| @@ -1,8 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | /** |
| 3 | 3 | * @package FireBox |
| 4 | - * @version 3.1.7 Free | |
| 4 | + * @version 3.1.14 Free | |
| 5 | 5 | * |
| 6 | 6 | * @author FirePlugins <[email protected]> |
| 7 | 7 | * @link https://www.fireplugins.com |
| 8 | 8 | * @copyright Copyright © 2026 FirePlugins All Rights Reserved |
| @@ -80,9 +80,18 @@ | ||
| 80 | 80 | |
| 81 | 81 | // Hide the close button. |
| 82 | 82 | $box->getCampaignParams()->set('closebutton.show', '0'); |
| 83 | 83 | |
| 84 | - $isEditor = isset($_GET['editor']) && sanitize_key(wp_unslash($_GET['editor'])); //phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 84 | + // The editor flag is a plain query argument, so it only counts for users who can edit this campaign. | |
| 85 | + $isEditor = isset($_GET['editor']) && sanitize_key(wp_unslash($_GET['editor'])) //phpcs:ignore WordPress.Security.NonceVerification.Recommended | |
| 86 | + && is_user_logged_in() && current_user_can('edit_post', $id); | |
| 87 | + | |
| 88 | + // Campaigns in test mode are only visible to users who can manage campaigns, embedded or not. | |
| 89 | + if (!$isEditor && $box->getCampaignParams()->get('testmode', false) == '1' && !(is_user_logged_in() && current_user_can('edit_fireboxes'))) | |
| 90 | + { | |
| 91 | + return; | |
| 92 | + } | |
| 93 | + | |
| 85 | 94 | if ($isEditor) |
| 86 | 95 | { |
| 87 | 96 | /** |
| 88 | 97 | * Ignore Opening/Closing Behavior and Display Conditions. |
