← All changes | app/Controllers/Admin/Ajax/DefaultTemplate.php +4 -2 2.1.3 → 2.1.13 View file →

		@@ -33,12 +33,14 @@
33	33	*
34	34	* @return void
35	35	*/
36	36	public function response() {
37		- if ( ! Fns::verify_nonce() ) {
	37	+ if ( ! wp_verify_nonce( Fns::get_nonce(), rtsb()->nonceText ) ) {
38	38	wp_send_json_error();
39	39	}
40		-
	40	+ if ( ! current_user_can( 'manage_options' ) ) {
	41	+ wp_send_json_error();
	42	+ }
41	43	$page_type = isset( $_POST['template_type'] ) ? sanitize_text_field( wp_unslash( $_POST['template_type'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Missing
42	44	$default_page_id = isset( $_POST['set_default_page_id'] ) && 'publish' === get_post_status( $_POST['set_default_page_id'] ) ? absint( wp_unslash( $_POST['set_default_page_id'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Missing
43	45	$page_id = isset( $_POST['page_id'] ) && 'publish' === get_post_status( $_POST['page_id'] ) ? absint( wp_unslash( $_POST['page_id'] ) ) : null; // phpcs:ignore WordPress.Security.NonceVerification.Missing
44	46