fix: check per-chart edit_post capability in chart_data REST field

[lucadobrescu]

Any logged-in user with the edit_posts capability (Contributor and above) could read the full backend configuration of any chart on the site — data source query, series/settings, and JSON endpoint URLs with their authentication headers — via GET /wp-json/wp/v2/visualizer/{chart_id}, because the chart_data REST field callback only checked the generic edit_posts capability. Reported in Codeinwp/visualizer-pro#605.

What changed

• chart_data REST field guard — get_visualizer_data() now checks Visualizer_Module::can_edit_chart() against the requested chart instead of the generic current_user_can( 'edit_posts' ). Access is allowed for the chart's author and for users with edit_others_posts (Editor and above). The existing can_edit_chart() helper is used instead of a bare edit_post check because charts are force-published on save and Contributors lack edit_published_posts — a bare check would lock Contributor authors out of their own charts.

• Regression test — tests/test-chart-data-permissions.php asserts a Contributor gets false for another user's published chart, a Contributor author still receives their own chart's data, and an Editor can read any chart.

chart_data request flow

flowchart LR
    A[GET /wp/v2/visualizer/id] --> B[chart_data field callback]
    B --> C{Changed:<br/>can_edit_chart —<br/>author or Editor+?}:::changed
    C -- Yes --> D[Return chart config]
    C -- No --> E[Return false]

    classDef changed fill:#9a6700,color:#fff,stroke:#5c3d00,stroke-width:3px,stroke-dasharray:6 3

Loading

QA

1. As an Administrator, create and publish a chart, and note its post ID.

2. As a Contributor, request the chart over REST (e.g. from the browser console while logged in):

   wp.apiFetch( { path: '/wp/v2/visualizer/<chart_id>' } ).then( console.log );

   Expect: chart_data is false — no source query, settings, or endpoint headers in the response.

3. As the chart's author (or an Editor/Administrator), repeat the same request.
   Expect: chart_data contains the chart configuration and the chart still loads normally in the Gutenberg block editor.

4. As a Contributor, create a chart of your own, then repeat the request for that chart's ID.
   Expect: chart_data contains the chart configuration — Contributor authors keep access to their own charts.

🤖 Generated with Claude Code

[pirate-bot]

Plugin build for 6b05e98 is ready 🛎️!

• Download build

[Copilot]

Pull request overview

Secures the chart_data REST field with per-chart authorization.

Changes:

• Replaces the generic capability check with object-specific authorization.
• Adds regression tests for chart configuration access.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
classes/Visualizer/Gutenberg/Block.php	Restricts REST chart data access.
tests/test-chart-data-permissions.php	Tests owner and non-owner access.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[pirate-bot]

🎉 This PR is included in version 4.0.7 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀