Repository navigation
The get-entry gate asks about the entry's form, not the blanket question - #50
Merged
AllTerrainDeveloper merged 1 commit intoSep 6, 2026
Merged
Conversation
The wordpress.org review flagged that the `get-entry` ability's
permission callback checked only whether the caller may read entries at
all. The data path behind it -- `alltfo_prepare_entry()` -- already
refused an entry whose form the per-form `alltfo_can_read_entries`
filter denies, so nothing leaked; but the declared gate is what an MCP
client consults before running anything, and it said "yes" to entries
it would then decline to return.
`alltfo_can_read_entry( $entry_id )` resolves an entry to its form and
asks the filter about that form. The `get-entry` ability and the
`/entries/{id}` REST route -- which had the same shape, deliberately
keeping the entry id out of the form question but asking about form 0
instead -- both gate on it now. An id that is not an entry falls back to
the blanket question so a capable caller still reaches its own "does not
exist" answer.
Tests cover the gate directly through `check_permissions()`, the REST
callback on an entry of a denied form, and the helper's fallback; the
abilities and hooks docs describe the per-form behaviour of get-entry.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T7rWsbxZpSLqBqd2DtDGUY
AllTerrainDeveloper
deleted the
fix/get-entry-permission-asks-about-the-form
branch
September 6, 2026 15:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The wordpress.org reviewer flagged
allterrain-forms/get-entry: itspermission_callbackchecked only blanket entry-read access and did not authorise the target entry's form.In practice nothing leaked --
alltfo_prepare_entry()re-asks the per-formalltfo_can_read_entriesfilter with the entry's form and returns nothing when denied -- but the declared gate is what an MCP client and the Abilities REST channel consult before executing, and it answered yes to entries the ability would then refuse. The/entries/{id}REST route had the same shape.Change
alltfo_can_read_entry( $entry_id )inincludes/post-types.php: resolves the entry to its form and asks the per-form filter about that form. A non-entry id falls back to the blanket question so a capable caller still gets its own "does not exist" answer rather than an opaque refusal.get-entryability gates on it (includes/abilities.php).alltfo_rest_can_read_entries()gates/entries/{id}on it too, while/forms/{id}/analyticskeeps treatingidas the form (includes/rest.php).Tests
test_per_form_filter_confines_the_read_abilitiesnow seeds an entry in an allowed and a denied form and assertscheck_permissions()itself refuses the denied one, and thatexecute()still returns aWP_Error.test_analytics_permission_asks_about_the_right_formnow expects the entry route to be denied at the gate when its form is denied, and still asserts the entry id is never mistaken for a form id.test_reading_one_entry_asks_about_its_formcovers the helper and its fallback.Docs
docs/abilities.mdanddocs/hooks-reference.mddescribe the per-form gating ofget-entryand the/entries/{id}route.🤖 Generated with Claude Code
https://claude.ai/code/session_01T7rWsbxZpSLqBqd2DtDGUY