Changeset 3433652

Timestamp:

01/06/2026 01:22:17 PM (3 months ago)

Author:

butterflymedia

Message:

Authenticated REST API requests are now properly excluded from firewall blocking

Location:

wp-guardian/trunk

Files:

• modules/firewall.php (modified) (4 diffs)
• modules/security-measures.php (modified) (1 diff)
• readme.txt (modified) (2 diffs)
• wp-guardian.php (modified) (2 diffs)

wp-guardian/trunk/modules/firewall.php

@@ -35 +35 @@
 function wp_guardian_gatekeeper_core() {
     if ( ! defined( 'DOING_CRON' ) || ! DOING_CRON ) {
+        // Check if this is a REST API request
+        $is_rest_request = false;
+        if ( isset( $_SERVER['REQUEST_URI'] ) ) {
+            $request_uri = sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) );
+            if ( strpos( $request_uri, '/wp-json/' ) !== false ) {
+                $is_rest_request = true;
+            }
+        }
+        
         $ignored_patterns = [
             'admin-ajax.php',
@@ -46 +55 @@
             }
         }
+        
+        // If it's a REST API request and user is authenticated, skip all firewall checks
+        if ( $is_rest_request && is_user_logged_in() ) {
+            return;
+        }
 
         //
@@ -120 +134 @@
 
         if ( $post_scanning && isset( $_POST ) && $should_deep_scan ) {
+            // Skip POST scanning for authenticated REST API requests
+            if ( $is_rest_request && is_user_logged_in() ) {
+                return;
+            }
+            
             $post_array = apply_filters( 'post_items', [ '<%=', '\+\/"\/\+\/', '(<|%3C|&lt;?|u003c|x3c)script', 'src=#\s', '(href|src)="javascript:', '(href|src)=javascript:', '(href|src)=`javascript:' ] );
 
@@ -129 +148 @@
                 }
 
-                if ( ! is_admin() && preg_match( '/' . implode( '|', $post_array ) . '/i', $value, $matches ) ) {
+                // Skip POST scanning for authenticated users in admin or REST API
+                if ( ( is_admin() || ( $is_rest_request && is_user_logged_in() ) ) ) {
+                    continue;
+                }
+                
+                if ( preg_match( '/' . implode( '|', $post_array ) . '/i', $value, $matches ) ) {
                     wp_guardian_gatekeeper_response( $matches, $request_uri_string, $query_string_string, $user_agent_string, $referrer_string );
 

wp-guardian/trunk/modules/security-measures.php

@@ -214 +214 @@
         'init',
         function () {
-            if ( ! is_admin() && ! is_user_logged_in() ) {
+            // Skip blocking for authenticated REST API requests
+            $is_rest_request = false;
+            if ( isset( $_SERVER['REQUEST_URI'] ) ) {
+                $request_uri = sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) );
+                if ( strpos( $request_uri, '/wp-json/' ) !== false ) {
+                    $is_rest_request = true;
+                }
+            }
+            
+            // Only block if not admin, not logged in, and not authenticated REST API request
+            if ( ! is_admin() && ! is_user_logged_in() && ! ( $is_rest_request && is_user_logged_in() ) ) {
                 $request_uri = isset( $_SERVER['REQUEST_URI'] ) ? sanitize_text_field( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '';
                 $restricted  = [ '/\.git/', '/\.svn/', '/\.env$', '/wp-config\.php$', '/\.htaccess$', '/\.htpasswd$' ];

wp-guardian/trunk/readme.txt

@@ -7 +7 @@
 Requires PHP: 7.0
 Requires CP: 2.0
-Stable tag: 1.8.2
+Stable tag: 1.8.3
 License: GPLv3 or later
 License URI: https://www.gnu.org/licenses/gpl-3.0.html
@@ -43 +43 @@
 
 == Changelog ==
+
+= 1.8.3 =
+* Fix: Authenticated REST API requests are now properly excluded from firewall blocking
+* Fix: POST scanning no longer blocks authenticated REST API requests when saving pages
+* Fix: Security measures no longer interfere with authenticated REST API requests
 
 = 1.8.2 =

wp-guardian/trunk/wp-guardian.php

@@ -4 +4 @@
  * Plugin URI: https://getbutterfly.com/wordpress-plugins/wp-guardian/
  * Description: An easy way to harden your website's security effectively.
- * Version: 1.8.2
+ * Version: 1.8.3
  * Author: Ciprian Popescu
  * Author URI: https://getbutterfly.com/
@@ -33 +33 @@
 }
 
-define( 'DTJWPG_VERSION', '1.8.2' );
+define( 'DTJWPG_VERSION', '1.8.3' );
 define( 'DTJWPG_URL', __FILE__ );
 define( 'DTJWPG_BASENAME', plugin_basename( DTJWPG_URL ) );