Fix broken access control (#1590)

* BREAKING CHANGE: fix broken access control * refactor: hard code secured fields
wpmetabox · Jun 26, 2024 · db1e61a · db1e61a
1 parent 2d492a7
commit db1e61a
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 13 deletions.
diff --git a/inc/fields/post.php b/inc/fields/post.php
@@ -108,6 +108,8 @@ public static function query( $meta, array $field ): array {
 			'mb_field_id'            => $field['id'],
 		] );
 
+		$args['perm'] = 'readable';
+
 		$meta = wp_parse_id_list( (array) $meta );
 
 		// Query only selected items.

diff --git a/inc/fields/user.php b/inc/fields/user.php
@@ -17,7 +17,7 @@ public static function ajax_get_users() {
 		$request = rwmb_request();
 
 		$field = $request->filter_post( 'field', FILTER_DEFAULT, FILTER_FORCE_ARRAY );
-
+		
 		// Required for 'choice_label' filter. See self::filter().
 		$field['clone']        = false;
 		$field['_original_id'] = $field['id'];
@@ -96,22 +96,22 @@ public static function normalize( $field ) {
 
 	public static function query( $meta, array $field ): array {
 		$display_field = $field['display_field'];
+
 		$args          = wp_parse_args( $field['query_args'], [
 			'orderby' => $display_field,
 			'order'   => 'asc',
-			'fields'  => [
-				'ID',
-				'user_login',
-				'user_pass',
-				'user_nicename',
-				'user_email',
-				'user_url',
-				'user_registered',
-				'user_status',
-				'display_name',
-			],
 		] );
 
+		$args['fields']  = [
+			'ID',
+			'user_login',
+			'user_nicename',
+			'user_url',
+			'user_registered',
+			'user_status',
+			'display_name',
+		];
+
 		$meta = wp_parse_id_list( (array) $meta );
 
 		// Query only selected items.
@@ -132,7 +132,7 @@ public static function query( $meta, array $field ): array {
 		$users   = get_users( $args );
 		$options = [];
 		foreach ( $users as $user ) {
-			$label = $user->$display_field ? $user->$display_field : __( '(No title)', 'meta-box' );
+			$label = $user->$display_field ?? __( '(No title)', 'meta-box' );
 			$label = self::filter( 'choice_label', $label, $field, $user );
 
 			$options[ $user->ID ] = [