(Hardening) Add a cap check before previewing classification of a post.

[peterwilsoncc]

Description of the Change

This adds a read_post capability check to the Watson NLU classification preview ajax endpoint.

It's a very, very minor hardening issue as users can only access the nonce if they have the manage_options capability required to access the classifai settings page.

It protects against the case in which a developer has used the map_meta_cap filter to modify the permissions of users able to read posts. Without that use case it does nothing.

How to test the Change

1. Create and publish a post with dummy content
2. Enable Watson NLU Classification feature
3. Save the settings
4. Open your browser tools network tab. Your browser will need to have a feature where you can right click on a request and "copy as curl" (Firefox has this).
5. In the preview post option search for the post created by title
6. The preview should show as expected.
7. Copy the admin-ajax request used for the preview as curl
8. Run the curl code in your terminal
9. Ensure the preview data is shown in the terminal
10. Add this code as an mu-plugin to prevent anyone from reading any posts

add_filter( 'map_meta_cap', function( $caps, $cap, $user_id, $args ) {
	if ( 'read_post' === $cap ) {
		$caps[] = 'do_not_allow';
	}
	return $caps;
}, 10, 4 );

11. Re-run the curl command
12. Ensure the response contains the error "You do not have permission to preview this post"
13. Delete the mu-plugin code added above to avoid confusion later

Changelog Entry

Security - Hardening: add read post check for Watson NLU classification previewer

Credits

Props @peterwilsoncc

Checklist:

• I agree to follow this project's Code of Conduct.
• I have updated the documentation accordingly.
• I have added Critical Flows, Test Cases, and/or End-to-End Tests to cover my change.
• All new and existing tests pass.

[github-actions]

✅ WordPress Plugin Check Report

✅ Status: Passed

📊 Report

All checks passed! No errors or warnings found.

---

🤖 Generated by WordPress Plugin Check Action • Learn more about Plugin Check