Automattic / Automattic/jetpack

JSON API: Private metadata not available for authenticated user

Open
#3,061 1 comment 0 reactions 0 assignees View on GitHub
[Feature] WPCOM API [Pri] Low Bug
Dominant language
PHP
Stars
1.8k
Forks
898
Avg merge
1d 18h
Merged PRs (30d)
774

Description

Per https://developer.wordpress.com/2013/04/26/custom-post-type-and-metadata-support-in-the-rest-api/ , private metadata should be available when requested by an authenticated user with rights to edit the post. This appears to not be happening.

Steps to reproduce:
0. Have a post with private meta data (e.g. `_private_meta_key`).
1. Via the https://developer.wordpress.com/console/ while logged into the wpcom user that owns the JP connection and is the author of the post (thus no question has the cap), query `/v1.1/sites/$site//posts/$ID`

Expected: The metadata array includes `_private_meta_key`.

Actual: It does not.

Further testing, if the key is specifically whitelisted by `rest_api_allowed_public_metadata`, it is included (expected), so my first thought is https://github.com/Automattic/jetpack/blob/3.8.0/json-endpoints/class.wpcom-json-api-post-endpoint.php#L448 is failing.

Contributor guide

Open the contributing guide

Research direction

Start in json-endpoints/class.wpcom-json-api-post-endpoint.php around line 448, then reproduce the authenticated request described through the WordPress.com console. Confirm that an authenticated user with rights to edit the post receives the private metadata key, while the existing whitelist behavior remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
php, wordpress
Domain
api, authentication, authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.