WordPress.org
Get WordPress

Plugin Directory

Changeset 3436004


Ignore:
Timestamp:
01/09/2026 02:42:58 PM (3 months ago)
Author:
butterflymedia
Message:

Gravity Forms REST API endpoints are now whitelisted to prevent blocking form submissions

Location:
wp-guardian/trunk
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • wp-guardian/trunk/modules/firewall.php

    r3433652 r3436004  
    4848            'wp-json/wp/',
    4949            'wp-json/edd/',
     50            'wp-json/gf/',
    5051        ];
    5152
    … …  
    5657        }
    5758       
    58         // If it's a REST API request and user is authenticated, skip all firewall checks
    59         if ( $is_rest_request && is_user_logged_in() ) {
     59        // If it's a REST API request, skip all firewall checks (REST API is WordPress core functionality)
     60        if ( $is_rest_request ) {
    6061            return;
    6162        }
    … …  
    134135
    135136        if ( $post_scanning && isset( $_POST ) && $should_deep_scan ) {
    136             // Skip POST scanning for authenticated REST API requests
    137             if ( $is_rest_request && is_user_logged_in() ) {
     137            // Skip POST scanning for all REST API requests (REST API is WordPress core functionality)
     138            if ( $is_rest_request ) {
    138139                return;
    139140            }
    … …  
    148149                }
    149150
    150                 // Skip POST scanning for authenticated users in admin or REST API
    151                 if ( ( is_admin() || ( $is_rest_request && is_user_logged_in() ) ) ) {
     151                // Skip POST scanning for authenticated users in admin
     152                if ( is_admin() ) {
    152153                    continue;
    153154                }

  • wp-guardian/trunk/modules/security-measures.php

    r3435127 r3436004  
    214214        'init',
    215215        function () {
    216             // Skip blocking for authenticated REST API requests
     216            // Skip blocking for all REST API requests (REST API is WordPress core functionality)
    217217            $is_rest_request = false;
    218218            if ( isset( $_SERVER['REQUEST_URI'] ) ) {
    … …  
    223223            }
    224224           
    225             // Only block if not admin, not logged in, and not authenticated REST API request
    226             if ( ! is_admin() && ! is_user_logged_in() && ! ( $is_rest_request && is_user_logged_in() ) ) {
     225            // Only block if not admin, not logged in, and not a REST API request
     226            if ( ! is_admin() && ! is_user_logged_in() && ! $is_rest_request ) {
    227227                $request_uri = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
    228228                $restricted  = [ '\.git', '\.svn', '\.env$', 'wp-config\.php$', '\.htaccess$', '\.htpasswd$' ];

  • wp-guardian/trunk/readme.txt

    r3435127 r3436004  
    77Requires PHP: 7.0
    88Requires CP: 2.0
    9 Stable tag: 1.8.4
     9Stable tag: 1.8.5
    1010License: GPLv3 or later
    1111License URI: https://www.gnu.org/licenses/gpl-3.0.html
    … …  
    4343
    4444== Changelog ==
     45
     46= 1.8.5 =
     47* Fix: All REST API requests (including unauthenticated) are now excluded from firewall blocking to support Gravity Forms and other plugins
     48* Fix: Gravity Forms REST API endpoints are now whitelisted to prevent blocking form submissions
     49* Fix: Gravity Forms form submissions from logged-out users now work correctly
    4550
    4651= 1.8.4 =

  • wp-guardian/trunk/wp-guardian.php

    r3435127 r3436004  
    44 * Plugin URI: https://getbutterfly.com/wordpress-plugins/wp-guardian/
    55 * Description: An easy way to harden your website's security effectively.
    6  * Version: 1.8.4
     6 * Version: 1.8.5
    77 * Author: Ciprian Popescu
    88 * Author URI: https://getbutterfly.com/
    … …  
    3333}
    3434
    35 define( 'DTJWPG_VERSION', '1.8.4' );
     35define( 'DTJWPG_VERSION', '1.8.5' );
    3636define( 'DTJWPG_URL', __FILE__ );
    3737define( 'DTJWPG_BASENAME', plugin_basename( DTJWPG_URL ) );
Note: See TracChangeset for help on using the changeset viewer.