Skip to content

Restrict protected meta-key writes and option reads to administrators #232

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
leoloso merged 12 commits into from
Sep 2, 2026
Merged

Restrict protected meta-key writes and option reads to administrators #232

Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
7fa0492
Fix privilege escalation through the user meta mutations
leoloso Sep 2, 2026
1ecafb5
Exclude admins from meta-key restriction, extend it to other entities…
leoloso Sep 2, 2026
fa806af
Update translations for the changed settings descriptions
leoloso Sep 2, 2026
8d25b95
Point the changelog entries at the actual PR number
leoloso Sep 2, 2026
b8458d7
Restrict reading protected meta keys to administrators
leoloso Sep 2, 2026
df65e43
Update GatoGraphQL: scope meta read-protection to user meta only
leoloso Sep 2, 2026
0493f08
Update GatoGraphQL: enforce meta read-protection at the resolution layer
leoloso Sep 2, 2026
7433edf
Update GatoGraphQL: re-extract POT to refresh source line references
leoloso Sep 2, 2026
66598f6
Update GatoGraphQL: run option allow/denylist tests as a non-administ…
leoloso Sep 2, 2026
428dcee
Update GatoGraphQL: option-test user-switching + admin schema read test
leoloso Sep 2, 2026
95e8ecb
Update GatoGraphQL: show denied option read in anon schema test
leoloso Sep 2, 2026
75ad3d3
Update GatoGraphQL: drop field alias in anon schema test
leoloso Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion submodules/GatoGraphQL
Open in desktop
Submodule GatoGraphQL updated 96 files
+10 −0 layers/CMSSchema/packages/commentmeta-wp/src/TypeAPIs/CommentMetaTypeAPI.php
+14 −3 layers/CMSSchema/packages/commentmeta/src/FieldResolvers/ObjectType/CommentObjectTypeFieldResolver.php
+10 −0 layers/CMSSchema/packages/custompostmeta-wp/src/TypeAPIs/CustomPostMetaTypeAPI.php
+14 −3 layers/CMSSchema/packages/custompostmeta/src/FieldResolvers/ObjectType/CustomPostObjectTypeFieldResolver.php
+1 −0 layers/CMSSchema/packages/meta-mutations/src/MutationResolvers/MutateEntityMetaMutationResolverTrait.php
+18 −2 layers/CMSSchema/packages/meta/src/FieldResolvers/ObjectType/AbstractWithMetaObjectTypeFieldResolver.php
+10 −0 layers/CMSSchema/packages/meta/src/TypeAPIs/AbstractMetaTypeAPI.php
+2 −0 layers/CMSSchema/packages/meta/src/TypeAPIs/MetaTypeAPIInterface.php
+7 −0 layers/CMSSchema/packages/settings-wp/src/TypeAPIs/SettingsTypeAPI.php
+8 −0 layers/CMSSchema/packages/settings/src/TypeAPIs/AbstractSettingsTypeAPI.php
+10 −0 layers/CMSSchema/packages/taxonomymeta-wp/src/TypeAPIs/TaxonomyMetaTypeAPI.php
+14 −3 layers/CMSSchema/packages/taxonomymeta/src/FieldResolvers/ObjectType/TaxonomyObjectTypeFieldResolver.php
+33 −0 layers/CMSSchema/packages/usermeta-mutations-wp/src/TypeAPIs/UserMetaTypeMutationAPI.php
+26 −0 layers/CMSSchema/packages/usermeta-wp/src/TypeAPIs/UserMetaTypeAPI.php
+14 −3 layers/CMSSchema/packages/usermeta/src/FieldResolvers/ObjectType/UserObjectTypeFieldResolver.php
+1 −1 ...atographql/tests/Integration/AbstractOptionsModifyPluginSettingsFixtureEndpointWebserverRequestTestCase.php
+12 −1 ...es/gatographql/tests/Integration/AllowedSettingsModifyPluginSettingsFixtureEndpointWebserverRequestTest.php
+40 −0 ...nit-packages/gatographql/tests/Integration/AuthenticatedSchemaQueryExecutionFixtureWebserverRequestTest.php
+12 −0 ...atographql/tests/Integration/OptionNamesFilterByModifyPluginSettingsFixtureEndpointWebserverRequestTest.php
+12 −0 ...t-packages/gatographql/tests/Integration/OptionsModifyPluginSettingsFixtureEndpointWebserverRequestTest.php
+13 −2 ...-packages/gatographql/tests/Integration/SettingsModifyPluginSettingsFixtureEndpointWebserverRequestTest.php
+23 −2 ...oGraphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-allowed-settings/allowed-settings.json
+23 −2 ...raphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-allowed-settings/allowed-settings:0.json
+2 −23 ...raphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-allowed-settings/allowed-settings:1.json
+2 −23 ...raphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-allowed-settings/allowed-settings:2.json
+2 −23 ...raphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-allowed-settings/allowed-settings:3.json
+13 −0 ...s/GatoGraphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-authenticated-schema/settings.gql
+184 −0 .../GatoGraphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-authenticated-schema/settings.json
+9 −0 layers/GatoGraphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-authenticated-schema/users.gql
+69 −0 layers/GatoGraphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-authenticated-schema/users.json
+2 −12 layers/GatoGraphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-schema/settings.gql
+25 −180 layers/GatoGraphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-schema/settings.json
+5 −5 layers/GatoGraphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-schema/users.gql
+578 −614 layers/GatoGraphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-schema/users.json
+2 −23 layers/GatoGraphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-settings/options.json
+23 −2 layers/GatoGraphQLForWP/phpunit-packages/gatographql/tests/Integration/fixture-settings/options:0.json
+9 −0 layers/GatoGraphQLForWP/plugins/gatographql/CHANGELOG.md
+5 −1 layers/GatoGraphQLForWP/plugins/gatographql/docs/modules/schema-settings/en.md
+2 −0 layers/GatoGraphQLForWP/plugins/gatographql/docs/modules/schema-user-meta/en.md
+18 −0 layers/GatoGraphQLForWP/plugins/gatographql/docs/release-notes/19.2/en.md
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-de_DE.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-de_DE.mo
+62 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-de_DE.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-el.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-el.mo
+64 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-el.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-es_ES.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-es_ES.mo
+64 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-es_ES.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-fr_FR.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-fr_FR.mo
+64 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-fr_FR.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-id_ID.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-id_ID.mo
+60 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-id_ID.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-it_IT.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-it_IT.mo
+63 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-it_IT.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-ja.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-ja.mo
+60 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-ja.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-ko_KR.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-ko_KR.mo
+58 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-ko_KR.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-nl_NL.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-nl_NL.mo
+62 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-nl_NL.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-pl_PL.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-pl_PL.mo
+64 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-pl_PL.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-pt_BR.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-pt_BR.mo
+62 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-pt_BR.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-ru_RU.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-ru_RU.mo
+65 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-ru_RU.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-sv_SE.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-sv_SE.mo
+61 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-sv_SE.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-th.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-th.mo
+61 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-th.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-tr_TR.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-tr_TR.mo
+63 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-tr_TR.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-vi.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-vi.mo
+65 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-vi.po
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-zh_CN.l10n.php
+ − layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-zh_CN.mo
+58 −26 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql-zh_CN.po
+29 −24 layers/GatoGraphQLForWP/plugins/gatographql/languages/gatographql.pot
+6 −0 layers/GatoGraphQLForWP/plugins/gatographql/readme.txt
+2 −1 layers/GatoGraphQLForWP/plugins/gatographql/src/ModuleResolvers/MetaSchemaTypeModuleResolver.php
+2 −2 ...rs/GatoGraphQLForWP/plugins/gatographql/src/ModuleResolvers/PluginManagementFunctionalityModuleResolver.php
+1 −1 layers/GatoGraphQLForWP/plugins/gatographql/src/ModuleResolvers/SchemaTypeModuleResolver.php