Disable REST API - Version 1.3

Version Description

  • Tested for WP v4.7
  • Adding new functionality to raise authentication errors in 4.7+ for non-logged-in users
Download this release

Release Info

Developer dmchale
Plugin Icon 128x128 Disable REST API
Version 1.3
Comparing to
See all releases

Code changes from version 1.2 to 1.3

Files changed (2) hide show
  1. disable-json-api.php +56 -13
  2. readme.txt +23 -17
disable-json-api.php CHANGED
@@ -1,23 +1,66 @@
1
  <?php
2
  /**
3
- * Plugin Name: Disable JSON API
4
  * Plugin URI: http://www.binarytemplar.com/disable-json-api
5
- * Description: Uses the built-in filters of the JSON REST API to disable its functionality
6
- * Version: 1.2
7
  * Author: Dave McHale
8
  * Author URI: http://www.binarytemplar.com
9
  * License: GPL2+
10
  */
11
 
12
- // Filters for WP-API version 1.x
13
- add_filter('json_enabled', '__return_false');
14
- add_filter('json_jsonp_enabled', '__return_false');
15
 
16
- // Filters for WP-API version 2.x
17
- add_filter('rest_enabled', '__return_false');
18
- add_filter('rest_jsonp_enabled', '__return_false');
 
 
19
 
20
- // Remove REST API info from head and headers
21
- remove_action( 'xmlrpc_rsd_apis', 'rest_output_rsd' );
22
- remove_action( 'wp_head', 'rest_output_link_wp_head', 10 );
23
- remove_action( 'template_redirect', 'rest_output_link_header', 11 );
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
  <?php
2
  /**
3
+ * Plugin Name: Disable REST API
4
  * Plugin URI: http://www.binarytemplar.com/disable-json-api
5
+ * Description: Disable the use of the JSON REST API on your website to anonymous users
6
+ * Version: 1.3
7
  * Author: Dave McHale
8
  * Author URI: http://www.binarytemplar.com
9
  * License: GPL2+
10
  */
11
 
12
+ $dra_current_WP_version = get_bloginfo('version');
 
 
13
 
14
+ if ( version_compare( $dra_current_WP_version, '4.7', '>=' ) ) {
15
+ DRA_Force_Auth_Error();
16
+ } else {
17
+ DRA_Disable_Via_Filters();
18
+ }
19
 
20
+ //\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
21
+ //\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
22
+ //\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
23
+
24
+ /**
25
+ * This function is called if the current version of WordPress is 4.7 or above
26
+ * Forcibly raise an authentication error to the REST API if the user is not logged in
27
+ */
28
+ function DRA_Force_Auth_Error() {
29
+ add_filter( 'rest_authentication_errors', 'DRA_only_allow_logged_in_rest_access' );
30
+ }
31
+
32
+ /**
33
+ * This function gets called if the current version of WordPress is less than 4.7
34
+ * We are able to make use of filters to actually disable the functionality entirely
35
+ */
36
+ function DRA_Disable_Via_Filters() {
37
+
38
+ // Filters for WP-API version 1.x
39
+ add_filter( 'json_enabled', '__return_false' );
40
+ add_filter( 'json_jsonp_enabled', '__return_false' );
41
+
42
+ // Filters for WP-API version 2.x
43
+ add_filter( 'rest_enabled', '__return_false' );
44
+ add_filter( 'rest_jsonp_enabled', '__return_false' );
45
+
46
+ // Remove REST API info from head and headers
47
+ remove_action( 'xmlrpc_rsd_apis', 'rest_output_rsd' );
48
+ remove_action( 'wp_head', 'rest_output_link_wp_head', 10 );
49
+ remove_action( 'template_redirect', 'rest_output_link_header', 11 );
50
+
51
+ }
52
+
53
+ /**
54
+ * Returning an authentication error if a user who is not logged in tries to query the REST API
55
+ * @param $access
56
+ * @return WP_Error
57
+ */
58
+ function DRA_only_allow_logged_in_rest_access( $access ) {
59
+
60
+ if( ! is_user_logged_in() ) {
61
+ return new WP_Error( 'rest_cannot_access', __( 'Only authenticated users can access the REST API.', 'disable-json-api' ), array( 'status' => rest_authorization_required_code() ) );
62
+ }
63
+
64
+ return $access;
65
+
66
+ }
readme.txt CHANGED
@@ -1,30 +1,29 @@
1
- === Disable JSON API ===
2
  Contributors: dmchale
3
  Tags: admin, api, json, REST, rest-api, disable
4
  Requires at least: 4.0
5
- Tested up to: 4.5
6
- Stable tag: 1.2
7
  License: GPLv2 or later
8
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
9
 
10
- Uses the built-in filters of the JSON REST API to disable its functionality.
11
 
12
  == Description ==
13
 
14
- ** Now supporting the 1.x API, the 2.x beta API, and the API features found in WP Core since v4.4 **
 
 
15
 
16
- The JSON REST API is currently in development via the [JSON REST API](https://wordpress.org/plugins/json-rest-api/)
17
- plugin by Ryan McCue. The engine for the API exists in WordPress as of v4.4, but additional functionality and working
18
- endpoints are still in development. While this is very exciting news
19
- for many reasons, it is also not functionality that every site admin is going to want enabled on their website.
20
- Similar to other plugins which already disable the XML-RPC protocol, this plugin looks to make your life simple by
21
- allowing you to disable the JSON REST API simply by installing and activating this plugin.
22
 
23
- You can install this plugin now to ensure that your site will not support the JSON REST API as it exists in its
24
- current state.
25
-
26
- This plugin simply uses two filters that are built into the API which turn off support for JSON and JSONP,
27
- respectively. Nothing is done which is not intended by the API author(s).
28
 
29
  == Installation ==
30
 
@@ -43,10 +42,14 @@ should be safe.
43
 
44
  == Screenshots ==
45
 
46
- 1. The JSON returned by a website that is protected by this plugin.
47
 
48
  == Changelog ==
49
 
 
 
 
 
50
  = 1.2 =
51
  * Tested for WP v4.5
52
  * Removal of actions which publish REST info to the head and header
@@ -59,6 +62,9 @@ should be safe.
59
 
60
  == Upgrade Notice ==
61
 
 
 
 
62
  = 1.1 =
63
  * Now with support for the 2.0 beta API filters
64
 
1
+ === Disable REST API ===
2
  Contributors: dmchale
3
  Tags: admin, api, json, REST, rest-api, disable
4
  Requires at least: 4.0
5
+ Tested up to: 4.7
6
+ Stable tag: 1.3
7
  License: GPLv2 or later
8
  License URI: http://www.gnu.org/licenses/gpl-2.0.html
9
 
10
+ Disable the use of the JSON REST API on your website to anonymous users.
11
 
12
  == Description ==
13
 
14
+ ** As of WordPress 4.7, the filter provided for disabling the REST API has been removed. However, this plugin will now
15
+ forcibly return an authentication error to any API requests from sources who are not logged into your website, which
16
+ will effectively still prevent unauthorized requests from using the REST API to get information from your website **
17
 
18
+ The REST API is a project in development via the [JSON REST API](https://wordpress.org/plugins/rest-api/)
19
+ plugin by Ryan McCue, Rachel Baker, Daniel Bachhuber and Joe Hoyle. The engine for the API has existed in WordPress
20
+ since v4.4, but additional functionality and endpoints are a continual project. While this is very exciting news
21
+ for many reasons, it is also not functionality that every site admin is going to want enabled on their website if not
22
+ necessary.
 
23
 
24
+ For WordPress versions 4.4, 4.5 and 4.6, this plugin makes use of the `rest_enabled` filter provided by the API to
25
+ disable the API functionality. For WordPress 4.7+, the plugin will return an authentication error (effectively
26
+ disabling all endpoints) for any user not logged into the website.
 
 
27
 
28
  == Installation ==
29
 
42
 
43
  == Screenshots ==
44
 
45
+ 1. The JSON returned by a website that is protected by this plugin. (WordPress versions 4.4, 4.5, 4.6)
46
 
47
  == Changelog ==
48
 
49
+ = 1.3 =
50
+ * Tested for WP v4.7
51
+ * Adding new functionality to raise authentication errors in 4.7+ for non-logged-in users
52
+
53
  = 1.2 =
54
  * Tested for WP v4.5
55
  * Removal of actions which publish REST info to the head and header
62
 
63
  == Upgrade Notice ==
64
 
65
+ = 1.3 =
66
+ *
67
+
68
  = 1.1 =
69
  * Now with support for the 2.0 beta API filters
70