Doesn’t block media access

  • Resolved Stephen Rees-Carter

    (@valorin)


    9 years, 3 months ago

    I’m using https://en-au.ww.wp.xz.cn/plugins/wp-force-login/ to lock down my WordPress so it can be used by family for sharing photos privately, however I just discovered the API endpoint /wp-json/wp/v2/media/ which returns a full list of all uploaded files! (Which seems like a major security hole to me…)

    Anyway, I’ve installed your plugin, but it doesn’t appear to block the media endpoint at all…

    Any ideas?

Viewing 5 replies - 1 through 5 (of 5 total)
  • Plugin Author Dave McHale

    (@dmchale)

    9 years, 3 months ago

    Hi @valorin

    Are you certain that you are logged OUT of wordpress? The plugin will allow any logged-in user to use all endpoints, but will disallow all UNAUTHENTICATED users from access. I just did a quick test on that specific endpoint of my own site and it seems to be working fine. http://www.binarytemplar.com/wp-json/wp/v2/media/

    Let me know if you’re still having trouble, or if that was the issue. Thanks!

    Dave

    Thread Starter Stephen Rees-Carter

    (@valorin)

    9 years, 3 months ago

    @dmchale,

    Yep, I tried it with both an Incognito window in Chrome, and a separate browser on a separate network. Both allowed me full media list access…

    What extra info do you need from me for debugging?

    Plugin Author Dave McHale

    (@dmchale)

    9 years, 3 months ago

    @valorin Can you try temporarily disabling WP Force Login and seeing what happens then? That plugin is honestly my first suspect. One drawback of this plugin currently is that “logged in” is not currently being split up by user role. So whether you’re a Subscriber, Contributor, Editor, Administrator, or any other custom role, “logged in” is “logged in” and therefore will allow any authenticated user to view the REST API endpoints.

    That’s just my main guess still. If you’d like to send me more info to look at your particular setup, can you send me

    • URL to your site
    • Any credentials needed to see it if necessary
    • What WP Version you’re on
    • What theme you’re running
    • What plugins are on the site

    If you want to send me those details privately, you can shoot them to [email protected] and I can take a look and see what I can see. I’ll then reply back here on the thread with my findings once I’ve had a chance to take a more in-depth look. Thanks!

    Thread Starter Stephen Rees-Carter

    (@valorin)

    9 years, 3 months ago

    @dmchale this is most bizzare, but the plugin has started working! I am sure I tested with it enabled before, and it let things through… I wonder if there is a cache or something hiding in WordPress that took time to expire.

    Weird…

    Thanks for the super fast support though! 😀

    Plugin Author Dave McHale

    (@dmchale)

    9 years, 3 months ago

    @valorin If you have any type of caching enabled at the host or through your DNS provider, that definitely may have been the issue which would also explain why you’d have even seen it in incognito mode. I’m glad it’s working for you now though!

    You got lucky and caught me on a quiet afternoon re: the quick responses haha. But you’re very welcome for the assist 🙂 Take care

Viewing 5 replies - 1 through 5 (of 5 total)

The topic ‘Doesn’t block media access’ is closed to new replies.