Add the capability check to the preview endpoint to prevent it from b…

…eing accessible to unauthenticated users
Automattic · Jun 4, 2024 · 91e88ac · 91e88ac
1 parent 4284d1e
commit 91e88ac
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 3 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,8 @@
 # Changelog
 
+## 1.9.7
+* Add a capability check to the preview endpoint, to prevent unauthenticated users from accessing it
+
 ## 1.9.6
 
 * Revert #597, restoring `get_fields_for_render()` that is being used in some implementations (#639)

diff --git a/classes/class-wpcom-liveblog-rest-api.php b/classes/class-wpcom-liveblog-rest-api.php
@@ -180,12 +180,12 @@ public static function register_routes() {
 			array(
 				'methods'  => WP_REST_Server::CREATABLE,
 				'callback' => array( __CLASS__, 'format_preview_entry' ),
+				'permission_callback' => array( 'WPCOM_Liveblog', 'current_user_can_edit_liveblog' ),
 				'args'     => array(
 					'entry_content' => array(
 						'required' => true,
 					),
 				),
-				'permission_callback'  => '__return_true',
 			)
 		);
 

diff --git a/liveblog.php b/liveblog.php
@@ -4,7 +4,7 @@
  * Plugin Name: Liveblog
  * Plugin URI: http://wordpress.org/extend/plugins/liveblog/
  * Description: Empowers website owners to provide rich and engaging live event coverage to a large, distributed audience.
- * Version:     1.9.6
+ * Version:     1.9.7
  * Author:      WordPress.com VIP, Big Bite Creative and contributors
  * Author URI: https://github.com/Automattic/liveblog/graphs/contributors
  * Text Domain: liveblog
@@ -26,7 +26,7 @@
 	final class WPCOM_Liveblog {
 
 		/** Constants *************************************************************/
-		const VERSION                 = '1.9.6';
+		const VERSION                 = '1.9.7';
 		const REWRITES_VERSION        = 1;
 		const MIN_WP_VERSION          = '4.4';
 		const MIN_WP_REST_API_VERSION = '4.4';