From bf1828ce20ef1ceaacb0396ac05022117ca09cbf Mon Sep 17 00:00:00 2001
From: Iftakharul Islam Ifat
 <88052038+iftakharul-islam@users.noreply.github.com>
Date: Thu, 8 Oct 2026 14:52:50 +0600
Subject: [PATCH] Fix: Require edit_post capability for raw content in docs
 search

The public wp/v2/docs/search route accepted context=edit from guests and
returned content.raw, exposing password-protected docs. Raw fields are now
added only when the user can edit the doc, and the route declares a
context arg limited to view/embed/edit.
---
 includes/API/API.php | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/includes/API/API.php b/includes/API/API.php
index b0bd6351..8d9077bd 100644
--- a/includes/API/API.php
+++ b/includes/API/API.php
@@ -132,6 +132,14 @@ public function register_routes() {
                 'callback'            => [ $this, 'search_docs' ],
                 'permission_callback' => '__return_true',
                 'args'                => [
+                    'context' => [
+                        'description'       => __( 'Scope under which the request is made; determines fields present in response.', 'wedocs' ),
+                        'type'              => 'string',
+                        'enum'              => [ 'view', 'embed', 'edit' ],
+                        'default'           => 'view',
+                        'sanitize_callback' => 'sanitize_key',
+                        'validate_callback' => 'rest_validate_request_arg',
+                    ],
                     'query' => [
                         'required'          => true,
                         'type'              => 'string',
@@ -1197,7 +1205,9 @@ public function prepare_item_for_response( $doc, $request ) {
             'order'  => $doc->menu_order,
         ];
 
-        if ( 'edit' == $request['context'] ) {
+        // Raw fields are edit-only data, so the caller must be able to edit the doc.
+        // Otherwise `context=edit` on public routes would leak password-protected content.
+        if ( 'edit' === $request['context'] && current_user_can( 'edit_post', $doc->ID ) ) {
             $data['title']['raw']   = $doc->post_title;
             $data['content']['raw'] = $doc->post_content;
         }