Filter for options exposes all fields to front-end users

[ethanclevenger91]

After all this time using GitHub, I'm still not sure if notifications go out on closed issues, so thought I would create a new one.

In order to get Options pages working correctly, you implemented a filter on ACF's rule matching, but this filter isn't particularly nuanced (specifically the is_admin check), so if I'm allowing users to edit fields from the front end, it ends up displaying all options fields as well as those I intend to display.

[airesvsg]

Hi @ethanclevenger91,
This filter is used because ACF limits the visibility of the options values. This error isn't in my plugin, please open a new thread here: https://support.advancedcustomfields.com/forums/forum/add-ons/options-page/

Thanks

[ethanclevenger91]

Hey @airesvsg ,

I'm digging through and trying to find a way around this. Can you describe what exactly is happening in this function? The call to update_field will accept the name of the field rather than the key and should be available in all versions of ACF (I think), so I'm trying to understand why a simpler pass-through isn't an option, like:

public function update_item( $request ) {
        if ( $request instanceof WP_REST_Request ) {
        $key  = apply_filters( 'acf/rest_api/key', 'fields', $request, $this->type );

        if ( is_string( $key ) && ! empty( $key ) ) {
            $data  = $request->get_param( $key );

            $field = $request->get_param( 'field' );

            $this->format_id( $request );

                        update_field($key, $data, $this->id);

                return new WP_REST_Response( $this->get_fields( $request ), 200 );
                }
    }
}

I'm sure there's something pretty nuanced you're trying to do instead so I'm trying to understand what that is before I run around making pull requests.