| @@ -118,8 +118,14 @@ | ||
| 118 | 118 | * @return string|void |
| 119 | 119 | */ |
| 120 | 120 | function charitable_update_debug_window_ajax() { |
| 121 | 121 | |
| 122 | + check_ajax_referer( 'charitable-builder', 'nonce' ); | |
| 123 | + | |
| 124 | + if ( ! current_user_can( 'manage_charitable_settings' ) ) { | |
| 125 | + wp_send_json_error(); | |
| 126 | + } | |
| 127 | + | |
| 122 | 128 | // data to post is likely be submitted form data from an ajax request. |
| 123 | 129 | $data = false; |
| 124 | 130 | |
| 125 | 131 | if ( isset( $_POST['data'] ) && is_string( $_POST['data'] ) ) { // @codingStandardsIgnoreLine |
| @@ -136,9 +142,8 @@ | ||
| 136 | 142 | wp_send_json_success( $output ); |
| 137 | 143 | exit; |
| 138 | 144 | } |
| 139 | 145 | add_action( 'wp_ajax_charitable_update_debug_window_ajax', 'charitable_update_debug_window_ajax' ); |
| 140 | -add_action( 'wp_ajax_nopriv_charitable_update_debug_window_ajax', 'charitable_update_debug_window_ajax' ); | |
| 141 | 146 | |
| 142 | 147 | /** |
| 143 | 148 | * Log helper. |
| 144 | 149 | * |
