← All changes | includes/features/Duplicator/Duplicator.php +7 -7 51.1.35 → 51.1.83 View file →

		@@ -29,9 +29,9 @@
29	29	}
30	30
31	31	public static function addDuplicatorActionLink($action, $post)
32	32	{
33		- if (current_user_can('edit_posts') && post_type_supports($post->post_type, 'elementor')) {
	33	+ if (current_user_can('edit_post', $post->ID) && post_type_supports($post->post_type, 'elementor')) {
34	34
35	35	/** @noinspection HtmlUnknownTarget */
36	36	// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- Already escaped
37	37	$action[self::KNG_DUPLICATOR_ACTION] = sprintf(
		@@ -57,28 +57,28 @@
57	57	'paged' => (get_query_var('paged')) ? get_query_var('paged') : 1,
58	58	),
59	59	admin_url('admin.php')
60	60	),
61		- self::KNG_DUPLICATOR_ACTION
	61	+ self::KNG_DUPLICATOR_ACTION . '_' . absint($post_id)
62	62	);
63	63	}
64	64
65	65	public static function doDuplicateAction(): void
66	66	{
67		- if (!current_user_can('edit_posts')) {
68		- return;
69		- }
70		-
71	67	/** @noinspection SpellCheckingInspection */
72	68	$wp_nonce = isset($_GET['_wpnonce']) ? sanitize_text_field(wp_unslash($_GET['_wpnonce'])) : '';
73	69	$post_id = isset($_GET['post_id']) ? absint($_GET['post_id']) : 0;
74	70
75		- if (!wp_verify_nonce($wp_nonce, self::KNG_DUPLICATOR_ACTION)) {
	71	+ if (!$post_id || !wp_verify_nonce($wp_nonce, self::KNG_DUPLICATOR_ACTION . '_' . $post_id)) {
76	72	return;
77	73	}
78	74
79	75	$post = get_post($post_id);
80	76	if (is_null($post)) {
	77	+ return;
	78	+ }
	79	+
	80	+ if (!current_user_can('edit_post', $post_id) || !post_type_supports($post->post_type, 'elementor')) {
81	81	return;
82	82	}
83	83
84	84	$post = sanitize_post($post, 'db');