Files
wordpress/wp-includes
gziolo 90d7aada35 AI: Sync Ability_Function_Resolver API enhancement to harden security
Make `WP_AI_Client_Ability_Function_Resolver` non-static and require specifying the allowed abilities list in the constructor. This hardens security by ensuring that only explicitly specified abilities can be executed, preventing potential vulnerabilities such as prompt injection from triggering arbitrary abilities.

The constructor accepts either `WP_Ability` objects or ability name strings. If an ability is not in the allowed list, an error response with code `ability_not_allowed` is returned.

Developed in https://github.com/WordPress/wordpress-develop/pull/11103.
Upstream: https://github.com/WordPress/wp-ai-client/pull/61.

Props felixarntz, gziolo, JasonTheAdams, dkotter, johnbillion.
Fixes #64769.



Built from https://develop.svn.wordpress.org/trunk@61795


git-svn-id: http://core.svn.wordpress.org/trunk@61101 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2026-03-03 14:01:43 +00:00
..
2026-02-26 13:59:22 +00:00
2026-02-26 13:59:22 +00:00
2026-02-26 13:59:22 +00:00
2026-02-18 20:56:33 +00:00
2026-02-20 08:42:48 +00:00
2026-02-18 20:56:33 +00:00