	130	+ // Update the response data
	131	+ $response->set_data( $data );
	132	+
	133	+ return $response;
	134	+ }
	135	+
	136	+ public function register_nonce_routes() {
	137	+
	138	+ register_rest_route(
	139	+ 'passster/v1',
	140	+ '/nonces',
	141	+ array(
	142	+ 'methods' => 'POST',
	143	+ 'callback' => array( $this, 'get_all_nonces' ),
	144	+ 'permission_callback' => '__return_true',
	145	+ )
	146	+ );
	147	+ }
	148	+ public function get_all_nonces() {
	149	+ $user_id = wp_validate_auth_cookie( '', 'logged_in' );
	150	+
	151	+ if ( $user_id ) {
	152	+ wp_set_current_user( $user_id );
	153	+ }
	154	+
	155	+ $response = new \WP_REST_Response(
	156	+ array(
	157	+ 'nonce' => wp_create_nonce( 'ps-password-nonce' ),
	158	+ 'hash_nonce' => wp_create_nonce( 'ps-hash-nonce' ),
	159	+ 'logout_nonce' => wp_create_nonce( 'ps-logout-nonce' ),
	160	+ )
	161	+ );
	162	+
	163	+ // Prevent caching of nonces - they are user-session specific.
	164	+ $response->header( 'Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0, private' );
	165	+ $response->header( 'Pragma', 'no-cache' );
	166	+ $response->header( 'Expires', '0' );
	167	+ $response->header( 'X-LiteSpeed-Cache-Control', 'no-cache' );
	168	+ $response->header( 'X-Accel-Expires', '0' ); // Nginx
	169	+ $response->header( 'Surrogate-Control', 'no-store' ); // Varnish/CDN
	170	+
	171	+ return $response;
70	172	}
71	173	}