Skip to content

Fix: Require edit_post capability for raw content in docs search - #375

Open
iftakharul-islam wants to merge 1 commit into
developfrom
fix/search-raw-content-access
Open

iftakharul-islam wants to merge 1 commit into
developfrom
fix/search-raw-content-access

Conversation

@iftakharul-islam

Copy link
Copy Markdown
Member

Fixes weDevsOfficial/wedocs-pro#453

Problem

GET /wp/v2/docs/search is public (permission_callback => '__return_true'). When a request passed context=edit, prepare_item_for_response() added title.raw and content.raw without any capability check. A guest could read the full body of password-protected docs without the password.

Fix

  • prepare_item_for_response() adds raw fields only when current_user_can( 'edit_post', $doc->ID ). Covers the search route and the parents route, which share this method.
  • The search route declares a context arg (view / embed / edit, default view), so unknown values are rejected with rest_invalid_param.

Logged-in editors still get raw fields with context=edit, so nothing changes for the admin UI.

Proof

Tested on WordPress Playground (WP latest, PHP 8.3) with one published password-protected doc (body SECRET-BODY-12345) and one public doc.

Request Before (develop / 2.6.0) After
Guest, context=view no raw, no leak no raw, no leak
Guest, context=edit raw returned, secret leaked no raw, no leak
Guest, context=bogus ignored rest_invalid_param
Editor, context=edit raw returned raw returned
=== BEFORE (origin/develop, 2.6.0) ===
guest  context=view  | secret_leaked=no  | Public Doc=no-raw,Protected: Protected Doc=no-raw
guest  context=edit  | secret_leaked=YES | Public Doc=raw,Protected: Protected Doc=raw
guest  context=bogus | secret_leaked=no  | Public Doc=no-raw,Protected: Protected Doc=no-raw
editor context=edit  | secret_leaked=YES | Public Doc=raw,Protected: Protected Doc=raw
=== AFTER (fix branch) ===
guest  context=view  | secret_leaked=no  | Public Doc=no-raw,Protected: Protected Doc=no-raw
guest  context=edit  | secret_leaked=no  | Public Doc=no-raw,Protected: Protected Doc=no-raw
guest  context=bogus | secret_leaked=no  | error:rest_invalid_param
editor context=edit  | secret_leaked=YES | Public Doc=raw,Protected: Protected Doc=raw

The editor row returning the body is expected: editors are allowed to read raw content.

The public wp/v2/docs/search route accepted context=edit from guests and
returned content.raw, exposing password-protected docs. Raw fields are now
added only when the user can edit the doc, and the route declares a
context arg limited to view/embed/edit.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant