| @@ -331,8 +331,24 @@ | ||
| 331 | 331 | */ |
| 332 | 332 | function gutenberg_experiments_intercept_render() { |
| 333 | 333 | // phpcs:ignore WordPress.Security.NonceVerification.Recommended |
| 334 | 334 | if ( isset( $_GET['page'] ) && 'experiments' === $_GET['page'] ) { |
| 335 | + // The page renders outside the menu page callback flow, so it must | |
| 336 | + // enforce authentication and capability checks itself. Without this, | |
| 337 | + // any admin entry point firing `admin_init` (such as admin-post.php, | |
| 338 | + // which serves logged-out requests) would render the page for | |
| 339 | + // unauthenticated visitors. | |
| 340 | + if ( ! is_user_logged_in() ) { | |
| 341 | + auth_redirect(); | |
| 342 | + } | |
| 343 | + | |
| 344 | + if ( ! current_user_can( 'manage_options' ) ) { | |
| 345 | + wp_die( | |
| 346 | + __( 'Sorry, you are not allowed to access this page.' ), | |
| 347 | + 403 | |
| 348 | + ); | |
| 349 | + } | |
| 350 | + | |
| 335 | 351 | gutenberg_experiments_render_page(); |
| 336 | 352 | exit; |
| 337 | 353 | } |
| 338 | 354 | } |
