| @@ -308,8 +308,12 @@ | ||
| 308 | 308 | function gamipress_get_log_extra_data_ui_ajax_handler() { |
| 309 | 309 | // Security check, forces to die if not security passed |
| 310 | 310 | check_ajax_referer( 'gamipress_admin', 'nonce' ); |
| 311 | 311 | |
| 312 | + // Check user capabilities | |
| 313 | + if( ! current_user_can( gamipress_get_manager_capability() ) ) | |
| 314 | + wp_send_json_error( __( 'You are not allowed to perform this action.', 'gamipress' ) ); | |
| 315 | + | |
| 312 | 316 | ct_setup_table( 'gamipress_logs' ); |
| 313 | 317 | |
| 314 | 318 | $ct_object = ct_get_object( absint( $_REQUEST['object_id'] ) ); |
| 315 | 319 | |
