Changeset 3760851 for ai-engine/trunk/classes/api.php

Timestamp:

10/23/2026 03:27:20 AM (13 days ago)

Author:

TigrouMeow

Message:

Version 3.8.7.

File:

• ai-engine/trunk/classes/api.php (modified) (3 diffs)

ai-engine/trunk/classes/api.php

@@ -23 +23 @@
    */
   private function sanitize_rest_options( $options ) {
-    return Meow_MWAI_Core::sanitize_rest_params( $options );
+    $options = Meow_MWAI_Core::sanitize_rest_params( $options );
+    // Any logged-in user reaches the Public API by default, and an MCP server attached here
+    // runs with its stored token (the site's own MCP acts as an admin), so tools stay with
+    // administrators. The bearer token signs in as one, so it keeps them. Keys compared in
+    // canonical form, since inject_params() accepts snake_case too (CVE-2026-96561).
+    if ( !current_user_can( 'manage_options' ) ) {
+      foreach ( array_keys( $options ) as $key ) {
+        if ( in_array( strtolower( Meow_MWAI_Query_Base::canonical_key( (string) $key ) ), [ 'mcpservers', 'tools', 'functions' ], true ) ) {
+          unset( $options[$key] );
+        }
+      }
+    }
+    return $options;
   }
 
@@ -460 +472 @@
         $message = isset( $params['prompt'] ) ? $params['prompt'] : '';
       }
-      $options = isset( $params['options'] ) ? $params['options'] : [];
+      $options = $this->sanitize_rest_options( isset( $params['options'] ) ? $params['options'] : [] );
       $resolution = isset( $params['resolution'] ) ? $params['resolution'] : '';
       $scope = isset( $params['scope'] ) ? $params['scope'] : 'public-api';
@@ -495 +507 @@
       }
       $mediaId = isset( $params['mediaId'] ) ? intval( $params['mediaId'] ) : 0;
-      $options = isset( $params['options'] ) ? $params['options'] : [];
+      $options = $this->sanitize_rest_options( isset( $params['options'] ) ? $params['options'] : [] );
       $resolution = isset( $params['resolution'] ) ? $params['resolution'] : '';
       $scope = isset( $params['scope'] ) ? $params['scope'] : 'public-api';