| @@ -65,8 +65,15 @@ | ||
| 65 | 65 | $meta['reviews'] = $_reviews; |
| 66 | 66 | } |
| 67 | 67 | |
| 68 | 68 | if ( ! empty( $response['user'] ) && is_array( $response['user'] ) ) { |
| 69 | + /** | |
| 70 | + * The cloud API key must never be persisted here or sent to the client. | |
| 71 | + * Under a global login this key belongs to the admin, while any user with | |
| 72 | + * `delete_posts` can reach this endpoint. Login and SignUp already drop it. | |
| 73 | + */ | |
| 74 | + unset( $response['user']['api_key'] ); | |
| 75 | + | |
| 69 | 76 | $response['user']['site_url'] = base64_encode( home_url( '/' ) ); |
| 70 | 77 | $response['user']['ip'] = Helper::get_ip(); |
| 71 | 78 | } |
| 72 | 79 | |
