← All changes | app/Http/Controllers/AddonsController.php +28 -1 1.4.1 → 1.6.5 View file →

		@@ -123,9 +123,10 @@
123	123	'fluent-smtp',
124	124	'fluent-community',
125	125	'fluent-security',
126	126	'fluentform',
127		- 'fluent-support'
	127	+ 'fluent-support',
	128	+ 'fluent-player'
128	129	]);
129	130
130	131	if (!$addon || !in_array($addon, $listedPlugins)) {
131	132	return $this->sendError([
		@@ -130,8 +131,34 @@
130	131	if (!$addon || !in_array($addon, $listedPlugins)) {
131	132	return $this->sendError([
132	133	'message' => __('This addon cannot be installed at this time', 'fluent-cart')
133	134	]);
	135	+ }
	136	+
	137	+ // integrations/manage is a FluentCart permission and does not imply the
	138	+ // WordPress capability to put executable code on the site: a Manager is not
	139	+ // necessarily an administrator.
	140	+ //
	141	+ // installPlugin() always ends by activating the plugin — freshly downloaded
	142	+ // or already on disk — so activate_plugins is required either way, and an
	143	+ // absent addon needs install_plugins on top for the download itself. The two
	144	+ // are separate capabilities a custom role can hold independently.
	145	+ if (!function_exists('get_plugins')) {
	146	+ require_once ABSPATH . 'wp-admin/includes/plugin.php';
	147	+ }
	148	+
	149	+ $isInstalled = array_key_exists($addon . '/' . $addon . '.php', get_plugins());
	150	+
	151	+ if (!current_user_can('activate_plugins')) {
	152	+ return $this->sendError([
	153	+ 'message' => __('You do not have permission to activate plugins.', 'fluent-cart')
	154	+ ], 403);
	155	+ }
	156	+
	157	+ if (!$isInstalled && !current_user_can('install_plugins')) {
	158	+ return $this->sendError([
	159	+ 'message' => __('You do not have permission to install plugins.', 'fluent-cart')
	160	+ ], 403);
134	161	}
135	162
136	163	$result = (new BackgroundInstaller())->installPlugin($addon);
137	164