Loosen-IT/WP-LIT-MCP
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

fix: restrict media-search to the query, not just editable() after it

Browse Source 
I1: query the attachments themselves author-restricted when the user
lacks edit_others_posts (PostGuard::ownPostsOnly, extracted from
ContentQueryAbility so content-query reuses the exact same rule)
instead of relying solely on a post-query editable() filter, which
could leak the existence of other users' attachments via an empty
page plus next_cursor. editable() stays as a backstop.

Also: M1 document that only status=inherit attachments are listed;
M2 tie-break ordering by ID (content-query and media-search) for
stable pagination; M3 no next_cursor once the last candidate was
examined; M4 reject an explicit non-image mime with missing_alt;
M5 additional coverage (posts_per_page, cursor offset pass-through,
invalid cursor, post_status/date/mime args); mime maxLength 100.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
This commit is contained in:
janniclas.loosen
2026-09-26 02:19:50 +02:00
co-authored by Claude Opus 5.5
parent 5099c9fc89
commit b0da2cdecc
6 changed files with 262 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Integrations/WordPress/Content/ContentQueryAbility.php
+7 -4
View File
@@ -176,8 +176,10 @@ final class ContentQueryAbility implements Ability
// Without edit_others_posts, even a status the user may edit in principle must
// stay limited to their own posts – otherwise the query would leak drafts etc.
// of other authors that happen to pass the per-status gate below.
$restrictedToOwnPosts = ! current_user_can($this->capability($caps, 'edit_others_posts'));
$ownerId = PostGuard::ownPostsOnly($postType);
$restrictedToOwnPosts = $ownerId !== null;
$order = strtoupper((string) ($input['order'] ?? 'desc'));
$args = [
'post_type' => $postType,
'post_status' => $this->allowedStatuses(
@@ -185,15 +187,16 @@ final class ContentQueryAbility implements Ability
$caps,
$restrictedToOwnPosts
),
'orderby' => (string) ($input['orderby'] ?? 'date'),
'order' => strtoupper((string) ($input['order'] ?? 'desc')),
// A secondary ID tie-breaker keeps paging stable when several entries share the
// exact same orderby value (e.g. bulk-imported posts with an identical date).
'orderby' => [(string) ($input['orderby'] ?? 'date') => $order, 'ID' => $order],
'no_found_rows' => true,
'ignore_sticky_posts' => true,
'suppress_filters' => false,
];
if ($restrictedToOwnPosts) {
$args['author'] = get_current_user_id();
$args['author'] = $ownerId;
}
if (isset($input['search']) && $input['search'] !== '') {
src/Integrations/WordPress/PostGuard.php
+22
View File
@@ -119,6 +119,28 @@ final class PostGuard
return $object;
}
/**
* Whether a list/search query for this post type must stay restricted to the current
* user's own entries because they lack edit_others_posts. Filtering per row after the
* query (e.g. current_user_can('edit_post', $id)) is not enough on its own: without this,
* a restricted user's query still runs unrestricted, so a page can come back empty (or
* short) with a next_cursor that quietly reveals other users' entries exist without ever
* showing them – the same defect ContentQueryAbility guards against for content-query.
*
* @return int|null The current user id when restricted, null when the query may run
* unrestricted (author filter must then be left out entirely).
*/
public static function ownPostsOnly(string $postType): ?int
{
$typeObject = get_post_type_object($postType);
$caps = is_object($typeObject) && isset($typeObject->cap) ? $typeObject->cap : null;
$capability = $caps !== null && isset($caps->edit_others_posts)
? (string) $caps->edit_others_posts
: 'edit_others_posts';
return current_user_can($capability) ? null : get_current_user_id();
}
public static function id(mixed $value): ?int
{
if (is_int($value)) {