← All changes | Inc/Core/Admin/Capabilities.php +43 -11 3.1.9 → 3.1.14 View file →

		@@ -1,8 +1,8 @@
1	1	<?php
2	2	/**
3	3	* @package FireBox
4		- * @version 3.1.9 Free
	4	+ * @version 3.1.14 Free
5	5	*
6	6	* @author FirePlugins <[email protected]>
7	7	* @link https://www.fireplugins.com
8	8	* @copyright Copyright © 2026 FirePlugins All Rights Reserved
		@@ -38,9 +38,23 @@
38	38	'delete_private_fireboxes',
39	39	'delete_published_fireboxes',
40	40	'delete_others_fireboxes',
41	41	'edit_private_fireboxes',
42		- 'edit_published_fireboxes'
	42	+ 'edit_published_fireboxes',
	43	+
	44	+ // Standalone permission to run campaign-authored PHP (display condition and
	45	+ // PHP Scripts). Deliberately NOT part of getPostTypeCapabilities(), so editing
	46	+ // campaigns never grants it implicitly — only administrators get it by default,
	47	+ // and a site owner can grant it to another role on purpose.
	48	+ 'firebox_execute_php',
	49	+
	50	+ // Standalone permission to emit campaign-authored JavaScript (the Custom
	51	+ // JavaScript setting and the "Run Javascript" action). unfiltered_html also
	52	+ // satisfies that gate; this capability exists so administrators keep custom JS
	53	+ // where WordPress withholds unfiltered_html (multisite site admins,
	54	+ // DISALLOW_UNFILTERED_HTML hosts), and so a site owner can grant it to a
	55	+ // trusted role deliberately. Same rules as firebox_execute_php otherwise.
	56	+ 'firebox_execute_js'
43	57	];
44	58	}
45	59
46	60	private function setup()
		@@ -50,12 +64,9 @@
50	64	$admin = get_role('administrator');
51	65
52	66	if ($admin)
53	67	{
54		- foreach ($capabilities as $cap)
55		- {
56		- $admin->add_cap($cap);
57		- }
	68	+ self::addCapabilities($admin, $capabilities);
58	69	}
59	70	else
60	71	{
61	72	$roles = get_editable_roles();
		@@ -65,14 +76,11 @@
65	76	if (isset($data['capabilities']['manage_options']) && $data['capabilities']['manage_options'])
66	77	{
67	78	$role = get_role($role_name);
68	79
69		- foreach ($capabilities as $cap)
	80	+ if ($role)
70	81	{
71		- if ($role)
72		- {
73		- $role->add_cap($cap);
74		- }
	82	+ self::addCapabilities($role, $capabilities);
75	83	}
76	84	}
77	85	}
78	86	}
		@@ -77,6 +85,30 @@
77	85	}
78	86	}
79	87
80	88	wp_get_current_user()->get_role_caps();
	89	+ }
	90	+
	91	+ /**
	92	+ * Adds the capabilities a role is missing.
	93	+ *
	94	+ * add_cap() writes the role option on every call, and this now runs on
	95	+ * every site of a network, so only the missing ones are added.
	96	+ *
	97	+ * @param \WP_Role $role
	98	+ * @param array $capabilities
	99	+ *
	100	+ * @return void
	101	+ */
	102	+ private static function addCapabilities($role, $capabilities)
	103	+ {
	104	+ foreach ($capabilities as $cap)
	105	+ {
	106	+ if ($role->has_cap($cap))
	107	+ {
	108	+ continue;
	109	+ }
	110	+
	111	+ $role->add_cap($cap);
	112	+ }
81	113	}
82	114	}