Withhold password-protected article content from the REST API

The /wzkb/v1/knowledgebase, /wzkb/v1/knowledgebase/{id} and /wzkb/v1/search
endpoints returned the content and excerpt of password-protected articles
without the password. Return an empty excerpt and content when
post_password_required() is true, add a 'protected' flag like core, and skip
caching responses that include password-protected posts so an unlocked
response is never served to another requester.

Author: ajaydsouza

includes/rest/class-rest-controller.php

@@ -520,14 +520,16 @@ public function get_knowledgebase_posts( WP_REST_Request $request ) {
 		$response->header( 'X-WP-Total', (string) (int) $query->found_posts );
 		$response->header( 'X-WP-TotalPages', (string) (int) $query->max_num_pages );
 
-		$this->cache_set(
-			$cache_key,
-			array(
-				'body'  => $posts,
-				'total' => (int) $query->found_posts,
-				'pages' => (int) $query->max_num_pages,
-			)
-		);
+		if ( ! $this->has_password_protected_post( $query->posts ) ) {
+			$this->cache_set(
+				$cache_key,
+				array(
+					'body'  => $posts,
+					'total' => (int) $query->found_posts,
+					'pages' => (int) $query->max_num_pages,
+				)
+			);
+		}
 
 		return $response;
 	}
@@ -558,6 +560,11 @@ public function get_single_knowledgebase_post( WP_REST_Request $request ) {
 			);
 		}
 
+		// Password-protected responses depend on the requester's password cookie, so never cache them.
+		if ( '' !== $post->post_password ) {
+			return rest_ensure_response( $this->prepare_post_for_response( $post, true ) );
+		}
+
 		$cache_key = $this->get_cache_key(
 			'kb_single',
 			array(
@@ -742,7 +749,9 @@ public function get_search_results( WP_REST_Request $request ) {
 			$results[] = $this->prepare_post_for_response( $post );
 		}
 
-		$this->cache_set( $cache_key, $results );
+		if ( ! $this->has_password_protected_post( $wp_query->posts ) ) {
+			$this->cache_set( $cache_key, $results );
+		}
 
 		return rest_ensure_response( $results );
 	}
@@ -1013,6 +1022,9 @@ private function get_post_list_args() {
 	/**
 	 * Prepare KB post data.
 	 *
+	 * Password-protected posts return an empty excerpt and content unless the
+	 * requester has entered the post password, matching core's REST controller.
+	 *
 	 * @param \WP_Post $post             Post object.
 	 * @param bool     $include_content  Include full content flag.
 	 * @return array
@@ -1023,25 +1035,50 @@ private function prepare_post_for_response( $post, $include_content = false ) {
 			return array();
 		}
 
+		$is_protected = '' !== $post->post_password;
+		$is_locked    = $is_protected && post_password_required( $post );
+
 		$data = array(
 			'id'        => (int) $post->ID,
 			'title'     => get_the_title( $post ),
 			'slug'      => $post->post_name,
-			'excerpt'   => wp_trim_words( wp_strip_all_tags( $post->post_content ), 55 ),
+			'excerpt'   => $is_locked ? '' : wp_trim_words( wp_strip_all_tags( $post->post_content ), 55 ),
 			'permalink' => get_permalink( $post ),
 			'products'  => $this->format_terms( get_the_terms( $post, 'wzkb_product' ) ),
 			'sections'  => $this->format_terms( get_the_terms( $post, 'wzkb_category' ) ),
 			'date'      => mysql2date( DATE_RFC3339, $post->post_date_gmt, false ),
 			'modified'  => mysql2date( DATE_RFC3339, $post->post_modified_gmt, false ),
+			'protected' => $is_protected,
 		);
 
 		if ( $include_content ) {
-			$data['content'] = apply_filters( 'the_content', $post->post_content );
+			$data['content'] = $is_locked ? '' : apply_filters( 'the_content', $post->post_content );
 		}
 
 		return $data;
 	}
 
+	/**
+	 * Check whether any post in a list is password protected.
+	 *
+	 * Responses containing such posts vary with the requester's password cookie
+	 * and must not be cached.
+	 *
+	 * @since 3.2.1
+	 *
+	 * @param array $posts Post objects.
+	 * @return bool
+	 */
+	private function has_password_protected_post( array $posts ): bool {
+		foreach ( $posts as $post ) {
+			if ( $post instanceof \WP_Post && '' !== $post->post_password ) {
+				return true;
+			}
+		}
+
+		return false;
+	}
+
 	/**
 	 * Format terms list.
 	 *

readme.txt

@@ -195,6 +195,15 @@ Release date: TBD
 
 * [Pro] Reused cached Ask the Docs answers for reworded questions until their source articles change.
 
+**Security**
+
+* The `/wzkb/v1/knowledgebase` and `/wzkb/v1/search` REST endpoints returned the content and excerpt of password-protected articles without the password.
+
+**Fixed**
+
+* [Pro] GitHub imports and reimports stripped image captions from articles.
+* [Pro] Ask the Docs could cite another company's article.
+
 = 3.2.0 =
 
 Release date: 7 October 2026
@@ -219,6 +228,7 @@ Release post: https://webberzone.com/announcements/knowledge-base-v3-2/
 
 * The Knowledge Base search results page size overrode the REST search endpoint's `limit` parameter.
 * Knowledge Base search forms showed duplicate suggestions when Better Search live search was also active.
+* [Pro] Help widget searches returned no articles with Better Search active, and the search box lost focus while typing.
 * Text in the Knowledge Base Alerts block could not be selected reliably in the editor.
 * Knowledge Base Alerts blocks without an alignment saved an invalid `text-align: none` inline style.
 * Settings repeater button labels used the wrong translation domain.
@@ -230,4 +240,4 @@ For the changelog of earlier versions, please refer to the [releases page on Git
 == Upgrade Notice ==
 
 = 3.2.1 =
-Faster Pro Ask the Docs answers with a choice of model and a fallback provider, and better answer caching. Pro GitHub imports preserve image captions.
+Security release. Stops the REST API exposing password-protected articles. Also adds faster Pro Ask the Docs answers with a choice of model and a fallback provider, and better answer caching. Pro GitHub imports preserve image captions.