← All changes | includes/ajax.php +9 -1 2.9.0 → 2.13.1 View file →

		@@ -53,9 +53,17 @@
53	53	}
54	54
55	55	public function get_storeengine_terms() {
56	56	check_ajax_referer( 'ablocks_nonce', 'security' );
57		- $cats = Helper::get_terms_list( 'storeengine_product_category' );
	57	+
	58	+ // The nonce alone only proves the request came from an aBlocks screen,
	59	+ // not that this user may read the catalogue — and every logged-in user
	60	+ // is handed that nonce. Matches get_academy_terms() above.
	61	+ if ( ! current_user_can( 'edit_posts' ) ) {
	62	+ die();
	63	+ }
	64	+
	65	+ $cats = Helper::get_terms_list( 'storeengine_product_category' );
58	66	$tags = Helper::get_terms_list( 'storeengine_product_tag' );
59	67
60	68	wp_send_json_success(array(
61	69	'categories' => $cats,