← All changes
|
admin/section/class-convertkit-admin-section-form-entries.php
+6
-1
3.3.2
→
3.4.6
View file →
| @@ -254,8 +254,13 @@ | ||
| 254 | 254 | if ( ! isset( $_REQUEST['_wpnonce'] ) || ! wp_verify_nonce( sanitize_key( wp_unslash( $_REQUEST['_wpnonce'] ) ), 'bulk-convertkit-items' ) ) { |
| 255 | 255 | return; |
| 256 | 256 | } |
| 257 | 257 | |
| 258 | + // Bail if the user isn't permitted to manage form entries. | |
| 259 | + if ( ! current_user_can( 'manage_options' ) ) { | |
| 260 | + return; | |
| 261 | + } | |
| 262 | + | |
| 258 | 263 | // Bail if no bulk action is set. |
| 259 | 264 | $bulk_action = isset( $_REQUEST['action'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['action'] ) ) : ''; |
| 260 | 265 | if ( empty( $bulk_action ) ) { |
| 261 | 266 | return; |
| @@ -278,9 +283,9 @@ | ||
| 278 | 283 | // Convert entries to CSV string. |
| 279 | 284 | $csv = $form_entries->get_csv_string( $entries ); |
| 280 | 285 | |
| 281 | 286 | // Force download with output. |
| 282 | - header( 'Content-type: application/x-msdownload' ); | |
| 287 | + header( 'Content-Type: text/csv; charset=utf-8' ); | |
| 283 | 288 | header( 'Content-Disposition: attachment; filename=kit-form-entries-export.csv' ); |
| 284 | 289 | header( 'Pragma: no-cache' ); |
| 285 | 290 | header( 'Expires: 0' ); |
| 286 | 291 | echo $csv; // phpcs:ignore WordPress.Security.EscapeOutput |