| @@ -1,8 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | /** |
| 3 | 3 | * @package FireBox |
| 4 | - * @version 3.1.10 Free | |
| 4 | + * @version 3.1.14 Free | |
| 5 | 5 | * |
| 6 | 6 | * @author FirePlugins <[email protected]> |
| 7 | 7 | * @link https://www.fireplugins.com |
| 8 | 8 | * @copyright Copyright © 2026 FirePlugins All Rights Reserved |
| @@ -38,9 +38,23 @@ | ||
| 38 | 38 | 'delete_private_fireboxes', |
| 39 | 39 | 'delete_published_fireboxes', |
| 40 | 40 | 'delete_others_fireboxes', |
| 41 | 41 | 'edit_private_fireboxes', |
| 42 | - 'edit_published_fireboxes' | |
| 42 | + 'edit_published_fireboxes', | |
| 43 | + | |
| 44 | + // Standalone permission to run campaign-authored PHP (display condition and | |
| 45 | + // PHP Scripts). Deliberately NOT part of getPostTypeCapabilities(), so editing | |
| 46 | + // campaigns never grants it implicitly — only administrators get it by default, | |
| 47 | + // and a site owner can grant it to another role on purpose. | |
| 48 | + 'firebox_execute_php', | |
| 49 | + | |
| 50 | + // Standalone permission to emit campaign-authored JavaScript (the Custom | |
| 51 | + // JavaScript setting and the "Run Javascript" action). unfiltered_html also | |
| 52 | + // satisfies that gate; this capability exists so administrators keep custom JS | |
| 53 | + // where WordPress withholds unfiltered_html (multisite site admins, | |
| 54 | + // DISALLOW_UNFILTERED_HTML hosts), and so a site owner can grant it to a | |
| 55 | + // trusted role deliberately. Same rules as firebox_execute_php otherwise. | |
| 56 | + 'firebox_execute_js' | |
| 43 | 57 | ]; |
| 44 | 58 | } |
| 45 | 59 | |
| 46 | 60 | private function setup() |
