hotfix 1.1.1: 2meet-data-optimizer — keep private fields out of the public listings REST endpoints #5

Merged

wpdev merged 1 commits from hotfix/1.1.1 into main 2026-09-26 22:25:24 +08:00

Conversation 0 Commits 1 Files Changed 9

+236 -12

wpdev commented 2026-09-26 22:22:41 +08:00

Owner

Copy Link

Copy Source

Security hotfix (Critical). The public GET /wpdo/v1/listings and /wpdo/v1/listings/{id} returned every registered hot / cold field to anonymous visitors, because show_in_rest defaulted to true and no add-on set it. Confirmed on dev36: infocards tmeetic_ig_access_token_enc / tmeetic_ig_token_expiry / tmeetic_ig_user_id and WooCommerce _purchase_note. Present since 1.0.x. No site currently holds such data behind an enabled endpoint (checked 2026-09-26).

Changes

• show_in_rest now defaults to false; fields must be declared public.
• TMDO_Schema_Registry::rest_exposable(): protected (underscore) keys and credential-like keys are never exposed, whatever they declare.
• Zone A list path is fail-closed (no whole rows when nothing is public); filters and orderby accept public columns only.
• Version 1.1.1, CHANGELOG, readme. 1.1.0 zip withdrawn.

Compatibility

Fields that relied on the old default must add 'show_in_rest' => true (or use the existing tmdo_rest_listing_visible_fields filter).

Verification

unit 690 (+3), integration 525 (+3, RED on 1.1.0), live suite rest 2/2 (RED on 1.1.0), all live suites 49/49 on dev36, phpcs 0, phpstan OK.

**Security hotfix (Critical).** The public `GET /wpdo/v1/listings` and `/wpdo/v1/listings/{id}` returned every registered hot / cold field to anonymous visitors, because `show_in_rest` defaulted to true and no add-on set it. Confirmed on dev36: infocards `tmeetic_ig_access_token_enc` / `tmeetic_ig_token_expiry` / `tmeetic_ig_user_id` and WooCommerce `_purchase_note`. Present since 1.0.x. No site currently holds such data behind an enabled endpoint (checked 2026-09-26). ## Changes - `show_in_rest` now defaults to **false**; fields must be declared public. - `TMDO_Schema_Registry::rest_exposable()`: protected (underscore) keys and credential-like keys are never exposed, whatever they declare. - Zone A list path is fail-closed (no whole rows when nothing is public); filters and orderby accept public columns only. - Version 1.1.1, CHANGELOG, readme. 1.1.0 zip withdrawn. ## Compatibility Fields that relied on the old default must add `'show_in_rest' => true` (or use the existing `tmdo_rest_listing_visible_fields` filter). ## Verification unit 690 (+3), integration 525 (+3, RED on 1.1.0), live suite `rest` 2/2 (RED on 1.1.0), all live suites 49/49 on dev36, phpcs 0, phpstan OK.

wpdev added 1 commit 2026-09-26 22:22:41 +08:00

fix(2meet-data-optimizer): keep registered fields out of the public listings REST endpoints ... 336664473b

- show_in_rest defaulted to true, so GET /wpdo/v1/listings and /listings/{id} (public by design) returned every registered hot / cold field to anonymous visitors — e.g. infocards tmeetic_ig_access_token_enc / _token_expiry / _user_id and WooCommerce _purchase_note (confirmed on dev36)
- Fields are private unless registered with show_in_rest => true; protected (underscore) and credential-like keys (token, secret, password, api key, private key, credential, salt, nonce) are never exposed
- Zone A list path no longer returns whole rows when nothing is public, and filters / orderby accept public columns only
- Version 1.1.1; CHANGELOG, readme
- Verify: unit 690 (+3), integration 525 (+3 private-column tests, RED on 1.1.0), live suite rest 2/2 (RED on 1.1.0), all live 49/49, phpcs 0, stan OK

wpdev merged commit 957f5c4ab0 into main 2026-09-26 22:25:24 +08:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

wpdev

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wpdev/2meet-data-optimizer#5