Context Navigation

Changeset 3483325

Timestamp:

03/15/2026 10:34:35 PM (2 weeks ago)

Author:

mateuszflowsystems

Message:

Release 1.3.2

Location:

flowsystems-webhook-actions/trunk

Files:

-                      r3483320
+                      r3483325
 Tested up to: 6.9
 Requires PHP: 8.0
 Stable tag: 1.3.1
+Stable tag: 1.3.2
 License: GPLv2 or later
 License URI: https://www.gnu.org/licenses/old-licenses/gpl-2.0.html
 …
 == Changelog ==
+= 1.3.2 — 2026-03-15 =
+- Fixed `auth_header` field being exposed to API tokens without `full` scope — read and operational tokens now receive a permission notice instead
 = 1.3.1 — 2026-03-15 =

-                      r3483320
+                      r3483325
  * Plugin URI: https://flowsystems.pl/wordpress-webhook-actions
  * Description: Trigger HTTP webhooks from WordPress actions (do_action). Easily connect WordPress with n8n, Zapier, Make, or custom workflows.
  * Version: 1.3.1
+ * Version: 1.3.2
  * Author: Mateusz Skorupa
  * Author URI: https://flowsystems.pl
 …
 defined('ABSPATH') || exit;
 define('FSWA_VERSION', '1.3.1');
+define('FSWA_VERSION', '1.3.2');
 define('FSWA_FILE', __FILE__);

-                      r3483307
+                      r3483325
     return true;
+  }
+  /**
+   * Check if the current request has at least the given scope (or is an admin session).
+   * Use this for response shaping — does not send errors.
+   */
+  public static function requestHasScope(WP_REST_Request $request, string $scope): bool {
+    if (current_user_can('manage_options')) {
+      return true;
+    }
+    $service = new ApiTokenService();
+    $token   = $service->validateFromRequest($request);
+    if ($token === false) {
+      return false;
+    }
+    return $service->tokenHasScope($token, $scope);
+  }
+}

-                      r3483307
+                      r3483325
   /**
+   * Strip auth_header for non-full-scope callers.
+   */
+  private function prepareWebhook(array $webhook, WP_REST_Request $request): array {
+    if (!AuthHelper::requestHasScope($request, AuthHelper::SCOPE_FULL)) {
+      $webhook['auth_header'] = __('You don\'t have permissions to see it.', 'flowsystems-webhook-actions');
+    }
+    return $webhook;
+  }
+  /**
    * Get all webhooks
    */
   public function getItems($request): WP_REST_Response {
     $webhooks = $this->repository->getAll();
+    $webhooks = array_map(fn($w) => $this->prepareWebhook($w, $request), $webhooks);
     return rest_ensure_response($webhooks);
 …
+    }
     return rest_ensure_response($webhook);
+    return rest_ensure_response($this->prepareWebhook($webhook, $request));
+  }
 …
     $webhook = $this->repository->find($webhookId);
     return rest_ensure_response($webhook);
+    return rest_ensure_response($this->prepareWebhook($webhook, $request));
+  }
 …
     $webhook = $this->repository->find($id);
     return rest_ensure_response($webhook);
+    return rest_ensure_response($this->prepareWebhook($webhook, $request));
+  }
 …
     $webhook = $this->repository->find($id);
     return rest_ensure_response($webhook);
+    return rest_ensure_response($this->prepareWebhook($webhook, $request));
+  }

Note: See TracChangeset for help on using the changeset viewer.