403 error importing Yoast SEO Scores – but I might know what’s happening

Hi There,

Hopefully this is helpful: I was just doing a new install of RankMath on a client site today, and I kept running into a 403 error when trying to import the Yoast SEO Scores (all the other imports worked without issue). The odd thing is that I was testing RankMath on the client’s staging site a few days ago, and the SEO Score import worked great. Then I realized you had a recent update, and so I diffed the two versions, and discovered that there is a new callback that appears to be for sanitizing incoming arguments:


register_rest_route(
$this->namespace,
'/updateSeoScore',
[
'methods' => \WP_REST_Server::EDITABLE,
'callback' => [ $this, 'update_seo_score' ],
'permission_callback' => [ $this, 'can_edit_posts' ],
'args' => $this->get_update_seo_score_args(), <--- new to version 1.0.240
]
);


Doing a little logging via the rest_request_before_callbacks hook, it looks like this callback is messing with the parameter structure of the posted score data. Here’s what the posted data looks like when using version 1.0.239 (i.e. what’s on my client’s staging site):


{"post_scores":{"1535":"70","1585":"58","3557":"11","2909":"66","5777":"77","6892":"66"...}


…and here’s what it looks like using version 1.0.240:


"post_scores":["70","58","11","66","77","66"...]


So you can see that args callback is somehow dropping the key on that posted data, which means the callback permissions is looking at post ids like 0 and 1 instead of 1535 and 1585.

As a temporary fix, I tried commenting out that args callback, get_update_seo_score_args(), and sure enough, that worked. But obviously it would be great to fix whatever is breaking the incoming posted data in get_update_seo_score_args(), so we can get that in a future update.

Thanks for a great plugin overall!

Joe