| @@ -14,8 +14,9 @@ | ||
| 14 | 14 | use Elementor\Utils; |
| 15 | 15 | use Elementor\User; |
| 16 | 16 | use Elementor\Core\Isolation\Wordpress_Adapter; |
| 17 | 17 | use Elementor\Core\Isolation\Wordpress_Adapter_Interface; |
| 18 | +use Elementor\Core\Isolation\Elementor_Adapter; | |
| 18 | 19 | use Elementor\Core\Isolation\Elementor_Adapter_Interface; |
| 19 | 20 | use Elementor\Modules\EditorOne\Classes\Menu_Data_Provider; |
| 20 | 21 | use Elementor\Includes\TemplateLibrary\Sources\AdminMenuItems\Editor_One_Saved_Templates_Menu; |
| 21 | 22 | use Elementor\Includes\TemplateLibrary\Sources\AdminMenuItems\Editor_One_Templates_Menu; |
| @@ -1266,10 +1267,8 @@ | ||
| 1266 | 1267 | * |
| 1267 | 1268 | * @param string $redirect_to The redirect URL. |
| 1268 | 1269 | * @param string $action The action being taken. |
| 1269 | 1270 | * @param array $post_ids The items to take the action on. |
| 1270 | - * | |
| 1271 | - * @return string The redirect URL, unchanged when the action is not handled here. | |
| 1272 | 1271 | */ |
| 1273 | 1272 | public function admin_export_multiple_templates( $redirect_to, $action, $post_ids ) { |
| 1274 | 1273 | if ( self::BULK_EXPORT_ACTION === $action ) { |
| 1275 | 1274 | $result = $this->export_multiple_templates( $post_ids ); |
| @@ -1277,10 +1276,8 @@ | ||
| 1277 | 1276 | // If you reach this line, the export failed |
| 1278 | 1277 | // PHPCS - Not user input. |
| 1279 | 1278 | wp_die( $result->get_error_message() ); // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped |
| 1280 | 1279 | } |
| 1281 | - | |
| 1282 | - return $redirect_to; | |
| 1283 | 1280 | } |
| 1284 | 1281 | |
| 1285 | 1282 | /** |
| 1286 | 1283 | * Print admin tabs. |
| @@ -2000,18 +1997,33 @@ | ||
| 2000 | 1997 | if ( null === $this->wordpress_adapter ) { |
| 2001 | 1998 | $this->set_wordpress_adapter( new WordPress_Adapter() ); |
| 2002 | 1999 | } |
| 2003 | 2000 | |
| 2001 | + if ( ! $this->should_check_permissions( $args ) ) { | |
| 2002 | + return true; | |
| 2003 | + } | |
| 2004 | + | |
| 2004 | 2005 | $post_id = intval( $args['template_id'] ); |
| 2005 | 2006 | $post_status = $this->wordpress_adapter->get_post_status( $post_id ); |
| 2007 | + $is_private_or_non_published = ( 'private' === $post_status && ! $this->wordpress_adapter->current_user_can( 'read_private_posts', $post_id ) ) || ( 'publish' !== $post_status ); | |
| 2006 | 2008 | |
| 2007 | - if ( 'publish' === $post_status && ! post_password_required( $post_id ) ) { | |
| 2008 | - return true; | |
| 2009 | + $can_read_template = ! $is_private_or_non_published || $this->wordpress_adapter->current_user_can( 'edit_post', $post_id ); | |
| 2010 | + | |
| 2011 | + return apply_filters( 'elementor/template-library/is_allowed_to_read_template', $can_read_template, $args ); | |
| 2012 | + } | |
| 2013 | + | |
| 2014 | + private function should_check_permissions( array $args ): bool { | |
| 2015 | + if ( null === $this->elementor_adapter ) { | |
| 2016 | + $this->set_elementor_adapter( new Elementor_Adapter() ); | |
| 2009 | 2017 | } |
| 2010 | 2018 | |
| 2011 | - $can_read_template = $this->wordpress_adapter->current_user_can( 'edit_post', $post_id ); | |
| 2019 | + $check_permissions = isset( $args['check_permissions'] ) && false === $args['check_permissions']; | |
| 2012 | 2020 | |
| 2013 | - return apply_filters( 'elementor/template-library/is_allowed_to_read_template', $can_read_template, $args ); | |
| 2021 | + if ( $check_permissions ) { | |
| 2022 | + return false; | |
| 2023 | + } | |
| 2024 | + | |
| 2025 | + return true; | |
| 2014 | 2026 | } |
| 2015 | 2027 | |
| 2016 | 2028 | public function set_wordpress_adapter( Wordpress_Adapter_Interface $wordpress_adapter ) { |
| 2017 | 2029 | $this->wordpress_adapter = $wordpress_adapter; |
