| @@ -167,9 +167,14 @@ | ||
| 167 | 167 | if ( empty( $current_route ) ) { |
| 168 | 168 | return false; |
| 169 | 169 | } |
| 170 | 170 | |
| 171 | - $allowed_public = $this->options['allowed_public_endpoints'] ?? array(); | |
| 171 | + // Vigilante_Settings::list_or_shipped(): an empty list of a setting with | |
| 172 | + // no field on screen is a leftover, not a choice. See its docblock. | |
| 173 | + $allowed_public = Vigilante_Settings::list_or_shipped( | |
| 174 | + $this->options['allowed_public_endpoints'] ?? array(), | |
| 175 | + array( 'rest_api_security', 'allowed_public_endpoints' ) | |
| 176 | + ); | |
| 172 | 177 | |
| 173 | 178 | foreach ( $allowed_public as $endpoint ) { |
| 174 | 179 | if ( strpos( $current_route, $endpoint ) === 0 ) { |
| 175 | 180 | return true; |
| @@ -342,9 +347,11 @@ | ||
| 342 | 347 | 'mode' => $this->options['mode'] ?? 'selective', |
| 343 | 348 | 'user_enum_blocked' => ! empty( $this->options['block_user_enumeration'] ), |
| 344 | 349 | 'jsonp_disabled' => ! empty( $this->options['disable_jsonp'] ), |
| 345 | 350 | 'protected_endpoints' => count( $this->options['protected_endpoints'] ?? array() ), |
| 346 | - 'allowed_endpoints' => count( $this->options['allowed_public_endpoints'] ?? array() ), | |
| 351 | + // Counted from the same value the check uses, or the screen would | |
| 352 | + // report zero while five endpoints are exempt. | |
| 353 | + 'allowed_endpoints' => count( Vigilante_Settings::list_or_shipped( $this->options['allowed_public_endpoints'] ?? array(), array( 'rest_api_security', 'allowed_public_endpoints' ) ) ), | |
| 347 | 354 | ); |
| 348 | 355 | } |
| 349 | 356 | |
| 350 | 357 | /** |
