Changeset 11297

Timestamp:

10/26/2021 04:05:15 AM (5 years ago)

Author:

dd32

Message:

Plugin Directory: API: Add permission_callback to all the public API endpoints, to avoid _doing_it_wrong().

'register_rest_route was called <strong>incorrectly</strong>. The REST API route definition for <code>plugins/v1/query-plugins/?</code> is missing the required <code>permission_callback</code> argument. For REST API routes that are intended to be public, use <code>return_true</code> as the permission callback.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes

Files:

• class-locale-banner.php (modified) (1 diff)
• class-plugin-release-confirmation.php (modified) (1 diff)
• class-popular-tags.php (modified) (1 diff)
• class-query-plugins.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-locale-banner.php

@@ -14 +14 @@
     function __construct() {
         register_rest_route( 'plugins/v1', '/locale-banner', array(
-            'methods'  => WP_REST_Server::ALLMETHODS,
-            'callback' => array( $this, 'locale_banner' ),
-            'args'     => array(
+            'methods'             => WP_REST_Server::ALLMETHODS,
+            'callback'            => array( $this, 'locale_banner' ),
+            'args'                => array(
                 'plugin_slug' => array(
                     'validate_callback' => array( $this, 'validate_plugin_slug_callback' ),
                 ),
             ),
+            'permission_callback' => '__return_true',
         ) );
     }

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-plugin-release-confirmation.php

@@ -61 +61 @@
             'args'                => [
             ],
-            'permission_callback' => function( $request ) {
-                return is_user_logged_in();
-            },
+            'permission_callback' => 'is_user_logged_in',
         ] );
 

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-popular-tags.php

@@ -14 +14 @@
     function __construct() {
         register_rest_route( 'plugins/v1', '/popular-tags/?', array(
-            'methods'  => WP_REST_Server::READABLE,
-            'callback' => array( $this, 'popular_tags' ),
+            'methods'             => WP_REST_Server::READABLE,
+            'callback'            => array( $this, 'popular_tags' ),
+            'permission_callback' => '__return_true',
         ) );
     }

sites/trunk/wordpress.org/public_html/wp-content/plugins/plugin-directory/api/routes/class-query-plugins.php

@@ -28 +28 @@
     function __construct() {
         register_rest_route( 'plugins/v1', '/query-plugins/?', array(
-            'methods'  => WP_REST_Server::READABLE,
-            'callback' => array( $this, 'query' ),
+            'methods'             => WP_REST_Server::READABLE,
+            'callback'            => array( $this, 'query' ),
+            'permission_callback' => '__return_true',
         ) );
     }