bcc-login: close visibility leaks (REST, oEmbed, feeds, endpoints, SearchWP) and restore Phrase access

[cs1m0n]

Summary

Restores Phrase's access to restricted posts, which stopped in 1.2.8, and closes several ways restricted posts could be read without logging in: the REST API, oEmbed, Yoast SEO's head route, feeds, bcc-login's endpoints and SearchWP. The changes are in bcc-login's visibility, feed and endpoints classes; no settings or database changes.

Changes

Query filters

• The the_posts backstop from 1.2.8 only re-checks queries the visibility filter set up, so the queries it exempts (Phrase, editors, feeds read with the key) stay exempt.
• bcc-login's internal query vars are ignored when they come in with a query's own arguments.
• Queries that another pre_get_posts callback switches to a supported post type are checked again.

SearchWP

• The rules reach SearchWP as a plain post ID condition instead of a meta query, which skewed its ranking and slowed searches down. This covers its native search (also on CPT archives), live search, REST API and shortcodes.

REST API

• Single posts from the posts controllers (posts, pages, media, CPTs) follow the rules of the post's own page, and are otherwise refused with core's rest_forbidden (401/403). Editors are exempt, so the block editor is unaffected.
• On sites whose default visibility isn't public, REST lists and /wp/v2/search leave out post types without visibility support for visitors below the default.
• /oembed/1.0/embed follows the same rules. Embeds of the site's own posts in content are decided per visitor when output, because the cached embed is shared by everyone.
• Yoast SEO's /yoast/v1/get_head no longer returns the head (title, description) of a post the visitor may not view.
• The old rest_pre_echo_response filter is removed. Its single-post check never matched these routes, and its search post-filter is replaced by filtering in the query (it also turned error responses into PHP fatals).

Feeds and endpoints

• ?post_types= is sanitised and limited to viewable post types (reusable blocks and contact forms excluded). translatedFrom only points to a published original with the same audience.
• bcc-login's endpoints are served at template_redirect, so they can't be combined with a feed. Only the known endpoints skip the login check, and HEAD requests don't run them.

Sites whose default visibility isn't public

• Archives, search and core feeds are served when they were filtered for the visitor and hold posts they may see. Single views, unfiltered listings, comment feeds and other handlers fall back to the site default, as before.

Worth knowing

• Over REST, a request counts as logged in only with the REST nonce, as REST lists already did. The site's own scripts send it.
• Members and editors now get all the posts they may see in /wp/v2/search; the removed post-filter dropped some.
• On sites whose default isn't public, embedded featured images without their own visibility come back as errors for anonymous visitors, as in the media list.

Testing

On local copies of two sites, comparing the released plugin with this branch. One is public by default with site groups (WPML, SearchWP, Yoast); the other is logged-in by default (WPML, Flatsome, Contextual Related Posts, Yoast).

• Anonymous HTTP requests for pages, archives, feeds, endpoints, search and REST routes.
• REST as admin, editor, subscriber, and members with and without matching groups.
• SearchWP surfaces, oEmbed (REST and in-content embeds) and Yoast heads.

Not covered

• Comments over REST on sites without Disable Comments.
• Direct wp_oembed_get() callers, such as ACF oEmbed fields.
• Yoast's XML sitemaps list restricted URLs (no content).

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The feed key still bypasses visibility checks on non-feed restricted URLs.

1 open finding

• Feed key bypasses visibility checks on restricted singular URLs · New

What changed in this PR

Hardens BCC Login content visibility across REST, feeds, endpoints, oEmbed, Yoast, and SearchWP while restoring Phrase access.

Changes:

• Adds visibility enforcement across REST and search integrations.
• Secures feed post types, translations, and endpoint dispatch.
• Refines query filtering and exemptions.

File	Description
class-bcc-login-visibility.php	Expands visibility enforcement and query handling.
class-bcc-login-feed.php	Restricts feed types and translation metadata.
class-bcc-login-endpoints.php	Serves allowlisted endpoints before content rendering.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.