| @@ -20,8 +20,10 @@ | ||
| 20 | 20 | private function addons_loader() { |
| 21 | 21 | $Autoload = Autoload::get_instance(); |
| 22 | 22 | $addons = apply_filters('ablocks/addons/loader_args', [ |
| 23 | 23 | 'theme-builder' => 'ThemeBuilder', |
| 24 | + 'cookie-consent' => 'CookieConsent', | |
| 25 | + 'link-guard' => 'LinkGuard', | |
| 24 | 26 | ]); |
| 25 | 27 | |
| 26 | 28 | foreach ( $addons as $addon_name => $addon_class_name ) { |
| 27 | 29 | $addon_root_path = ABLOCKS_ADDONS_DIR_PATH . $addon_name . '/'; |
| @@ -36,9 +38,9 @@ | ||
| 36 | 38 | } |
| 37 | 39 | |
| 38 | 40 | public function get_all_addons() { |
| 39 | 41 | check_ajax_referer( 'ablocks_nonce', 'security' ); |
| 40 | - if ( ! current_user_can( 'manage_options' ) ) { | |
| 42 | + if ( ! current_user_can( 'ablocks_manage_addons' ) ) { | |
| 41 | 43 | wp_die(); |
| 42 | 44 | } |
| 43 | 45 | $ablocks_addons = json_decode( get_option( ABLOCKS_ADDONS_SETTINGS_NAME, '{}' ) ); |
| 44 | 46 | wp_send_json_success( $ablocks_addons ); |
| @@ -45,9 +47,11 @@ | ||
| 45 | 47 | } |
| 46 | 48 | |
| 47 | 49 | public function saved_addon_status() { |
| 48 | 50 | check_ajax_referer( 'ablocks_nonce', 'security' ); |
| 49 | - if ( ! current_user_can( 'manage_options' ) ) { | |
| 51 | + // ablocks_manage_addons is only ever granted to somebody who already holds | |
| 52 | + // install_plugins, because turning an add-on on can install one. | |
| 53 | + if ( ! current_user_can( 'ablocks_manage_addons' ) ) { | |
| 50 | 54 | wp_die(); |
| 51 | 55 | } |
| 52 | 56 | // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.MissingUnslash |
| 53 | 57 | $addon_name = ( isset( $_POST['addon_name'] ) ? sanitize_text_field( $_POST['addon_name'] ) : '' ); |
