Pages: require authentication and a capability to render generated standalone pages

package.json

@@ -35,7 +35,10 @@
 		"packageNamespace": "wordpress",
 		"handlePrefix": "wp",
 		"pages": [
-			"font-library",
+			{
+				"id": "font-library",
+				"capability": "edit_theme_options"
+			},
 			"options-connectors",
 			{
 				"id": "dashboard",
@@ -57,17 +60,20 @@
 				"init": [
 					"@wordpress/edit-site-init"
 				],
+				"capability": "upload_files",
 				"experimental": true
 			},
 			{
 				"id": "site-editor-v2",
 				"init": [
 					"@wordpress/edit-site-init"
 				],
+				"capability": "edit_theme_options",
 				"experimental": true
 			},
 			{
 				"id": "theme-preview",
+				"capability": "switch_themes",
 				"experimental": true
 			}
 		]

packages/wp-build/CHANGELOG.md

@@ -13,6 +13,7 @@
 
 ### Bug Fixes
 
+-   Pages: require authentication and a configurable capability (new `capability` page setting, default `manage_options`) before rendering generated standalone pages, so `admin_init` entry points such as `admin-post.php` no longer serve them to logged-out visitors ([#82254](https://github.com/WordPress/gutenberg/pull/82254)).
 -   Widen the optional `@wordpress/theme` peer dependency range to allow 2.x releases. ([#82139](https://github.com/WordPress/gutenberg/pull/82139))
 -   Pages: preserve the Core Boot layout compatibility class in generated wp-admin page templates so short pages fill the viewport when using Core's bundled Boot module ([#82112](https://github.com/WordPress/gutenberg/pull/82112)).
 

packages/wp-build/README.md

@@ -294,9 +294,10 @@ Pages can be defined as simple strings or as objects with initialization modules
 **Page Configuration:**
 
 -   **String format**: `"my-admin-page"` - Simple page with no init modules
--   **Object format**: `{ "id": "page-slug", "init": ["@scope/package"], "experimental": true }` - Page with optional init modules
+-   **Object format**: `{ "id": "page-slug", "init": ["@scope/package"], "capability": "edit_theme_options", "experimental": true }` - Page with optional init modules
     -   **`id`** (required): The page slug used in WordPress admin URLs
     -   **`init`** (optional): Array of script module IDs to execute during page initialization
+    -   **`capability`** (optional, default `manage_options`): Capability a user needs to view the page. Full-page mode enforces this itself, since it renders outside the menu page callback flow; match it to the capability used when registering the page's menu entry.
     -   **`experimental`** (optional, default `false`): When `true`, the page is excluded from WordPress Core builds (`IS_WORDPRESS_CORE=true`), along with any route that belongs only to experimental pages.
 
 **Generated Files:**

packages/wp-build/lib/build.mjs

@@ -110,6 +110,11 @@ const HANDLE_PREFIX = WP_PLUGIN_CONFIG.handlePrefix || PACKAGE_NAMESPACE;
 const EXTERNAL_NAMESPACES = WP_PLUGIN_CONFIG.externalNamespaces || {};
 const PAGES = WP_PLUGIN_CONFIG.pages || [];
 
+// Capability required to view a generated page when the page config does not
+// declare one. Pages rendering outside the menu page callback flow must
+// enforce this themselves.
+const DEFAULT_PAGE_CAPABILITY = 'manage_options';
+
 /**
  * Interprets a configuration value as a boolean, where `"true"` and `"1"`
  * are considered true while all other values are false.
@@ -1296,6 +1301,7 @@ async function generatePagesPhp( pageData, replacements ) {
 			'{{PREFIX}}': prefixUnderscore,
 			'{{INIT_MODULES_PHP_ARRAY}}': initModulesPhp,
 			'{{INIT_MODULES_JSON}}': JSON.stringify( page.initModules ),
+			'{{CAPABILITY}}': page.capability || DEFAULT_PAGE_CAPABILITY,
 		};
 
 		// Generate both page.php and page-wp-admin.php
@@ -2352,13 +2358,19 @@ async function buildAll( baseUrlExpression ) {
 	// Normalize PAGES config to support both string and object formats
 	const normalizedPages = PAGES.map( ( page ) => {
 		if ( typeof page === 'string' ) {
-			return { id: page, init: [], title: undefined };
+			return {
+				id: page,
+				init: [],
+				title: undefined,
+				capability: DEFAULT_PAGE_CAPABILITY,
+			};
 		}
 		return {
 			id: page.id,
 			init: page.init || [],
 			title: page.title || undefined,
 			experimental: page.experimental || false,
+			capability: page.capability || DEFAULT_PAGE_CAPABILITY,
 		};
 	} );
 
@@ -2426,6 +2438,7 @@ async function buildAll( baseUrlExpression ) {
 			routes: pageRoutes,
 			initModules: page.init,
 			title: page.title,
+			capability: page.capability,
 		};
 	} );
 

packages/wp-build/lib/test/php-generator.js

@@ -15,3 +15,26 @@ describe( 'page-wp-admin.php template', () => {
 		);
 	} );
 } );
+
+describe( 'page.php template', () => {
+	it( 'guards the admin_init interceptor with authentication and the configured capability', async () => {
+		const generatedPage = await generateTemplate( 'page.php.template', {
+			'{{PAGE_SLUG}}': 'example',
+			'{{PAGE_SLUG_UNDERSCORE}}': 'example',
+			'{{PREFIX}}': 'wp',
+			'{{CAPABILITY}}': 'edit_theme_options',
+		} );
+
+		const interceptor = generatedPage.slice(
+			generatedPage.indexOf( 'function wp_example_intercept_render()' )
+		);
+
+		expect( interceptor ).toContain( 'is_user_logged_in()' );
+		expect( interceptor ).toContain(
+			"current_user_can( 'edit_theme_options' )"
+		);
+		expect( interceptor.indexOf( 'current_user_can' ) ).toBeLessThan(
+			interceptor.indexOf( 'wp_example_render_page()' )
+		);
+	} );
+} );

packages/wp-build/templates/page.php.template

@@ -332,6 +332,22 @@ function {{PREFIX}}_{{PAGE_SLUG_UNDERSCORE}}_render_page() {
 function {{PREFIX}}_{{PAGE_SLUG_UNDERSCORE}}_intercept_render() {
 	// phpcs:ignore WordPress.Security.NonceVerification.Recommended
 	if ( isset( $_GET['page'] ) && '{{PAGE_SLUG}}' === $_GET['page'] ) {
+		// The page renders outside the menu page callback flow, so it must
+		// enforce authentication and capability checks itself. Without this,
+		// any admin entry point firing `admin_init` (such as admin-post.php,
+		// which serves logged-out requests) would render the page for
+		// unauthenticated visitors.
+		if ( ! is_user_logged_in() ) {
+			auth_redirect();
+		}
+
+		if ( ! current_user_can( '{{CAPABILITY}}' ) ) {
+			wp_die(
+				__( 'Sorry, you are not allowed to access this page.' ),
+				403
+			);
+		}
+
 		{{PREFIX}}_{{PAGE_SLUG_UNDERSCORE}}_render_page();
 		exit;
 	}