Add check in post meta source

WordPress · Jan 30, 2024 · f3f8f78 · f3f8f78
1 parent 4a0b155
commit f3f8f78
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/lib/compat/wordpress-6.5/block-bindings/sources/post-meta.php b/lib/compat/wordpress-6.5/block-bindings/sources/post-meta.php
@@ -17,6 +17,13 @@ function gutenberg_block_bindings_post_meta_callback( $source_attrs ) {
 		$post_id = get_the_ID();
 	}
 
+	// If a post isn't public, we need to prevent
+	// unauthorized users from accessing the post meta.
+	$post = get_post( $post_id );
+	if ( ( $post && 'publish' !== $post->post_status && ! current_user_can( 'read_post', $post_id ) ) || post_password_required( $post_id ) ) {
+		return null;
+	}
+
 	return get_post_meta( $post_id, $source_attrs['key'], true );
 }