← All changes | includes/core/class-plugin-usage-tracker.php +7 -0 1.28.0 → 2.7.0 View file →

		@@ -806,8 +806,15 @@
806	806	* @since 1.12.0
807	807	*/
808	808	public function deactivate_reasons_form_submit() {
809	809	check_ajax_referer('wpins_deactivation_nonce', 'security');
	810	+
	811	+ // The form is only reachable from the plugins screen; require the same
	812	+ // capability that screen does so the nonce isn't the only control.
	813	+ if (!current_user_can('activate_plugins')) {
	814	+ wp_die('', '', ['response' => 403]);
	815	+ }
	816	+
810	817	if (isset($_POST['values'])) {
811	818	$values = sanitize_text_field(wp_unslash($_POST['values']));
812	819	update_option('wpins_deactivation_reason_' . $this->plugin_name, $values);
813	820	}