← All changes | inc/class-ps-rest-handler.php +8 -11 4.3.7 → 4.3.16 View file →

		@@ -28,24 +28,23 @@
28	28	/**
29	29	* Constructor for PS_Rest_Handler
30	30	*/
31	31	public function __construct() {
32		- add_filter( 'rest_authentication_errors', array( $this, 'restrict_rest_access' ) );
	32	+ add_filter( 'rest_pre_dispatch', array( $this, 'restrict_rest_access' ), 10, 3 );
33	33	add_filter( 'rest_prepare_post', array( $this, 'filter_rest_response' ), 10, 3 );
34	34
35	35	add_action( 'rest_api_init', array( $this, 'register_nonce_routes' ) );
36	36	}
37	37
38		- public function restrict_rest_access( $result ) {
	38	+ public function restrict_rest_access( $result, $server, $request ) {
39	39
40		- // If a previous authentication check was applied,
	40	+ // If a previous plugin already short-circuited dispatch,
41	41	// pass that result along without modification.
42		- if ( true === $result || is_wp_error( $result ) ) {
	42	+ if ( null !== $result ) {
43	43	return $result;
44	44	}
45	45
46	46	// Allow Passster public endpoints (unlock flow must work for guests).
47		- $request_uri = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
48	47	$public_passster_paths = array(
49	48	'/passster/v1/nonces',
50	49	'/passster/v1/unlock',
51	50	'/passster/v1/hash',
		@@ -51,17 +50,15 @@
51	50	'/passster/v1/hash',
52	51	'/passster/v1/captcha',
53	52	'/passster/v1/logout',
54	53	);
55		- foreach ( $public_passster_paths as $path ) {
56		- if ( strpos( $request_uri, $path ) !== false ) {
57		- return $result;
58		- }
	54	+ if ( in_array( $request->get_route(), $public_passster_paths, true ) ) {
	55	+ return null;
59	56	}
60	57
61	58	// Check if request is coming from a frontend page builder.
62	59	if ( current_user_can( 'manage_options' ) && ( is_plugin_active( 'elementor/elementor.php' ) || is_plugin_active( 'livecanvas/livecanvas-plugin-index.php' ) || is_plugin_active( 'divi-builder/divi-builder.php' ) || is_plugin_active( 'oxygen/functions.php' ) || is_plugin_active( 'pagelayer/pagelayer.php' ) ) ) {
63		- return $result;
	60	+ return null;
64	61	}
65	62
66	63	// Global protection activated?
67	64	$settings = get_option( 'passster' );
		@@ -83,9 +80,9 @@
83	80	array( 'status' => 401 )
84	81	);
85	82	}
86	83
87		- return $result;
	84	+ return null;
88	85	}
89	86
90	87	/**
91	88	* Filter REST API response to hide sensitive password data from unauthenticated users