← All changes | inc/class-ps-rest-handler.php +18 -12 4.3.5 → 4.3.16 View file →

		@@ -28,24 +28,23 @@
28	28	/**
29	29	* Constructor for PS_Rest_Handler
30	30	*/
31	31	public function __construct() {
32		- add_filter( 'rest_authentication_errors', array( $this, 'restrict_rest_access' ) );
	32	+ add_filter( 'rest_pre_dispatch', array( $this, 'restrict_rest_access' ), 10, 3 );
33	33	add_filter( 'rest_prepare_post', array( $this, 'filter_rest_response' ), 10, 3 );
34	34
35	35	add_action( 'rest_api_init', array( $this, 'register_nonce_routes' ) );
36	36	}
37	37
38		- public function restrict_rest_access( $result ) {
	38	+ public function restrict_rest_access( $result, $server, $request ) {
39	39
40		- // If a previous authentication check was applied,
	40	+ // If a previous plugin already short-circuited dispatch,
41	41	// pass that result along without modification.
42		- if ( true === $result || is_wp_error( $result ) ) {
	42	+ if ( null !== $result ) {
43	43	return $result;
44	44	}
45	45
46	46	// Allow Passster public endpoints (unlock flow must work for guests).
47		- $request_uri = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
48	47	$public_passster_paths = array(
49	48	'/passster/v1/nonces',
50	49	'/passster/v1/unlock',
51	50	'/passster/v1/hash',
		@@ -51,17 +50,15 @@
51	50	'/passster/v1/hash',
52	51	'/passster/v1/captcha',
53	52	'/passster/v1/logout',
54	53	);
55		- foreach ( $public_passster_paths as $path ) {
56		- if ( strpos( $request_uri, $path ) !== false ) {
57		- return $result;
58		- }
	54	+ if ( in_array( $request->get_route(), $public_passster_paths, true ) ) {
	55	+ return null;
59	56	}
60	57
61	58	// Check if request is coming from a frontend page builder.
62	59	if ( current_user_can( 'manage_options' ) && ( is_plugin_active( 'elementor/elementor.php' ) || is_plugin_active( 'livecanvas/livecanvas-plugin-index.php' ) || is_plugin_active( 'divi-builder/divi-builder.php' ) || is_plugin_active( 'oxygen/functions.php' ) || is_plugin_active( 'pagelayer/pagelayer.php' ) ) ) {
63		- return $result;
	60	+ return null;
64	61	}
65	62
66	63	// Global protection activated?
67	64	$settings = get_option( 'passster' );
		@@ -75,9 +72,9 @@
75	72	$atts = array( 'password' => get_post_meta( $page_id, 'passster_password', true ) );
76	73	$valid = PS_Conditional::is_valid( $atts );
77	74	}
78	75
79		- if ( $protection_enabled && ! $valid && ! is_user_logged_in() ) {
	76	+ if ( $protection_enabled && ! $valid && ! current_user_can( 'manage_options' ) ) {
80	77	return new \WP_Error(
81	78	'rest_not_logged_in',
82	79	__( 'You are not allowed to access this content. Please authenticate with a password first.', 'content-protector' ),
83	80	array( 'status' => 401 )
		@@ -83,9 +80,9 @@
83	80	array( 'status' => 401 )
84	81	);
85	82	}
86	83
87		- return $result;
	84	+ return null;
88	85	}
89	86
90	87	/**
91	88	* Filter REST API response to hide sensitive password data from unauthenticated users
		@@ -117,8 +114,17 @@
117	114	foreach ( $sensitive_fields as $field ) {
118	115	if ( isset( $data['meta'][ $field ] ) ) {
119	116	unset( $data['meta'][ $field ] );
120	117	}
	118	+ }
	119	+ }
	120	+
	121	+ if ( $post && class_exists( 'passster\PS_Category_Lock' ) && PS_Category_Lock::get_instance()->get_active_category_lock( $post->ID ) ) {
	122	+ if ( isset( $data['content']['rendered'] ) ) {
	123	+ $data['content']['rendered'] = '';
	124	+ }
	125	+ if ( isset( $data['excerpt']['rendered'] ) ) {
	126	+ $data['excerpt']['rendered'] = '';
121	127	}
122	128	}
123	129
124	130	// Update the response data