|
cambridgejbs
|
January 8, 2019 at 3:57 am
We’ve become concerned about various issues relating to REST API (https://www.pixemweb.com/blog/should-you-disable-the-wordpress-rest-api/). Looking at the list of plugins that use it http://v2.wp-api.org/guide/plugins/, Event Espresso Decaf is mentioned. We’re not using Decaf, but we are using Event Espresso version 4.9.70.p and Event Espresso – Calendar (EE 4.3+) version 3.2.12.p.
If we disable REST API, will this stop these plugins from working?
thanks, Ruth
|
|
Tony
|
January 8, 2019 at 6:49 am
Hi Ruth,
No, it will not stop those plugins working.
Event Espresso core outputs your event data using the REST API, so anything using that functionality will no longer function, the plugin itself will continue to work as the REST API can be used as a way to get information from EE.
The Calendar plugin does not use the REST API to pull the information in.
If you are using the EE Ticketing Apps, they do use the REST API and will no longer function and also the Attendee Mover Add-on also uses the REST API, so that will no longer function.
https://eventespresso.com/wiki/ee4-event-apps/
https://eventespresso.com/product/eea-attendee-mover/
|
|
cambridgejbs
|
January 8, 2019 at 6:59 am
Thanks for the quick response Tony. When you say “outputs the event data”, are you referring to how the calendar is displayed on the front end, e.g. https://insight.jbs.cam.ac.uk/events/, or e.g. RSS feeds that take the info and present it?
|
|
Tony
|
January 8, 2019 at 7:11 am
Neither.
The calendar queries the tables directly and doesn’t use the REST API, a little similar to RSS feeds but truth be told, not all that much.
For example: https://insight.jbs.cam.ac.uk/wp-json/ee/v4.8.36/events/
There’s a list of the events using the REST API from your site, another plugin could use that to display your events on another site by making a request to that URL and parsing the data.
Generally, if the plugin is on the same site you would just pull the information directly from the database, the attendee mover being an exception as we chose to utilize the REST API with that.
|
|
Josh
|
January 8, 2019 at 7:15 am
Neither of those use the REST API, for now.
In the future Event Espresso will begin to use the REST API for the event editor, so while you could disable the REST API for now, eventually you’ll need to re-enable it to be able add/edit events.
For what it’s worth, the article you linked to is out of date because the Username Harvesting issue was fixed in WordPress 4.7.2, so unless you’re running WordPress 4.7 or 4.7.1, this is a non-issue. It can also be noted that pixemweb.com has the REST API activated.
|
|
cambridgejbs
|
January 8, 2019 at 7:50 am
This reply has been marked as private.
|
|
Josh
|
January 8, 2019 at 8:06 am
The https://en-gb.wordpress.org/plugins/smntcs-disable-rest-api-user-endpoints/ plugin is fine to use on a site with EE4, and will not cause problems.
|
|
cambridgejbs
|
January 8, 2019 at 8:12 am
Thanks Josh!
|
