New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ACF REST route #286

Open

Rahe opened this issue Jun 12, 2020 · 0 comments

Rahe commented Jun 12, 2020

Hello,

The plugin is registering an ACF route for getting acf key => label in https://github.com/phpbits/block-options/blob/master/includes/class-editorskit-acf-support.php.
But this route is only protected by the logged_in function.
If I am just logged in as a subscriber I can access all this data even if not able to edit any post.

I think it's important to check a capability like "edit_post" and like the core using the "permission_callback" argument and WP_REST_Server::READABLE for the method argument.
https://github.com/WordPress/WordPress/blob/master/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php#L64

Nicolas,

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment