← All changes | includes/Ajax.php +5 -2 2.0.43 → 2.1.7 View file →

		@@ -3,16 +3,19 @@
3	3
4	4	class BBlocksAjax{
5	5	function __construct(){
6	6	add_action( 'wp_ajax_bBlocksUserRoles', [$this, 'bBlocksUserRoles'] );
7		- add_action( 'wp_ajax_nopriv_bBlocksUserRoles', [$this, 'bBlocksUserRoles'] );
8	7	}
9	8
10	9	function bBlocksUserRoles(){
11		- $nonce = sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ) ) ?? null;
	10	+ $nonce = sanitize_text_field( wp_unslash( $_POST['_wpnonce'] ?? '' ) );
12	11
13	12	if( !wp_verify_nonce( $nonce, 'wp_ajax' )){
14	13	wp_send_json_error( 'Invalid Request' );
	14	+ }
	15	+
	16	+ if ( !current_user_can( 'edit_posts' ) ) {
	17	+ wp_send_json_error( 'Unauthorized' );
15	18	}
16	19
17	20	global $wp_roles;
18	21	wp_send_json_success( $wp_roles->get_names() );