| @@ -189,8 +189,11 @@ | ||
| 189 | 189 | */ |
| 190 | 190 | public function getSettingsAjax() |
| 191 | 191 | { |
| 192 | 192 | $formId = absint($this->request->get('form_id')); |
| 193 | + // SECURITY (H-02): this handler is currently unregistered, but it read form CSS/JS with no | |
| 194 | + // capability check. Guard it so it is safe if ever wired to an action. | |
| 195 | + \FluentForm\App\Modules\Acl\Acl::verify('fluentform_forms_manager', $formId); | |
| 193 | 196 | wp_send_json_success([ |
| 194 | 197 | 'custom_css' => $this->getData($formId, '_custom_form_css'), |
| 195 | 198 | 'custom_js' => $this->getData($formId, '_custom_form_js'), |
| 196 | 199 | ], 200); |
| @@ -200,8 +203,11 @@ | ||
| 200 | 203 | * Save settings for a particular form by id |
| 201 | 204 | */ |
| 202 | 205 | public function saveSettingsAjax() |
| 203 | 206 | { |
| 207 | + // SECURITY (H-02): this handler is currently unregistered; guard it (forms_manager scope) | |
| 208 | + // so it is safe if ever wired. The unfiltered_html gate below still applies on top. | |
| 209 | + \FluentForm\App\Modules\Acl\Acl::verify('fluentform_forms_manager', absint($this->request->get('form_id'))); | |
| 204 | 210 | if (!fluentformCanUnfilteredHTML()) { |
| 205 | 211 | wp_send_json_error([ |
| 206 | 212 | 'message' => __('You need unfiltered_html permission to save Custom CSS & JS', 'fluentform'), |
| 207 | 213 | ], 423); |
