This stops the notices from filling up your log file but hides a security threat. Anyone can create and delete brands within your database without API keys or being logged into the site. It may be possible to leverage this for stored XSS attacks or other injection attacks.
I’m opening a PR with the developer since no one has yet.
For the READABLE endpoint you can use the suggested permission_callback but for the CREATABLE and DELETABLE I would use something like the following instead:
'permission_callback' => function() {
return current_user_can( 'manage_options' );
},
Sean released a new version of the Tubular javascript library. I’ll have to check and see if that has been addressed. If it hasn’t I’ll have to figure out why it’s not working with HD.
Checkout my plugin that lets you easily add Tubular to your site.
http://ww.wp.xz.cn/extend/plugins/tubular/
