| @@ -167,9 +167,14 @@ | ||
| 167 | 167 | if ( empty( $current_route ) ) { |
| 168 | 168 | return false; |
| 169 | 169 | } |
| 170 | 170 | |
| 171 | - $allowed_public = $this->options['allowed_public_endpoints'] ?? array(); | |
| 171 | + // Vigilante_Settings::list_or_shipped(): an empty list of a setting with | |
| 172 | + // no field on screen is a leftover, not a choice. See its docblock. | |
| 173 | + $allowed_public = Vigilante_Settings::list_or_shipped( | |
| 174 | + $this->options['allowed_public_endpoints'] ?? array(), | |
| 175 | + array( 'rest_api_security', 'allowed_public_endpoints' ) | |
| 176 | + ); | |
| 172 | 177 | |
| 173 | 178 | foreach ( $allowed_public as $endpoint ) { |
| 174 | 179 | if ( strpos( $current_route, $endpoint ) === 0 ) { |
| 175 | 180 | return true; |
| @@ -331,19 +336,8 @@ | ||
| 331 | 336 | return $endpoints; |
| 332 | 337 | } |
| 333 | 338 | |
| 334 | 339 | /** |
| 335 | - * Block author query parameter enumeration | |
| 336 | - */ | |
| 337 | - public function block_author_enumeration() { | |
| 338 | - // phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 339 | - if ( ! is_admin() && isset( $_GET['author'] ) ) { | |
| 340 | - wp_safe_redirect( home_url(), 301 ); | |
| 341 | - exit; | |
| 342 | - } | |
| 343 | - } | |
| 344 | - | |
| 345 | - /** | |
| 346 | 340 | * Get REST API security status |
| 347 | 341 | * |
| 348 | 342 | * @return array |
| 349 | 343 | */ |
| @@ -353,9 +347,11 @@ | ||
| 353 | 347 | 'mode' => $this->options['mode'] ?? 'selective', |
| 354 | 348 | 'user_enum_blocked' => ! empty( $this->options['block_user_enumeration'] ), |
| 355 | 349 | 'jsonp_disabled' => ! empty( $this->options['disable_jsonp'] ), |
| 356 | 350 | 'protected_endpoints' => count( $this->options['protected_endpoints'] ?? array() ), |
| 357 | - 'allowed_endpoints' => count( $this->options['allowed_public_endpoints'] ?? array() ), | |
| 351 | + // Counted from the same value the check uses, or the screen would | |
| 352 | + // report zero while five endpoints are exempt. | |
| 353 | + 'allowed_endpoints' => count( Vigilante_Settings::list_or_shipped( $this->options['allowed_public_endpoints'] ?? array(), array( 'rest_api_security', 'allowed_public_endpoints' ) ) ), | |
| 358 | 354 | ); |
| 359 | 355 | } |
| 360 | 356 | |
| 361 | 357 | /** |
