Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix(security): Pods-Feldrechte fail-closed

Browse Source 
Fehlt pods_has_permissions() oder pods_permission(), gilt kein Pods-Feld mehr als unbeschränkt, sondern als nicht erlaubt (HIDDEN/READONLY).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Jan-Niclas Loosen
2026-11-06 11:30:05 +01:00
co-authored by Claude Opus 5.5
parent 29e73caefb
commit 8f3a4e76eb
2 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Integrations/Pods/PodsFieldSource.php
Generated
+4 -3
View File
@@ -50,11 +50,12 @@ final class PodsFieldSource implements FieldSource
$this->loadPod = $loadPod ?? static fn (string $name): mixed => pods_api()->load_pod(['name' => $name]);
$this->podFor = $podFor ?? static fn (string $name, int $id): mixed => pods($name, $id);
$this->permitted = $permitted ?? static function (object $field): ?bool {
if (! function_exists('pods_has_permissions') || ! pods_has_permissions($field)) {
return null;
// Fail closed: without the Pods permission API no field counts as permitted.
if (! function_exists('pods_has_permissions') || ! function_exists('pods_permission')) {
return false;
}
return function_exists('pods_permission') && (bool) pods_permission($field);
return pods_has_permissions($field) ? (bool) pods_permission($field) : null;
};
}