Repository navigation
Stop password-protected and private articles leaking to visitors - #81
Merged
ajaydsouza merged 5 commits intoOct 12, 2026
Merged
Conversation
The /wzkb/v1/knowledgebase, /wzkb/v1/knowledgebase/{id} and /wzkb/v1/search
endpoints returned the content and excerpt of password-protected articles
without the password. Return an empty excerpt and content when
post_password_required() is true, add a 'protected' flag like core, and skip
caching responses that include password-protected posts so an unlocked
response is never served to another requester.
… Help widget The table of contents renderers that sit outside the article body (the [kbtoc] shortcode, the floating TOC, the docs layout outline, and the TOC widget and block) built their outline from the raw content of a password-protected article before the password was entered. Add TOC::is_post_locked() and return nothing from each renderer when the post is locked, while keeping the TOC in the editor preview for users who can edit the post. Also blank the Help widget's manual excerpt for locked suggested articles, skip the thumbnail content scan for locked posts, and version the REST cache keys so responses cached by 3.2.0 are never served again.
…tected-article-disclosure-y3o813
Key the section listing cache to the persistent content version in Util\Cache instead of wp_cache_get_last_changed( 'posts' ), which changes on every request without a persistent object cache. Add the remaining password-protection fixes to the changelog, without Pro-only fixes.
ajaydsouza
deleted the
claude/password-protected-article-disclosure-y3o813
branch
October 12, 2026 19:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Free-tier sync of WebberZone/knowledgebase-pro#38. The changed files under
includes/andphpunit/tests/are identical to the Pro branch; Pro-only files are left out.Fixes the reported unauthenticated disclosure of password-protected Knowledge Base articles (CVSS 5.3) and the related leaks.
Changes
excerptandcontentuntil the visitor enters the password, with aprotectedflag on every item. Responses containing protected articles are never cached; the list endpoint only returns published articles./wzkb/v1/relatedno longer caches and now honourspost_idandlimit. Cache keys are versioned so 3.2.0 entries are never read.[kbtoc]shortcode: renders nothing for a locked article (newTOC::is_post_locked()).Util\Cache, so they refresh when an article gains a password and still cache without a persistent object cache.Testing
phpunit/tests/test-rest-password-protection.php.Notes