← All changes | hooks/admin/ajax.php +21 -2 1.4.2 → 1.4.3 View file →

		@@ -2,8 +2,27 @@
2	2
3	3	defined( 'ABSPATH' ) || exit;
4	4
5	5	/**
	6	+ * Returns the capability required to use the Datafeedr API Tools AJAX actions.
	7	+ *
	8	+ * @since 1.4.3
	9	+ *
	10	+ * @return string
	11	+ */
	12	+function dfrapi_tools_capability(): string {
	13	+
	14	+ /**
	15	+ * Filters the capability required to delete cached API data and test the API connection.
	16	+ *
	17	+ * @since 1.4.3
	18	+ *
	19	+ * @param string $capability Default 'manage_options'.
	20	+ */
	21	+ return (string) apply_filters( 'dfrapi_tools_capability', 'manage_options' );
	22	+}
	23	+
	24	+/**
6	25	* Delete cached API data.
7	26	*
8	27	* We can only delete if user has API requests remaining.
9	28	* This is because we'll need to make 1 request to rebuild 'dfrapi_account'.
		@@ -11,9 +30,9 @@
11	30	function dfrapi_delete_cached_api_data() {
12	31
13	32	check_ajax_referer( 'dfrapi_ajax_nonce', 'dfrapi_security' );
14	33
15		- if ( ! current_user_can( 'edit_posts' ) ) {
	34	+ if ( ! current_user_can( dfrapi_tools_capability() ) ) {
16	35	_e( 'You do not have permission to perform this action.', 'datafeedr-api' );
17	36	die;
18	37	}
19	38
		@@ -50,9 +69,9 @@
50	69	function dfrapi_test_api_connection() {
51	70
52	71	check_ajax_referer( 'dfrapi_ajax_nonce', 'dfrapi_security' );
53	72
54		- if ( ! current_user_can( 'edit_posts' ) ) {
	73	+ if ( ! current_user_can( dfrapi_tools_capability() ) ) {
55	74	_e( 'You do not have permission to perform this action.', 'datafeedr-api' );
56	75	die;
57	76	}
58	77