← All changes | includes/class-wp-admin.php +9 -1 1.2.31 → trunk View file →

		@@ -98,9 +98,17 @@
98	98	// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only routing check on admin_init; no state change.
99	99	if ( empty( $_GET['page'] ) || $_GET['page'] !== 'plugin-detective' ) {
100	100	return;
101	101	}
102		-
	102	+
	103	+ // Defense in depth: this handler mints an authenticated pd_api token, so gate
	104	+ // it on the same capability the API enforces. WordPress's admin-menu access
	105	+ // check already blocks low-privileged users from this page, but don't rely on
	106	+ // that ordering — never mint a token for a user who couldn't use it anyway.
	107	+ if ( ! current_user_can( 'activate_plugins' ) ) {
	108	+ return;
	109	+ }
	110	+
103	111	if ( class_exists( 'ITSEC_Core' ) && $itsec_storage = get_option( 'itsec-storage' ) ) {
104	112	if ( !empty( $itsec_storage['system-tweaks']['plugins_php'] ) ) {
105	113	echo '<h1>iThemes Security is preventing Plugin Detective from operating properly</h1>';
106	114	echo '<h3>To fix this: <code>Go to Security > Settings > System Tweaks</code> and <strong>uncheck</strong> the checkbox setting for <code>Disable PHP in Plugins</code></h3>';