fix: check per-chart edit_post capability in chart_data REST field - #1348
Open
lucadobrescu wants to merge 2 commits into
Open
fix: check per-chart edit_post capability in chart_data REST field#1348lucadobrescu wants to merge 2 commits into
lucadobrescu wants to merge 2 commits into
Conversation
The chart_data REST field callback only checked the generic edit_posts
capability, so any contributor could read the full backend configuration
of any chart (data source query, settings, JSON endpoint auth headers)
via GET /wp-json/wp/v2/visualizer/{id}.
Check edit_post on the requested chart instead, so access follows the
standard post capability map (author or edit_others_posts).
Fixes Codeinwp/visualizer-pro#605
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
lucadobrescu
added
the
pr-checklist-skip
pirate-bot
added
the
pr-checklist-complete
Contributor
Soare-Robert-Daniel
approved these changes
Jul 27, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Secures the chart_data REST field with per-chart authorization.
Changes:
- Replaces the generic capability check with object-specific authorization.
- Adds regression tests for chart configuration access.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
classes/Visualizer/Gutenberg/Block.php |
Restricts REST chart data access. |
tests/test-chart-data-permissions.php |
Tests owner and non-owner access. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+52
to
+53
| $author_id = self::factory()->user->create( array( 'role' => 'editor' ) ); | ||
| $chart_id = $this->create_chart( $author_id ); |
Contributor
Author
There was a problem hiding this comment.
Done in 6b05e98 — fixtures are now published, the positive case is a Contributor-owned chart, and added an Editor-reads-others'-chart case.
Charts are force-published on save, and Contributors lack edit_published_posts, so a bare edit_post check locks chart authors out of their own charts in the Gutenberg block. Use the existing Visualizer_Module::can_edit_chart() helper, which allows the chart owner with edit_posts while still rejecting other users' charts. Covers Copilot review feedback on #1348. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Any logged-in user with the
edit_postscapability (Contributor and above) could read the full backend configuration of any chart on the site — data source query, series/settings, and JSON endpoint URLs with their authentication headers — viaGET /wp-json/wp/v2/visualizer/{chart_id}, because thechart_dataREST field callback only checked the genericedit_postscapability. Reported in Codeinwp/visualizer-pro#605.What changed
chart_dataREST field guard —get_visualizer_data()now checksVisualizer_Module::can_edit_chart()against the requested chart instead of the genericcurrent_user_can( 'edit_posts' ). Access is allowed for the chart's author and for users withedit_others_posts(Editor and above). The existingcan_edit_chart()helper is used instead of a bareedit_postcheck because charts are force-published on save and Contributors lackedit_published_posts— a bare check would lock Contributor authors out of their own charts.Regression test —
tests/test-chart-data-permissions.phpasserts a Contributor getsfalsefor another user's published chart, a Contributor author still receives their own chart's data, and an Editor can read any chart.chart_data request flow
flowchart LR A[GET /wp/v2/visualizer/id] --> B[chart_data field callback] B --> C{Changed:<br/>can_edit_chart —<br/>author or Editor+?}:::changed C -- Yes --> D[Return chart config] C -- No --> E[Return false] classDef changed fill:#9a6700,color:#fff,stroke:#5c3d00,stroke-width:3px,stroke-dasharray:6 3QA
As an Administrator, create and publish a chart, and note its post ID.
As a Contributor, request the chart over REST (e.g. from the browser console while logged in):
Expect:
chart_dataisfalse— no source query, settings, or endpoint headers in the response.As the chart's author (or an Editor/Administrator), repeat the same request.
Expect:
chart_datacontains the chart configuration and the chart still loads normally in the Gutenberg block editor.As a Contributor, create a chart of your own, then repeat the request for that chart's ID.
Expect:
chart_datacontains the chart configuration — Contributor authors keep access to their own charts.🤖 Generated with Claude Code