New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Protected Posts Still Accessible Through Rest API #371

Open

thewebtailors opened this issue Feb 27, 2023 · 1 comment

thewebtailors commented Feb 27, 2023

When I protect a post through User Access Manager, the post can't be accessed when accessing it through the URL (as expected).

However, it can still be read through the Rest API (which was unexpected). E.g. /wp-json/wp/v2/posts/2

For right now, I added a permission callback to the rest_api endpoint /wp/v2/posts/(?P[\d]+) to block unauthorized access.

But it would be great if the plugin would protect the individual post requests in the Rest API as well.

Owner

GM-Alex commented Mar 8, 2023

Hi,

I would say that you are requesting the posts as admin, since an admin has always the right to see all post this would explain the behavior.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment