← All changes
|
admin/section/class-convertkit-admin-section-general.php
+7
-2
3.4.0
→
3.4.6
View file →
| @@ -202,13 +202,18 @@ | ||
| 202 | 202 | if ( ! $this->on_settings_screen( $this->name ) ) { |
| 203 | 203 | return; |
| 204 | 204 | } |
| 205 | 205 | |
| 206 | + // Bail if the user is not permitted to disconnect the Plugin from a Kit account. | |
| 207 | + if ( ! current_user_can( 'manage_options' ) ) { | |
| 208 | + return; | |
| 209 | + } | |
| 210 | + | |
| 206 | 211 | // Bail if nonce verification fails. |
| 207 | 212 | if ( ! isset( $_REQUEST['_convertkit_settings_oauth_disconnect'] ) ) { |
| 208 | 213 | return; |
| 209 | 214 | } |
| 210 | - if ( ! wp_verify_nonce( sanitize_key( $_REQUEST['_convertkit_settings_oauth_disconnect'] ), 'convertkit-oauth-disconnect' ) ) { | |
| 215 | + if ( ! wp_verify_nonce( sanitize_key( $_REQUEST['_convertkit_settings_oauth_disconnect'] ), CONVERTKIT_NONCE_ACTION_OAUTH_DISCONNECT ) ) { | |
| 211 | 216 | return; |
| 212 | 217 | } |
| 213 | 218 | |
| 214 | 219 | // Get Settings class. |
| @@ -671,9 +676,9 @@ | ||
| 671 | 676 | esc_url( |
| 672 | 677 | add_query_arg( |
| 673 | 678 | array( |
| 674 | 679 | 'page' => '_wp_convertkit_settings', |
| 675 | - '_convertkit_settings_oauth_disconnect' => wp_create_nonce( 'convertkit-oauth-disconnect' ), | |
| 680 | + '_convertkit_settings_oauth_disconnect' => wp_create_nonce( CONVERTKIT_NONCE_ACTION_OAUTH_DISCONNECT ), | |
| 676 | 681 | ), |
| 677 | 682 | 'options-general.php' |
| 678 | 683 | ) |
| 679 | 684 | ), |