| @@ -222,10 +222,8 @@ | ||
| 222 | 222 | |
| 223 | 223 | // Show a warning if the API credentials haven't been set. |
| 224 | 224 | $settings = new ConvertKit_Settings(); |
| 225 | 225 | if ( ! $settings->has_access_and_refresh_token() ) { |
| 226 | - $post_type = get_post_type_object( $post->post_type ); | |
| 227 | - $api = new ConvertKit_API_V4( CONVERTKIT_OAUTH_CLIENT_ID, CONVERTKIT_OAUTH_CLIENT_REDIRECT_URI ); | |
| 228 | 226 | include CONVERTKIT_PLUGIN_PATH . '/views/backend/post/no-api-key.php'; |
| 229 | 227 | return; |
| 230 | 228 | } |
| 231 | 229 | |
| @@ -278,8 +276,13 @@ | ||
| 278 | 276 | } |
| 279 | 277 | |
| 280 | 278 | // Bail if no ConvertKit settings were posted. |
| 281 | 279 | if ( ! isset( $_POST['wp-convertkit'] ) ) { |
| 280 | + return; | |
| 281 | + } | |
| 282 | + | |
| 283 | + // Bail if the current user cannot edit this Post. | |
| 284 | + if ( ! current_user_can( 'edit_post', $post_id ) ) { | |
| 282 | 285 | return; |
| 283 | 286 | } |
| 284 | 287 | |
| 285 | 288 | // Save Post's settings. |
