← All changes
|
src/API/REST/V3/Routes/Subscriptions/SubscriptionController.php
+7
-2
4.16.0
→
4.16.9
View file →
| @@ -235,8 +235,9 @@ | ||
| 235 | 235 | |
| 236 | 236 | /** |
| 237 | 237 | * Get a subscription. |
| 238 | 238 | * |
| 239 | + * @since 4.16.3 Return 404 for anonymous donors unless explicitly included. | |
| 239 | 240 | * @since 4.8.0 |
| 240 | 241 | * |
| 241 | 242 | * @param WP_REST_Request $request Full data about the request. |
| 242 | 243 | * |
| @@ -246,15 +247,19 @@ | ||
| 246 | 247 | */ |
| 247 | 248 | public function get_item($request) |
| 248 | 249 | { |
| 249 | 250 | $subscription = Subscription::find($request->get_param('id')); |
| 251 | + $donorAnonymousMode = new DonorAnonymousMode($request->get_param('anonymousDonors')); | |
| 250 | 252 | |
| 251 | - if (!$subscription) { | |
| 253 | + // Hide anonymous donors unless explicitly included, matching the collection and donor endpoints. | |
| 254 | + if ( | |
| 255 | + !$subscription | |
| 256 | + || ($subscription->donor && $subscription->donor->isAnonymous() && $donorAnonymousMode->isExcluded()) | |
| 257 | + ) { | |
| 252 | 258 | return new WP_Error('subscription_not_found', __('Subscription not found', 'give'), ['status' => 404]); |
| 253 | 259 | } |
| 254 | 260 | |
| 255 | 261 | $includeSensitiveData = $request->get_param('includeSensitiveData'); |
| 256 | - $donorAnonymousMode = new DonorAnonymousMode($request->get_param('anonymousDonors')); | |
| 257 | 262 | |
| 258 | 263 | $item = (new SubscriptionViewModel($subscription)) |
| 259 | 264 | ->anonymousMode($donorAnonymousMode) |
| 260 | 265 | ->includeSensitiveData($includeSensitiveData) |