← All changes | includes/admin/emails/ajax-handler.php +8 -0 2.3.2 → 4.16.9 View file →

		@@ -13,10 +13,18 @@
13	13	/**
14	14	* Enabled & disable notification
15	15	*
16	16	* @since 2.0
	17	+ * @since 4.15.4 Add nonce verification.
17	18	*/
18	19	function give_set_notification_status_handler() {
	20	+ check_ajax_referer( 'give_set_notification_status', '_ajax_nonce' );
	21	+
	22	+ // Is user have permission to edit give setting.
	23	+ if ( ! current_user_can( 'manage_give_settings' ) ) {
	24	+ return;
	25	+ }
	26	+
19	27	$notification_id = isset( $_POST['notification_id'] ) ? give_clean( $_POST['notification_id'] ) : '';
20	28	if ( ! empty( $notification_id ) && give_update_option( "{$notification_id}_notification", give_clean( $_POST['status'] ) ) ) {
21	29	wp_send_json_success();
22	30	}