search

uhm-coe / authorizer

Authorizer is a WordPress plugin that uses Google, CAS, LDAP, or an OAuth2 provider for logins, and can prevent public access to a WordPress site. It also blocks repeated failed login attempts.
GNU General Public License v3.0
64 stars 36 forks source link

Non-existent pages being blocked #160

Open itzteajay-glitch opened 1 month ago

itzteajay-glitch commented 1 month ago

Hi folks, I've been setting up authorizer on my site and found that page privacy section is blocking pages I cannot locate like the API. This would be totally fine if I was able to override it like the other pages but these particular pages do not show up.

https://hoth.social/wp-json/tribe/events/v1

I've already made the "Nonexistent (404) Pages item public to allow me to see some endpoints but the one above just doesn't seem to be covered by anything in there.

Screenshot from 2024-08-09 15-34-04

itzteajay-glitch commented 1 month ago

Also to note the issue is an events endpoint is being blocked and when click the bubble "Everyone can see the site" the endpoint is accessible to the public again. So I did my due diligence in narrowing it down to Authorizer.

figureone commented 1 month ago

A couple options here. Previous relevant threads: https://wordpress.org/support/topic/authorizer-and-event-calendar-view-change-issue/ https://wordpress.org/support/topic/authorizer-blocking-events-plug-in/

AFAIK there is still an issue with Events Calendar where they don't send authentication headers with their REST requests, so all requests are seen as anonymous (and thus blocked by Authorizer if configured to restrict access to logged in users).

In your case, if you want to restrict access to the site to logged in users, but have the Events Calendar content public, there should be two options:

  1. Hook into tribe_events_views_v2_rest_endpoint_available to disable the REST API and fall back to AJAX (which Authorizer won't restrict): https://wordpress.org/support/topic/authorizer-blocking-events-plug-in/#post-17850246
  2. Hook into authorizer_has_access to inspect WordPress query variables to detect when the specific REST API request is happening, and allow access: https://github.com/uhm-coe/authorizer/blob/master/src/authorizer/class-authorization.php#L518-L536