← All changes | includes/API/Profile.php +7 -0 3.6.2 → 3.7.2 View file →

		@@ -65,8 +65,15 @@
65	65	$meta['reviews'] = $_reviews;
66	66	}
67	67
68	68	if ( ! empty( $response['user'] ) && is_array( $response['user'] ) ) {
	69	+ /**
	70	+ * The cloud API key must never be persisted here or sent to the client.
	71	+ * Under a global login this key belongs to the admin, while any user with
	72	+ * `delete_posts` can reach this endpoint. Login and SignUp already drop it.
	73	+ */
	74	+ unset( $response['user']['api_key'] );
	75	+
69	76	$response['user']['site_url'] = base64_encode( home_url( '/' ) );
70	77	$response['user']['ip'] = Helper::get_ip();
71	78	}
72	79