← All changes | modules/elementor/classes/class-cartflows-elementor-editor.php +15 -2 3.1.4 → 3.3.0 View file →

		@@ -146,10 +146,23 @@
146	146
147	147	add_action( 'cartflows_elementor_before_checkout_shortcode', array( $this, 'before_checkout_shortcode_actions' ) );
148	148	add_action( 'cartflows_elementor_before_optin_shortcode', array( $this, 'before_optin_shortcode_actions' ) );
149	149
150		- /* Thank you filters */
151		- add_filter( 'cartflows_show_demo_order_details', '__return_true' );
	150	+ /*
	151	+ * Thank you filters.
	152	+ *
	153	+ * This makes the order-details shortcode fall back to the store's most recent
	154	+ * real order, so it is kept to users who can actually edit steps rather than to
	155	+ * any admin-side request that merely carries an Elementor action.
	156	+ *
	157	+ * The post-type half of the gate is already enforced upstream: this class is
	158	+ * only loaded by Cartflows_El_Widgets_Loader::include_widgets_files(), which
	159	+ * runs from register_widgets() after confirming the global post is a
	160	+ * cartflows_step. The check here is the capability half.
	161	+ */
	162	+ if ( current_user_can( 'cartflows_manage_flows_steps' ) ) {
	163	+ add_filter( 'cartflows_show_demo_order_details', '__return_true' );
	164	+ }
152	165	}
153	166	//phpcs:enable WordPress.Security.NonceVerification.Recommended
154	167	}
155	168	}