← All changes | includes/core/class-role-manager.php +7 -1 2.9.0 → 2.14.3 View file →

		@@ -99,9 +99,15 @@
99	99	if (null !== $result) {
100	100	return $result;
101	101	}
102	102
103		- $route = (string) $request->get_route();
	103	+ // WP_REST_Server matches routes case-insensitively ('@^...$@i'), so
	104	+ // /ThinkRank/v1/... reaches the same handler as /thinkrank/v1/...
	105	+ // Compare a lowercased copy, or a change of case skips the gate (#975).
	106	+ // Every route this class names, including the exemptions below, is
	107	+ // lowercase, and lowercasing only lets a variant reach the same handler
	108	+ // its lowercase form already reaches, so no exemption grows.
	109	+ $route = strtolower((string) $request->get_route());
104	110	// Gate both the free (/thinkrank/v1/) and Pro (/thinkrank-pro/v1/)
105	111	// namespaces so the Role Manager governs Pro sections too — otherwise the
106	112	// whole Pro namespace bypasses the capability gate.
107	113	if (strpos($route, '/thinkrank/v1/') !== 0 && strpos($route, '/thinkrank-pro/v1/') !== 0) {