Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: restrict content-query by cap before pagination, filter hidden fields

Browse Source 
Review fix round 1: content-query now excludes posts/statuses the user
cannot edit before querying (author restriction without edit_others_posts,
status filtering by edit_private_posts/edit_published_posts) instead of
only dropping them after fetching, and rejects unknown field/taxonomy
filters. content-types' not-found hint only lists editable types.
PostPresenter skips Pods password fields and readonly protected meta.
Query input gains search/terms length limits.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
janniclas.loosen
2026-09-25 22:48:05 +02:00
co-authored by Claude Opus 5.5
parent d68e9b1f04
commit 0890e6f165
7 changed files with 268 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Integrations/WordPress/Content/ContentQueryAbility.php
+96 -4
View File
@@ -6,6 +6,7 @@ namespace LIT\MCP\Integrations\WordPress\Content;
use LIT\MCP\Abilities\Ability;
use LIT\MCP\Abilities\Cursor;
use LIT\MCP\Abilities\Errors;
use LIT\MCP\Integrations\WordPress\PostGuard;
use LIT\MCP\Integrations\WordPress\Schema\ContentSchema;
use WP_Error;
@@ -48,12 +49,17 @@ final class ContentQueryAbility implements Ability
'items' => ['type' => 'string', 'enum' => self::STATUSES],
'description' => 'Standard: alle außer Papierkorb.',
],
'search' => ['type' => 'string'],
'search' => ['type' => 'string', 'maxLength' => 200],
'taxonomy' => [
'type' => 'object',
'properties' => [
'taxonomy' => ['type' => 'string'],
'terms' => ['type' => 'array', 'minItems' => 1, 'items' => ['type' => ['integer', 'string']]],
'terms' => [
'type' => 'array',
'minItems' => 1,
'maxItems' => 50,
'items' => ['type' => ['integer', 'string']],
],
],
'required' => ['taxonomy', 'terms'],
'additionalProperties' => false,
@@ -115,6 +121,22 @@ final class ContentQueryAbility implements Ability
return Cursor::invalid();
}
$postType = (string) $input['post_type'];
if (isset($input['field']) && is_array($input['field'])) {
$error = $this->rejectUnlessKnownField($postType, (string) $input['field']['key']);
if ($error !== null) {
return $error;
}
}
if (isset($input['taxonomy']) && is_array($input['taxonomy'])) {
$error = $this->rejectUnlessKnownTaxonomy($postType, (string) $input['taxonomy']['taxonomy']);
if ($error !== null) {
return $error;
}
}
$limit = Cursor::limit($input['limit'] ?? null);
$posts = get_posts(array_merge($this->queryArgs($input), [
'posts_per_page' => $limit + 1,
@@ -138,9 +160,13 @@ final class ContentQueryAbility implements Ability
*/
private function queryArgs(array $input): array
{
$postType = (string) $input['post_type'];
$typeObject = get_post_type_object($postType);
$caps = is_object($typeObject) && isset($typeObject->cap) ? $typeObject->cap : null;
$args = [
'post_type' => (string) $input['post_type'],
'post_status' => $input['status'] ?? self::STATUSES,
'post_type' => $postType,
'post_status' => $this->allowedStatuses((array) ($input['status'] ?? self::STATUSES), $caps),
'orderby' => (string) ($input['orderby'] ?? 'date'),
'order' => strtoupper((string) ($input['order'] ?? 'desc')),
'no_found_rows' => true,
@@ -148,6 +174,13 @@ final class ContentQueryAbility implements Ability
'suppress_filters' => false,
];
// Without edit_others_posts, even a status the user may edit in principle must
// stay limited to their own posts – otherwise the query would leak drafts etc.
// of other authors that happen to pass the per-status gate below.
if (! current_user_can($this->capability($caps, 'edit_others_posts'))) {
$args['author'] = get_current_user_id();
}
if (isset($input['search']) && $input['search'] !== '') {
$args['s'] = (string) $input['search'];
}
@@ -204,4 +237,63 @@ final class ContentQueryAbility implements Ability
return count($clauses) > 1 ? array_merge(['relation' => 'OR'], $clauses) : $clauses;
}
/**
* Drops statuses the current user has no right to edit at all, so the query never
* even fetches rows that would only be discarded by the per-post check afterwards
* (which would otherwise waste a page slot and reveal the post existed).
*
* @param list<mixed> $statuses
* @return list<string>
*/
private function allowedStatuses(array $statuses, ?object $caps): array
{
$gates = [
'private' => $this->capability($caps, 'edit_private_posts'),
'publish' => $this->capability($caps, 'edit_published_posts'),
'future' => $this->capability($caps, 'edit_published_posts'),
];
return array_values(array_filter(
array_map('strval', $statuses),
static fn (string $status): bool => ! isset($gates[$status]) || current_user_can($gates[$status])
));
}
private function capability(?object $caps, string $name): string
{
return $caps !== null && isset($caps->{$name}) ? (string) $caps->{$name} : $name;
}
private function rejectUnlessKnownField(string $postType, string $key): ?WP_Error
{
$allowed = array_keys($this->schema->fields($postType));
if (in_array($key, $allowed, true)) {
return null;
}
return Errors::invalidInput(
sprintf('Feld "%s" ist für Inhaltstyp "%s" nicht verfügbar.', $key, $postType),
['field.key' => 'unbekanntes Feld'],
$allowed === []
? 'Für diesen Inhaltstyp sind keine Felder verfügbar.'
: 'Verfügbare Felder: ' . implode(', ', $allowed) . '.'
);
}
private function rejectUnlessKnownTaxonomy(string $postType, string $taxonomy): ?WP_Error
{
$allowed = array_column($this->schema->taxonomies($postType), 'name');
if (in_array($taxonomy, $allowed, true)) {
return null;
}
return Errors::invalidInput(
sprintf('Taxonomie "%s" ist für Inhaltstyp "%s" nicht verfügbar.', $taxonomy, $postType),
['taxonomy.taxonomy' => 'unbekannte Taxonomie'],
$allowed === []
? 'Für diesen Inhaltstyp sind keine Taxonomien verfügbar.'
: 'Verfügbare Taxonomien: ' . implode(', ', $allowed) . '.'
);
}
}